{ "Event": { "published": true, "date": "2023-05-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-08", "timestamp": 1683590581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "de210239-c679-4637-b140-833df31b3c8b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc7eff8-ed66-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683525832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525832, "uuid": "8d50795c-8a92-402b-9ee3-be3f2b6b7468", "comment": "Malware payload (Smoke Loader)", "value": "40179a5e8f84903509cab144e1a2e46a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525832, "uuid": "ffe87b79-b71b-4051-bdc4-81cf08e617b5", "comment": "Malware payload (Smoke Loader)", "value": "00997f8016ded8b467d957d8807032afd3e496dd94c3c9ec1349750abade4f39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525832, "uuid": "b2dfdb42-65ca-4022-82d8-230a48309eed", "comment": "Malware payload (Smoke Loader)", "value": "cd4e1cc587e250dbb8ef3232e9c84886fcf74335", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525832, "uuid": "1bd4de2e-7b3b-4d4f-863c-56dca2953ca7", "comment": "Malware payload (Smoke Loader)", "value": "63bc39158aacb02876c54f8dc5c0342a4f92c874e87c3026f0ec5a1e7a8198bdd2e8d338e58f868c9ed24cd7a8984105", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525832, "uuid": "2332c4f5-6487-48bf-a2d4-bbbd1af128f3", "value": "T150547D2272F0A872D5264B32CE19C6E4BA1EFCA1DF5527E7324C6ADF0A701E1D136716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525832, "uuid": "027c8a1f-bcea-4f60-951f-a711d71b06d2", "value": "d5316530de8caf207058f054d9fc1dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525832, "uuid": "af74a4fa-0715-49a1-a12d-99bc12b60f3d", "value": "3072:rUgKk8rGCpRkgjDc7tamUAVD6pWUYCMBa59p85IChYmuThaIgYAxWmY0ywX/Hrq:BmpTXUt1Lyh3Mc98dhnuT8IgYAAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683525832, "uuid": "8f8555f2-f752-4d89-8fcb-47b12f88a412", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683525832, "uuid": "55feb904-be6f-47fe-a60c-6e0efdd9e775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525832, "uuid": "9632d279-f2b1-4ffc-b3c2-3e1a816d3e62", "value": "40179a5e8f84903509cab144e1a2e46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479aadaa-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WannaCry)", "timestamp": 1683516457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516457, "uuid": "d8b53454-9a79-4f98-a809-eedf226adb90", "comment": "Malware payload (WannaCry)", "value": "31510bd9b6f5c297c64492ab86aacaa1", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516457, "uuid": "ba921bda-127e-4fe9-9ab2-636f6c7d1740", "comment": "Malware payload (WannaCry)", "value": "011c24bce46c2ded7236482e0e36530dd27c937e31a0896e91659d9acd7ceb69", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516457, "uuid": "bb682f99-52d8-4437-be9b-eb4f2e344eda", "comment": "Malware payload (WannaCry)", "value": "95f2b6d6fa1c48d71d2154270ba77aa3af74adc1", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516457, "uuid": "4c4db617-c3ed-47aa-880e-61f55d7e77cf", "comment": "Malware payload (WannaCry)", "value": "a4b81ee069b37743d169c5955816a588e1cf8b83bc14bb123e92f8c0b3ead99095dcee8f9fb62a4247a46fbd40c26a7c", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516457, "uuid": "3cdb579f-a483-4568-baf9-1d3476a3e304", "value": "T1C8063394612CB2FCF0440EB44473896AB7B33C69A7BA5E1F9BC086670D53B5BAFD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516457, "uuid": "466049d8-1aa9-46dd-9cab-b0f35af7051a", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516457, "uuid": "928a2b94-980f-4b0b-9fb5-ef41322c4aa9", "value": "98304:qDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:qDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516457, "uuid": "0cefd17e-4ff6-4bd9-bdc8-2a7730e9498b", "value": 3751936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516457, "uuid": "a5ca1cdd-bcc7-4683-94cb-d84e77c13d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516457, "uuid": "45d91d85-6fdb-48e5-897b-9c1a146f3695", "value": "2023-05-07_31510bd9b6f5c297c64492ab86aacaa1_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251ac4de-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568798, "uuid": "b3d36fbc-9d0e-4eae-8108-78ecd4c191ee", "comment": "Malware payload (Gafgyt)", "value": "75b2faea09a839982047697ad46a5b0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568798, "uuid": "870773f7-7eeb-444d-b18a-381e047c6eba", "comment": "Malware payload (Gafgyt)", "value": "02524e76a81250423517bbd962d33b60b879e3d29ed4900d6f744179e66d0fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568798, "uuid": "b89f4151-0934-4ed8-855e-9e43799407c5", "comment": "Malware payload (Gafgyt)", "value": "aaa5d9f63fd3b58b652f7f59ad415ca51d3ab593", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568798, "uuid": "2c4e6783-7d66-4870-81b7-eee7677be326", "comment": "Malware payload (Gafgyt)", "value": "59b96441b719f5758f6aa4fd8583b074874112bbbf990883e5376c850894db357faf155d858c288918e5fa38c19a5a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568798, "uuid": "b474d170-b166-47d1-ac47-272e87cf4caf", "value": "T108B32B4796A99FB3C086BAB515EB59300722ED120F2F1A9621387BF4437F5CD740EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568798, "uuid": "dc2a0ad1-03e8-4602-8d6c-4a6037329de0", "value": "1536:MqfWC0o17MhzlJpKgElT0T6Rk0MgPCbB5EDQEPWmmycgYVLu1IPYC:lfHdBeQglT6zPQcQgWmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568798, "uuid": "afa11000-31ef-4af9-b779-0400a0d720e6", "value": 108482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568798, "uuid": "4a1b9f09-eccc-41ec-a11c-dab67931b938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568798, "uuid": "1711b424-9334-4777-aa66-afe228e7f626", "value": "75b2faea09a839982047697ad46a5b0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330e5e36-ed9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683549923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683549923, "uuid": "bd21df00-ab4a-4581-8c3e-82417e967233", "comment": "Malware payload (AsyncRAT)", "value": "07c603fa85542e5875569659cae88e4a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683549923, "uuid": "8a6ccf5a-fa06-48d4-b362-f08a25da7c84", "comment": "Malware payload (AsyncRAT)", "value": "029166bde069ee02c46c3541bfe4f9ff8c97d9ff353f814c716e2d1fbdb29c1f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683549923, "uuid": "fb3606bb-cffc-46ab-9de6-8808efcd130d", "comment": "Malware payload (AsyncRAT)", "value": "ce6ee24d1084fdec9aab70b691d1daf36f765983", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683549923, "uuid": "8e656e08-3299-492e-adc7-c75476f6f907", "comment": "Malware payload (AsyncRAT)", "value": "e914b6e24d625779f9604a280854c2a1f77d5a3111829a0239a7e254d757aaabfcafc00282fb71117a9a5ae573b72779", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683549923, "uuid": "47948e3d-f062-45d1-a19c-cd735db31c6a", "value": "T17D251242F6D288F1E1731A360938B724A57DBD711E34CA2EA3D47E2DD972191E221F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683549923, "uuid": "75bafb6c-e4cb-4b9f-8225-75377e99ca93", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683549923, "uuid": "15241314-1fe8-4de6-b0fc-a52b381804ea", "value": "24576:wNA3R5drXUDjLLBEl4fcGWDNdxf9Cfs4foN61HH:p5KzBW4fcGWDXDOsuoN6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683549923, "uuid": "089ce0a7-2037-4a62-aa33-27a2246f4ae2", "value": 1006000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683549923, "uuid": "ecca9cf3-435a-4893-a84c-162959ad26ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683549923, "uuid": "0637daae-88ee-408f-a757-f76f43052675", "value": "ODEME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18329643-ede3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683579513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683579513, "uuid": "339d0107-2ebf-47af-b11e-bab152be458f", "comment": "Malware payload", "value": "ff5a156c1fd9675a8c4a6a589678bebd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683579513, "uuid": "cc23d0d2-5f5d-4355-8614-7eb4208beaf2", "comment": "Malware payload", "value": "02d266017daa63108d520772e541f73a41b6d93808995d724a3e14db53696edc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683579513, "uuid": "9630b00b-89e3-4d24-8325-243ec8b19974", "comment": "Malware payload", "value": "88bf6caea151239474594fda19b35bdb54913c53", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683579513, "uuid": "513333c7-2760-475a-b3cc-139657b41ead", "comment": "Malware payload", "value": "126a873d7230a54ea26b47d381ff33296804d34f965b8892a8f9fc8a794925e40f25df1bb0af5ca75c816f41dacf623e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683579513, "uuid": "951911d4-f020-4c6e-bce5-ba6690b12170", "value": "T199273321A387C522D66C457BE858FE1E0538BF63073051D3B7E97DBA84F4CC266B5A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683579513, "uuid": "32c13e00-72f5-44ef-aa70-6f32efad5f2e", "value": "393216:C/NsGGTOs66JMk/XiepGEWyfrGlj40TESxPQBPA9wR43yl:57OsjyFeBzyJTE6P4AG7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683579513, "uuid": "c63fe5ae-4ca6-45e0-b088-42d3c0ea7232", "value": 20517888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683579513, "uuid": "e7181f56-4bca-40ec-a13b-cf93fde8578b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683579513, "uuid": "fc0ec72d-4c32-4f5b-bb76-f61b47a1a080", "value": "23Visualizar_Nota_Fiscal.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68680c17-ed6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683527679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527679, "uuid": "b1fba957-e56a-4ce0-8803-ef9d0826dccf", "comment": "Malware payload (AgentTesla)", "value": "a99818b6c355b5cbd62eb74d802e0f5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527679, "uuid": "97792ca8-9007-4d37-a156-d27dd2c85a11", "comment": "Malware payload (AgentTesla)", "value": "02fa0fa7b89d8ad41c32e0613ef1bb1c38d9b93ea98d9295b7d61c2ca400a300", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527679, "uuid": "1768c827-ae3b-44db-aa09-e1547c4bd9fb", "comment": "Malware payload (AgentTesla)", "value": "e23ff2e7bb3d481b90f8682e9a152dc86423d87e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527679, "uuid": "17ebf8b6-792a-4195-8d1e-2c31bc935439", "comment": "Malware payload (AgentTesla)", "value": "d70212b5eb401eeda286fa3ac5b963b6c1c0f5172783c7baa7cf3d1be637d63286add7ab7b29c862196b3688c1772780", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527679, "uuid": "9fc03334-8e3b-43d8-9616-8d814dff2dad", "value": "T149C4029821B54BB9F81B9FF82878F1001371B167D8D1FA651F72A0C92F9FB904E8855B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527679, "uuid": "de4c035a-6eab-405b-bd09-0d58688bff44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527679, "uuid": "7cdb1fa7-2389-49cc-a3f7-8832730b4a4f", "value": "12288:2riQBsuvXMx6Jb6zL0gciYe7WzpiLqh3zFh:aSuv8xQ66kW9iLqhjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527679, "uuid": "0b9ba97d-9963-408e-b438-40ffe6e8d383", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527679, "uuid": "1a28b185-aadf-46c9-b15b-315a0e0bb57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527679, "uuid": "dc96df5c-caa0-427f-871c-ae8ede55a228", "value": "swift copy $37,000.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70c1beb-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683504645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504645, "uuid": "ffabddb6-7ce3-44e1-9432-56456bc7b4d0", "comment": "Malware payload (Mirai)", "value": "ab2528b2debe6b91e401b0dd35decdb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504645, "uuid": "9a300e52-df5e-4094-bef1-4b488f19a5c9", "comment": "Malware payload (Mirai)", "value": "02fefc49510f8d540c609256e5c999f1e4ff98dac85f38aa8af999f726d216c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504645, "uuid": "beead3ad-a701-4cd7-a043-d65e55d7dddc", "comment": "Malware payload (Mirai)", "value": "cbd7cbad8ac62448d2851034108bdf21734ed99e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504645, "uuid": "01a854f7-e6d2-41b0-bd95-e9ccbeba72f9", "comment": "Malware payload (Mirai)", "value": "24793f559eb4c38f6d36b15eca08aa478879b253c09f55c7072ff8b473809eb1be6b2e05921a80983a7b42238bb07c63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504645, "uuid": "65c214b7-0e73-478f-ad53-c37ea54eb885", "value": "T167431925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504645, "uuid": "94ff7f8e-f9d8-416f-82b5-6dc7eabbbd33", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDk:eL0AxvSHfymp0xgunvCkV6vTMDaub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504645, "uuid": "787ee34c-1a50-4f0e-a5f9-b60e85f83fc0", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504645, "uuid": "aaa97087-1462-4129-ace1-8befdd18987c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504645, "uuid": "873569fa-f58b-49cd-a9e5-95d9628d7c03", "value": "ab2528b2debe6b91e401b0dd35decdb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1572da8-eda8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683554510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554510, "uuid": "1d34d5bd-7e72-4735-aef6-8aa9094ddc2e", "comment": "Malware payload (SnakeKeylogger)", "value": "d94ad8cc32b6ec476dc1b58637eb3544", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554510, "uuid": "98f0586b-9dd8-4f10-aee0-0000f2f97371", "comment": "Malware payload (SnakeKeylogger)", "value": "030e74c1f62bd15a50731f20049d0b8279bcd9ff1bb9d3fb1c0cfb643e317f80", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554510, "uuid": "c5df4d39-cd25-4891-bc2b-107cebbc2e25", "comment": "Malware payload (SnakeKeylogger)", "value": "5285f7c3bc2cba35aded0fe376f0808ab8af8373", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554510, "uuid": "46562f68-8461-4673-94ab-2280fb00a479", "comment": "Malware payload (SnakeKeylogger)", "value": "c08fe27f7aa5dd21d86c54bbc44c45f9797ab15ff0525f170bf5d2f3988f64717869f8c776f18f39bd13510c92db9db6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554510, "uuid": "87d5cfbe-df9b-4102-b1c7-e5aed2b2e8f0", "value": "T1B7036C1AE79F02688F811373171B1A89AABDB63EF35055B1746C833433E9C3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554510, "uuid": "17fda98d-cbc9-465f-bdeb-84f22c784519", "value": "768:BFx0XaIsnPRIa4fwJMN1/HTnt7tmBkA8mn5AZPCbb6I:Bf0Xvx3EMNdntA35AZPCbb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683554510, "uuid": "3fed994e-09e7-45af-ad9b-6cfcc67dc765", "value": 38911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683554510, "uuid": "74c11bd5-39b0-4c24-b8ed-4d861208691c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554510, "uuid": "3e17025e-3193-42c1-8104-87bc64bb2d74", "value": "itemsXselected.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f7bf2a-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530336, "uuid": "33b09721-2394-4424-b714-109f9aff135b", "comment": "Malware payload (Mirai)", "value": "56d6c5bd82aff0b9cf427ea9873937ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530336, "uuid": "43762642-6ab5-4152-a388-5031585c2a25", "comment": "Malware payload (Mirai)", "value": "03329faa6938dc3beca088aa71c0c2e07b48552e8d288be6e325ca3503a8b743", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530336, "uuid": "6113f6c8-bc69-404f-a5a8-64c18c60f036", "comment": "Malware payload (Mirai)", "value": "5bf08a01bc41f98ff33a917655271da898e0e57f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530336, "uuid": "18960522-d6e7-45f8-b888-dbfdaa8569bd", "comment": "Malware payload (Mirai)", "value": "7cc674148e0926141ca81a340747f38bc5761208108f5bb36a8e915a1a35bcf9168f6163d7a7e3787fa528ded4cadd70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530336, "uuid": "5f681d56-d26d-41c7-9ecb-688b3c8f080e", "value": "T145534A22F9325927C5D495BF62F30326B5E9970A20BC4F197EB10E9DAF26A4036071FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530336, "uuid": "efdd9e89-5ca6-472d-9eaf-0d5af45df312", "value": "1536:QErr61Q/GxbU7l7LlEkPKaMnZuPk/NJYLkNel:161Q/GC7l7WmKQP0NKgNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530336, "uuid": "1fb5ac9e-acb0-4238-b560-4c3914dadabf", "value": 61240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530336, "uuid": "0b77cef0-89ad-46b2-b48d-6b9a2f2a70a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530336, "uuid": "08333fff-503b-47cb-8c52-95e2de70a3e1", "value": "Andoryu.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271ee961-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1683577820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683577820, "uuid": "dcedc31d-8ad7-468d-8e07-2befc1ec4556", "comment": "Malware payload (CobaltStrike)", "value": "0240652310070e4f9ebcecc8941592b6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683577820, "uuid": "4a2904df-2ec0-4fae-8dba-51049bb7caa9", "comment": "Malware payload (CobaltStrike)", "value": "03825741c04fb75f7bcb5d53d54ccbd0a7c00ebf3f187084e49b0fb95e67b51e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683577820, "uuid": "1f095d14-c118-4c9f-8adc-e956412e0ca5", "comment": "Malware payload (CobaltStrike)", "value": "28eb3ade63bcfd6c5209469d2e88f80a7ea831fb", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683577820, "uuid": "aed6f539-de4b-40d9-baf1-cc77cf70ea2b", "comment": "Malware payload (CobaltStrike)", "value": "41882ba50c0a23497ba6d8374acc104ecbc7f681ecb4464dfb93c3f2e4a7485fc71ec818a750a716c0abfdf5a0c2b07e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683577820, "uuid": "d5a6fc01-5596-4007-8161-5e16de59ff98", "value": "T1D454B706B6B948E8DC7AC138A79A623AF97338954734D7CB5740C69B8FA37D0983D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683577820, "uuid": "6f88d7a5-3932-4c67-89a3-97e415dc7162", "value": "0958db2ffe0e9d933f85665bfb29e62b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683577820, "uuid": "1e191c45-1253-411b-8749-90f98d200b5d", "value": "3072:5KE8ZN8R56jwDTZk63cYta9DCToN+pVLjdcuLbb7oTzuyaefzaIcfQnYX/xUe+:AE8Y5Q4cXdCTM+nKsbf1yda/xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683577820, "uuid": "e3dbc5ab-d123-4d33-869f-22b641dcd3d4", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683577820, "uuid": "9b85bee4-b639-426e-a327-ec669fb64642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683577820, "uuid": "a1d374f0-4024-45c1-997f-4adb96bba322", "value": "0240652310070e4f9ebcecc8941592b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7af936-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571602, "uuid": "07891142-ab5c-453e-bb84-3aafa570c05f", "comment": "Malware payload (Gafgyt)", "value": "c24bd631affd97a696ef3d057c2f3343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571602, "uuid": "13e13521-ca3f-4520-af02-421774d045fa", "comment": "Malware payload (Gafgyt)", "value": "04bba167668fb635dfb00c6e829e5bfbc90920d03678ca00096785fde7d59b89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571602, "uuid": "ed62fa65-38d5-4e15-aca0-900815fb9b4a", "comment": "Malware payload (Gafgyt)", "value": "3c2f3c574a361f887a2a31b57b845d712da95d99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571602, "uuid": "cec146e5-e264-40d3-a63a-4ada76204b99", "comment": "Malware payload (Gafgyt)", "value": "4757f2d52f78869da44871b008023ae4fe1d932beb80dfa8ced366720d42477360700d9ffb105d736037b3c3f33fcfb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571602, "uuid": "dc846f34-4b96-4615-ab24-1f424f87b5bf", "value": "T116E34909D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571602, "uuid": "25cf0290-158f-4393-bc7c-50686f066bdc", "value": "3072:Bt8iFDKEfFN+Fa+1sW3h7n1erM/9pUMbmQwfCMQiGW:z8iFDLf/+FaNSh7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571602, "uuid": "efdde994-c461-41b8-b067-aacb35128803", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571602, "uuid": "40061664-3d8c-4793-b4dc-a4d27c21e80e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571602, "uuid": "fb656606-f2b7-4db6-96ec-fab7431bb43a", "value": "c24bd631affd97a696ef3d057c2f3343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def0d1c2-ed5c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683521865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521865, "uuid": "ee5bf797-5834-4490-90ed-a81b06bed529", "comment": "Malware payload (RedLineStealer)", "value": "030febbd47da38efcc1b175812dadd52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521865, "uuid": "1d1c1901-b43c-4faa-a9d9-edc8f871036a", "comment": "Malware payload (RedLineStealer)", "value": "05304efb0d6d7f4f5d5bea50cb9e1dc7c2034bfdd374ca737f604f1ec78cac68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521865, "uuid": "63854dc8-37c2-4b5b-b21e-37488668368c", "comment": "Malware payload (RedLineStealer)", "value": "c69df0eee479bdd2af24f1129bcb36d07c0e6a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521865, "uuid": "b78a32d5-b467-4ca8-80e1-75bc01b25fce", "comment": "Malware payload (RedLineStealer)", "value": "a895d2d50d1e77fe343753bcfe5766e2e77207a4349d9674b98a1a1633c6253bce5141a6bba7bb1b65ef9d629eb874bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521865, "uuid": "414ea4ac-f011-4d4f-baf2-f9fb9b4e8e63", "value": "T175D38C4E77A4B58FC99BC9728CA41C64DAA17437431BD343B58326AD4E1DA8BCF081B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521865, "uuid": "e84e4921-6b12-46e7-ab24-b458c8615461", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521865, "uuid": "e1902304-6267-47b5-897e-d1f79bf14e81", "value": "3072:5fzZHKrMRAEvhUhFTt4G5sgCUkjof4w2cXoGO/ME+Ez:XVR1myEsgj+ow/cNO/ME+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683521865, "uuid": "72baf36a-932c-457d-beef-5084048d1327", "value": 138232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683521865, "uuid": "0e4764b0-35a3-4f98-98da-c8a60d8f9fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521865, "uuid": "600a56e8-536e-4806-91ab-8ef7fb1eadab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04b91d4-ed60-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683523585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683523585, "uuid": "eda97655-4064-4364-a1e2-396aee8853d5", "comment": "Malware payload (AgentTesla)", "value": "ed30bbcf08df6d34f0878043203ed9e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683523585, "uuid": "7737cb76-1524-43e1-98d4-fb312602d884", "comment": "Malware payload (AgentTesla)", "value": "05a6e74beef92dc711c25b3b01565f9b1a36f08f914567e467e5a47dc2d1087f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683523585, "uuid": "0146af75-ed41-4140-af53-b8906095b348", "comment": "Malware payload (AgentTesla)", "value": "7aaa02c79bfad495fc92035e090346e696ddb757", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683523585, "uuid": "ada90f87-05a4-415a-a418-ed2912005dfa", "comment": "Malware payload (AgentTesla)", "value": "15e957b4186dbafc7c1b0014e184247a64a82183caa71fda9f45e83d98e3c7496e1fac90f32a93e98443af04baecd1a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683523585, "uuid": "0939f0ed-89f7-4ab2-9ab3-b1df205b9544", "value": "T13AF4F12523B9B791FCF683F83608A005AFB52D6153B6D6E84CCAB0CD5554F18B720BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683523585, "uuid": "33c66cf2-713a-456d-8203-811ea7bc018c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683523585, "uuid": "2e364775-589d-4d5e-b373-4b49bd580166", "value": "12288:jG11KvFJqSAfMyYNRndaXOTsEf02Gxz4v2EYnTI951z4s8qRaqcyxARCR:CPKWpfzYnndacsEm8OEWT0z4XqX3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683523585, "uuid": "be724147-8c42-4aa7-9b49-753fe52d1289", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683523585, "uuid": "1ed5fe14-38f8-4ab5-b1c6-601056b377f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683523585, "uuid": "d1920ef8-8fae-4393-a3e1-573bd1a2a2ee", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1cd7c0-ed44-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683511280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511280, "uuid": "c8d8af44-282f-4e54-96a9-5a7f8103a8b1", "comment": "Malware payload (Amadey)", "value": "69b2005d6d5fadc2a7c92a1f99bbba1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511280, "uuid": "127da57d-02de-4011-a8ee-91e5a27d3363", "comment": "Malware payload (Amadey)", "value": "05ccafa7419380dbea0e637af2067f7798bfa04aa6f5f66a21bfa236b6ef22db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511280, "uuid": "0ea627b0-ab33-4bc4-aa79-d88a4e9414a8", "comment": "Malware payload (Amadey)", "value": "d38d2c8edfebe1170c60cebd46de3a341b5239ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511280, "uuid": "11bb4154-52ce-4ee2-b782-50d6f32a8b0e", "comment": "Malware payload (Amadey)", "value": "4bb891ddfb2a4d6466248ce629e37beb0ae356520f2ce1463d5ccc071cabe202321cb3cf914fa5b3ec0f17e8614d4891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511280, "uuid": "ea55e5d2-a44d-4331-858b-8c01e91cb735", "value": "T14964F91382E1FDC5EE364B729E2FC6E8769EF2508F59776A12189A1F44B00B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511280, "uuid": "6e8e89c4-0496-4e65-9066-7f2a22656443", "value": "e0ad233aaf9ebf0d2e326ac5df912cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511280, "uuid": "53215945-0f18-49a6-bd2b-ebfe40bfc108", "value": "3072:PpXeUJLIr6pLvNJzSQZBgVoPuSQh2jxvUwrthoBbaVVxeRgW5cy3P1eF8qqT:l3J82pLvNBSQZ6GiYvwuO6Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683511280, "uuid": "2eacf51f-ad3b-4bb7-97db-273dd1000829", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683511280, "uuid": "4fcf5c15-f9fe-4a8a-bbed-297e0a2708ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511280, "uuid": "8cae9dcd-409c-47c0-ae5c-df69adfc8b1b", "value": "69b2005d6d5fadc2a7c92a1f99bbba1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96735307-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585738, "uuid": "574231a3-2f62-4fe0-9585-676e46276662", "comment": "Malware payload (Mirai)", "value": "f5c5fa6f625c64bb14a11e2c3460bb27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585738, "uuid": "e8530f86-968a-4833-a580-5e8b5fb68cb6", "comment": "Malware payload (Mirai)", "value": "0840d08affa9f035a001211c251ab6c438cad32b01f0d99c7212f09e470f96f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585738, "uuid": "c0f37dc5-a6a3-4b13-8d6c-1fb4d3101d09", "comment": "Malware payload (Mirai)", "value": "5b2cc2bd8c4d9d7bb4e3a2a85c47b86e0ef6c12b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585738, "uuid": "f1775aa5-3687-40cf-864c-9545c61bd75a", "comment": "Malware payload (Mirai)", "value": "56d050c39b1b5da2dd72d6eda8bfc5121665000999b1f5294ec85c0efeb818e36b06adc9c8a35b942889afd45ab845e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585738, "uuid": "ff2ee454-3e2c-45c6-afc1-362fa38fcc1d", "value": "T185539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585738, "uuid": "4e4672f0-a197-46eb-a2b4-8180c9cf8fa2", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585738, "uuid": "d6c99e7e-06b7-419d-b157-5b26091d52ee", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585738, "uuid": "c652ab89-71b7-4458-b781-143282b2f509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585738, "uuid": "6dbcf334-e51d-4347-a674-1f7948d0a52d", "value": "f5c5fa6f625c64bb14a11e2c3460bb27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c54286-ed6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683527965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527965, "uuid": "291e6357-8c91-4b46-bb64-83b853c18b85", "comment": "Malware payload (RedLineStealer)", "value": "17d6f36945e41fc06e527f128e837ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527965, "uuid": "3b759e54-c809-437f-8ca4-45123b03693e", "comment": "Malware payload (RedLineStealer)", "value": "08424055881f85eef71b6e252b91ba305ec887913828ffc024e579ed1ea57d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527965, "uuid": "5f0ad723-e01c-4286-810f-af697697358d", "comment": "Malware payload (RedLineStealer)", "value": "b373e2c9146f0636c1403cb18bda392a77cd945b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527965, "uuid": "d5ae26b4-eb60-436f-b4eb-3d261270e3ca", "comment": "Malware payload (RedLineStealer)", "value": "455981eb936f3ce5963648619a9296c7b93acca3e55fbdbc61ed50f933df33b290aa125cdc49501d901313e6580ebd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527965, "uuid": "db2839a9-ac65-4dc1-bd0d-773c3343e159", "value": "T15E949F1272E2BB61D52247328E3AC6E466DEFC919F1566DB324C7A3F0A701E2D573702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527965, "uuid": "2e705096-cde2-467b-b60c-edd38fefbc44", "value": "d5316530de8caf207058f054d9fc1dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527965, "uuid": "caf59a5d-9839-459d-a2b3-7c35802043af", "value": "6144:OeBdzgCBDuBv9PKUiPkK9MFriq0AvvcS0Sfp8iA:OmdzgCBqBv9PKnkM4r9cSX8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527965, "uuid": "02c895f0-2d99-4540-9702-d81672cd1fce", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527965, "uuid": "539a6441-27b1-496e-92ff-10d9e497c27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527965, "uuid": "f6f540e9-ceb1-47dc-af9d-0ea252ee4417", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7140babf-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528982, "uuid": "df76a3bb-9d23-4c35-a1eb-927a809f67e4", "comment": "Malware payload (Mirai)", "value": "57d62d55a3cc15e0d8a0d37970a34358", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528982, "uuid": "775f0c2c-9ec5-40e3-abd7-ee6b990559ae", "comment": "Malware payload (Mirai)", "value": "09fcddfd9a8519d30056c7dec8f8ed3e438d880b71aeb790bf980b682a41e977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528982, "uuid": "73ca032b-f304-45d8-b992-4b2e941d3061", "comment": "Malware payload (Mirai)", "value": "e151d9a8c02b144935729b815234c6a01c54ebde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528982, "uuid": "c54adb0a-f059-49f4-be31-6852d09ab1cc", "comment": "Malware payload (Mirai)", "value": "29bba9be2546384e7f79e0ba5d20185fed470df4c0d52fdf385788914b1ce372ea02754491390041600297399f57ac5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528982, "uuid": "a9b3dc4c-53ba-4ac1-ad21-3a46568576e3", "value": "T172632851BC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D37A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528982, "uuid": "5a0368af-bd5f-45ac-b729-a58b8ce3bfd4", "value": "1536:ONKlxkmiig51kRmO//kWUzriiAsDwY8rNRuVAvvW4:ONDWzk13iiAsDHaJvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528982, "uuid": "94b013e3-1db9-4acf-82ff-0a8aefe482f0", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528982, "uuid": "2d7ba601-0247-4434-a8db-40db727615ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528982, "uuid": "92ff45c4-834f-4cee-8217-d8caea20061a", "value": "57d62d55a3cc15e0d8a0d37970a34358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50757272-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683516472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516472, "uuid": "064baf00-5b4f-42b9-9b1a-1c323052ca1c", "comment": "Malware payload (GandCrab)", "value": "f89692198bfc2d2c0f96ae539f1f20ff", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516472, "uuid": "6ebdd4e8-9663-46b8-8e3b-0b8a3eded481", "comment": "Malware payload (GandCrab)", "value": "0a20f03af50d14404b349279b3dc20886b1bf91419ede3f1b0c7fbdda579ae77", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516472, "uuid": "96dc6020-e4cc-4c34-8ae4-8700e97ddcd4", "comment": "Malware payload (GandCrab)", "value": "5000a45154ae471680f586b51cc2996e3ab8e65a", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516472, "uuid": "099e7f6b-a110-40c2-8ccd-55073ea92fe4", "comment": "Malware payload (GandCrab)", "value": "950b5e9a367db9f56771bbe6b589979efa1f748801c30006a02cab51f9d20b5159eaf17d124100634607c8449984bf1b", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516472, "uuid": "c86321de-fae3-4d2d-9e0d-47ff99208319", "value": "T154F68D19B1D1A0B2E4F34576D5B4AF11442DFC211BB07CDBB2E62A9E19320E39E39B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516472, "uuid": "4c7029ae-6998-410a-ac07-f4402f785d06", "value": "3072:S5K/B0toLOSNJmlxwsx89TSdBgjMqqDL2/TOK21Gl:ScytwbFTTSdBgQqqDL6SKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516472, "uuid": "c9a47fa3-9a07-4c78-a38f-49e65f4f26fd", "value": 16777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516472, "uuid": "77c9c55b-4b29-4046-98e7-987ffc89df89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516472, "uuid": "05072530-987c-4d6b-918b-fbfd523dda45", "value": "2023-05-07_f89692198bfc2d2c0f96ae539f1f20ff_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf7bcae-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585720, "uuid": "9b9fafbd-7d59-49b9-8035-e7ec38e94e9e", "comment": "Malware payload (Mirai)", "value": "df7f7711e0fc3faa2e446ec2e772c1fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585720, "uuid": "d866ccad-9d67-4c6d-a125-de59734f381b", "comment": "Malware payload (Mirai)", "value": "0a6011210e6a16d54f60f388ebe38fa3e253b4e039d23d4e4e7c91069eabfcdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585720, "uuid": "6305e72c-b5a8-4606-bcff-d9d6332c1bdf", "comment": "Malware payload (Mirai)", "value": "6c255513ec9bd7165fa87cf430a66d561880b6c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585720, "uuid": "11911db2-c0d5-4d2c-979f-167780f7c666", "comment": "Malware payload (Mirai)", "value": "a87792310aea268cc699bb5d23820c88c1d4e7a1ef538b493357e89307b873b4635dd591c64a457562055b696a4f7b6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585720, "uuid": "1816096c-98b8-44d1-b5d0-4984873dc338", "value": "T171535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585720, "uuid": "8fcdf7b8-0a48-4b01-bc2e-e63deeb9f056", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E85:N1GjR8EVGOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585720, "uuid": "df797b3e-55b7-4db5-b636-fd4c9564cf43", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585720, "uuid": "5cd28d4b-89ed-4d34-a4b7-bb6fcfd33e84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585720, "uuid": "f17bf398-c2b3-43d4-8d3f-2b3c4b7cd2f5", "value": "df7f7711e0fc3faa2e446ec2e772c1fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c79947-ed39-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683506728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683506728, "uuid": "97f1b48f-bd4b-4a20-a164-169c7bc16088", "comment": "Malware payload (CoinMiner)", "value": "c58149fe1a8c96b6151b74b7366a1cab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683506728, "uuid": "9c58890b-f814-4fd9-b2ed-587b43cc0c47", "comment": "Malware payload (CoinMiner)", "value": "0aad58709b5a1d40071abd715c637567087c7739435e7653322e48784afef786", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683506728, "uuid": "7d580015-2e3a-40b4-b89f-e3dcb1740511", "comment": "Malware payload (CoinMiner)", "value": "f57a9f870f11d7e66b884f24006e10ae0d0bc452", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683506728, "uuid": "8db176c8-9668-4fb7-a2c1-bcb9385959e7", "comment": "Malware payload (CoinMiner)", "value": "0b2d28d5731bd4d95b4fa7b5a00027241d1c13090e4784c6f43c53f57cabc9519a52841b21898c3143325dd6db7e61a5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683506728, "uuid": "9cc8203f-802e-48a9-ad0e-7a058cedaf41", "value": "T19AD6D0E728D96ACEC16EC0B6C642BD6F8B4F78B5113974E74153F227D927D08B90AB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683506728, "uuid": "2f2c651f-bb64-4e45-9807-19fcafd1fa88", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683506728, "uuid": "0697ddd5-1c5c-425c-8eca-ea9d9c50f368", "value": "196608:z16e8+LwTrvo7H6ta4Rm90+kaLzVUzDXjq0BxlJB9tRpz4O7NADtV6v+Xx8VZ3GS:8TLo7H6IQmCAPCrpplt/z7Gx8Vsb49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683506728, "uuid": "cf6fd553-0baa-4c63-8c25-c38bd0bb92d6", "value": 12955688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683506728, "uuid": "0ce8c43a-c1d4-4912-b634-1326ee9da2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683506728, "uuid": "ab9b6b98-7982-433e-9f8c-b58006359116", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fcaa5d-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683527413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527413, "uuid": "a3eeecdb-3705-4bb4-b278-ad2dc17380ba", "comment": "Malware payload (Amadey)", "value": "4db73a32cecfa765907e892b7aea8345", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527413, "uuid": "8de31e9f-c440-48c6-afeb-ee173d17141d", "comment": "Malware payload (Amadey)", "value": "0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527413, "uuid": "9fc27fc8-aefa-44b1-8307-6744e5fa639a", "comment": "Malware payload (Amadey)", "value": "c420d45d39f21d01bfc71eafd0750fe3cc256a63", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527413, "uuid": "eaa47271-3f20-4fe7-961d-a1a7c0b7ae0d", "comment": "Malware payload (Amadey)", "value": "818087ae4d2ef0f519294b8c2b156f972172b8bf7a223a989e1cec84473148c4242582f5f3eb0649a388055fc25fe4a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527413, "uuid": "a5494c80-8888-4a2b-8e79-1e6ccbe469d0", "value": "T18264E80392E1BDC5EA264B739E1FC6E8779EF2508F59776912189E1F84B00B2C277712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527413, "uuid": "cf502f0b-a5dc-4f87-be66-50001b8e71a7", "value": "513663070e5d163878e1cb9d4a5e6408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527413, "uuid": "40606061-41e2-425e-8f90-2009bbe6c2b5", "value": "3072:iAXPGgaSaDNJOanCLg3Tcjke0m4gyRAY0+qryYIu+PKPSvNO644vKSgI5gPc3Pgc:3+Sa5MfLgjcwTYyRAYBqryXq4SZOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527413, "uuid": "0924dbf1-4429-4c87-bcd2-808e291348e5", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527413, "uuid": "f9d592a7-227e-4aa3-bdb7-f7f22e74ec5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527413, "uuid": "e126f190-e210-444e-ba76-c29381acf6cd", "value": "4db73a32cecfa765907e892b7aea8345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2946fbe2-edc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566228, "uuid": "65fa4802-7e90-4dd6-a786-ebea6f4318a3", "comment": "Malware payload (Mirai)", "value": "ff801776924f351329285cceb1fccc49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566228, "uuid": "8c5774ab-8065-4d75-91ac-ed75bd342e76", "comment": "Malware payload (Mirai)", "value": "0b47ff4950be491f52ab488974c5c2d129a3e26b76291620e13a90660c5789e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566228, "uuid": "20c0dbb6-fa67-4f95-aac3-9bd34ac1d8ca", "comment": "Malware payload (Mirai)", "value": "beb5c81f951abd667a157c5090c1514a890a793f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566228, "uuid": "0c72d3a1-0816-466a-a33d-ba26126f3226", "comment": "Malware payload (Mirai)", "value": "69fbcba7166299586d343e1e8664fd2708967572486adf9cc88b1fdb654aa84bf9902d1093e9c9d63ef564f7e5ee5a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566228, "uuid": "544d154a-b689-4279-8933-441a465b62a6", "value": "T19FD2D1DDE6047AE7CB9E4D3822E523E66C91B48039CBAF3DF35044CAF925A54949C4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566228, "uuid": "ddd6736d-c80c-4805-b254-b3cbd0c1b498", "value": "768:qpP5brCsdTo7R0dxdR3cTk3cpvmXcSKSzEbs9fvxWy:qpP1JW10dWk3ivmMSDBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566228, "uuid": "4c8ae574-6962-41c3-b983-ea3ad6c1ddf9", "value": 30688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566228, "uuid": "5d48a16e-e82e-4ebf-8960-2e16c747dc59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566228, "uuid": "5cb6628b-0973-4636-a2b6-9b71e05cbb16", "value": "ff801776924f351329285cceb1fccc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f867055-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568788, "uuid": "672b426c-a28f-4aa9-a0f8-63690f043e90", "comment": "Malware payload (Gafgyt)", "value": "3cf60d00aee70afc375cb5e8a19b8679", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568788, "uuid": "a19cf602-a44b-43d6-b57c-69c2ec637166", "comment": "Malware payload (Gafgyt)", "value": "0e191a8587791b01e1f6fbf2bc6c99febfb19a06945577abf6d3b374fb74b325", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568788, "uuid": "21f59c8b-c11d-40d6-9434-f587a765d588", "comment": "Malware payload (Gafgyt)", "value": "7a22468cd5978c07987606381270c2aa08ef6d52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568788, "uuid": "84c2cacb-84ea-4c69-a3a4-7948a56fb81e", "comment": "Malware payload (Gafgyt)", "value": "03904cfdcbd7a56b8b9f3b8087e564d197897de1b35a6800db3b120ba8216ac47fafe028f875ec0990630818bc5bf787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568788, "uuid": "5d62ed4a-ffb1-4b0b-8c4c-f5fd8e6deaee", "value": "T106D31905F4608757C2D217BAFA4A425D37221F7893CB33256A28BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568788, "uuid": "41b9e851-c6ff-47e9-872d-a92f624da94d", "value": "3072:CdHpf5wyawRCzQArASotpay3kpkYzftmCQA9FX9aH:yHPwyawRC6pay3ezftmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568788, "uuid": "ba521adc-b454-48b8-819a-08edd588c5bc", "value": 139577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568788, "uuid": "e1fbada5-a82b-4c84-89ce-3e74ebe2a7b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568788, "uuid": "b3e6b3e3-79d6-45f0-a8f0-4fdb3fb733c9", "value": "3cf60d00aee70afc375cb5e8a19b8679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894f0edb-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530311, "uuid": "f41be9e5-c6af-4a6c-97d5-f85d5111e3c8", "comment": "Malware payload (Mirai)", "value": "8cfa4f833274e97b35f5a404de4d744d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530311, "uuid": "82d4c08b-6162-4bd1-afc5-4ea9e838480f", "comment": "Malware payload (Mirai)", "value": "0ef7b4e838b0fac95373b243d043b0df34bcf9266554fa71d83a6fe05d4a6c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530311, "uuid": "f56e3460-1af7-4f90-84c4-3c4178a5af4f", "comment": "Malware payload (Mirai)", "value": "229f1589dca5aeac8cd6e764d4c8b89a48a68396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530311, "uuid": "1a4f2aa8-dc6d-46b8-9295-9e057ef5f0a0", "comment": "Malware payload (Mirai)", "value": "fc89fe325d1b61c28b8e80fc508a13153a99ec27449cfaaa232fc91abb4ccf6610038c6350939f5615cc8a334cf97803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530311, "uuid": "5e0ece25-a173-41f5-9075-95d32e3dd99b", "value": "T1BE73C74D5E31DFADF769833197BB8A24639833D137D1C6C9D2ACE4012E6020E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530311, "uuid": "7118a360-2a77-4ede-abf3-c593b649fb7d", "value": "1536:mIwXU8Tv7eNYJLthH6JVsLJyAZ+YCpNfAQCNMN8g2iM:4vvaANCPjCNMNn2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530311, "uuid": "9f92c96f-1e31-4e77-bbf8-f24e2dd80904", "value": 73660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530311, "uuid": "7f0055fe-5b69-4054-a1c3-dd279ad72e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530311, "uuid": "7e3ce5e8-f30b-43e9-9dae-ff596642082d", "value": "Andoryu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80721a92-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683527290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527290, "uuid": "981c090d-a9b6-4fb5-afb6-d3f473d4cdf8", "comment": "Malware payload (AgentTesla)", "value": "16e04945d87b9c5b18af0e93bd8cc91b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527290, "uuid": "a78da85d-0cd4-4d0f-a55d-9560268ff443", "comment": "Malware payload (AgentTesla)", "value": "0fe40012d9bc6466173c5860fea01e4b7f4390c4dcc2fb95aeaef466d32c8904", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527290, "uuid": "8e0f9198-34e6-441f-be59-ba1d5543a852", "comment": "Malware payload (AgentTesla)", "value": "92a66b7ee8dd6fabd14e70de1da2c69c71873794", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527290, "uuid": "58c19c86-2d47-4ec6-948a-26c6fbcb04c8", "comment": "Malware payload (AgentTesla)", "value": "c4a4825927bbbdf915984d50a2d325cc60132e34bf6afb80ac85f153492e074f1f89daad85d7292833334e706c9fa710", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527290, "uuid": "7de079a8-e001-42e3-a2ec-245277920a58", "value": "T1FFA20848ABD58765C25D07B594F222604B38E6C39A43E71F7EFC71B90E133AA0B563E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527290, "uuid": "f57cf860-a249-4254-997f-b528bca46162", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527290, "uuid": "7015ff86-4334-441d-b5df-8941cfc571a3", "value": "384:CmCJDitBjQsMtnw26iC8taveG9GgXNEH3D1pbABf2:CmC5hjCTvFGtHTDyf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527290, "uuid": "cec5455e-7a77-4cff-817c-1edad9acd468", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527290, "uuid": "9f87875e-9213-40a2-a88d-617c945145dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527290, "uuid": "37f40db7-3eed-42ad-a671-8b6cc1362f88", "value": "Payment 20230504_1306030770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1119e9-edcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571311, "uuid": "c242d2ac-1f33-4929-a419-d3b55a218562", "comment": "Malware payload (Gafgyt)", "value": "d7c38dcf486229b9755993f35a0840e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571311, "uuid": "bcd085b4-bd6c-4c69-8f9d-0989f433667c", "comment": "Malware payload (Gafgyt)", "value": "1075b1c6fbb36dbe94c275d43c4037e857187f7d0af3fd600e7194db5bb20f53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571311, "uuid": "a9a1860f-0fd3-4b41-8ee7-a1c9d4299fd9", "comment": "Malware payload (Gafgyt)", "value": "d195975953bb39db2ccd111c7cb4d929275c3af9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571311, "uuid": "12997d71-8236-4161-84e7-e02e933d45ff", "comment": "Malware payload (Gafgyt)", "value": "dae59017d6b18e12b023f0e5eb1d7f490f2c0def50b942e04223720aa49821df862dbbc63550042f9b928f18cc9ce40c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571311, "uuid": "dbb0dfce-f3a4-4faa-85e3-4bf323867498", "value": "T1B2D3D617ABA15DBBD80FCE3302E64521109EE49613957B6FB178CA5CF74BA8E09E3C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571311, "uuid": "b9a330fb-a643-4763-a92c-04505c764291", "value": "1536:76ejyyUhayRB4pa4ggYJ7vOTlp7xhxPYsXm/KBgvYYiCh:7PyX4pNLflhx3mCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571311, "uuid": "205c70a9-c1d5-4257-8a43-2582f24e8337", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571311, "uuid": "3204b4c0-0b5a-4df3-b089-c9268f3f85f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571311, "uuid": "8dc532b7-418a-481c-9c53-fb8f3cf82126", "value": "d7c38dcf486229b9755993f35a0840e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784d0197-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683528994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528994, "uuid": "2dbace03-ec89-48b0-84b3-b89a77d7f706", "comment": "Malware payload (Loki)", "value": "c12f709034765d3b019c3b0b3fd46888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528994, "uuid": "f0d99fc5-e74c-46bc-b288-3abfd8bf991d", "comment": "Malware payload (Loki)", "value": "1098c30f8d02c4acabc58ffabc34f30e2a234c702851e1c6c88a072d795a2ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528994, "uuid": "510f2806-c2ac-4f2b-b450-76bbcd663c51", "comment": "Malware payload (Loki)", "value": "5f269b13e27f52e4b52a3be14c6bb0dc17ce3186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528994, "uuid": "17469dce-dc06-4593-b0a0-de4e9bb93b38", "comment": "Malware payload (Loki)", "value": "f5684631c5019d3ba5469f5c3218802b3f654827b0d284b94634dfd716aa218a6231b14e339648d520465fd67cf37026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528994, "uuid": "55c93531-73c0-4441-8970-e7666754a4a8", "value": "T1E2A41285B2F6CAA7F81E85F5063CB14023B270A791D0DBD44E726E885FDAB40AF4495F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528994, "uuid": "255c46fc-3ca5-47d9-913e-ac3c436f1ef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528994, "uuid": "1ecc64a7-0c8a-4294-8756-c7d9ecf7453d", "value": "12288:gE8omwPF0bwIBuYp/lJIl/9UBEM20LdK6:gEowPmJuxTE1ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528994, "uuid": "730d9545-2c2a-4e20-9386-577e01254efb", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528994, "uuid": "e5cd936f-f338-4736-84c0-48a2941b5d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528994, "uuid": "76c0f5b9-2879-4d2f-b97a-5a43232db62e", "value": "REqAO25caeLL49E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7995dd-ed9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550263, "uuid": "4662cd52-6758-4e66-95a4-a35a66c540f0", "comment": "Malware payload (SnakeKeylogger)", "value": "c3c525b57b37b16cd1eebf0207582c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550263, "uuid": "82d3b8e8-c6b8-402b-9ee9-79a9ea7d977f", "comment": "Malware payload (SnakeKeylogger)", "value": "10bbbb979fe5c51ef5402549101a4460666e9be265d430d1214c93ec0b6ca915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550263, "uuid": "6bde35a9-8288-4624-bf99-9599af18bc45", "comment": "Malware payload (SnakeKeylogger)", "value": "251d60ec1120da02a084942cd88f3949656e4caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550263, "uuid": "bcb9ed7a-fb77-4507-b2c2-a04425752b39", "comment": "Malware payload (SnakeKeylogger)", "value": "3f1acafe09a5a951f6b0e8ff649e8672d7a29b96a0ff7fa493c8012facce87824e4a367975ad39c6843f578ac9f767a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550263, "uuid": "4bfc1151-8867-4289-a39b-205f93f62afe", "value": "T11AB4014572F98FB1EA758BF01538B84103B230A36CF4E56D0EE615CD2EE6F501A85B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550263, "uuid": "f449b9ad-5c9b-4663-9495-985dd265e3aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550263, "uuid": "75fa6099-cc0b-4b4d-a561-aaacb7f36b5d", "value": "12288:FWEhZWIYSqsI3+hnjZLBfMzUCXwFFS9bxe1:gI3S3+TNZKwe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550263, "uuid": "bfa5d93f-4fe4-476c-9cc9-e36ee56c6d05", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550263, "uuid": "4f18b576-97a7-4348-85f0-d82ee4310b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550263, "uuid": "c2db91a1-360d-46b4-9b91-3f435a4dbd62", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e603d9-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683530302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530302, "uuid": "f69e50d9-d4a3-46ec-8207-0c9c3e6b1477", "comment": "Malware payload (AgentTesla)", "value": "c3c87aa9bcc17d6638b54ead59dc976c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530302, "uuid": "70c4f180-0c16-47eb-8686-3373deba4654", "comment": "Malware payload (AgentTesla)", "value": "1136a7337b15d84cb01ce91fe74e0be8a7e1df783243cb8c38feb070aba7c54e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530302, "uuid": "ccd64436-efa4-4d4b-8da9-7198adfcacfb", "comment": "Malware payload (AgentTesla)", "value": "ba2ac5353d931fce5b2c902ce712cdcaa30b0be3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530302, "uuid": "3cdbcadb-f8d6-4ba3-b71e-9d9b3178e98f", "comment": "Malware payload (AgentTesla)", "value": "341cf24e408b39491e0722259d87bfbbcf4f0cac84cf69eef082b0a135e629a29a1dcfac7c2550c84c77a9cf3e5676e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530302, "uuid": "c105f74c-684f-496e-8338-1c2462341b19", "value": "T1B7F4E1352779BBA1FCF683FC6608A0019FB42D2157BAE5E84DC6B0CD5155F08BA20B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530302, "uuid": "b69999f4-f422-459b-bae9-03619b987bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530302, "uuid": "779488c7-68e0-48ee-99c1-722258246058", "value": "12288:3z11KBGOjtWCeoCkEKNahF7jHtMTNCHXVTue5mQACBQwIZD+:jPKRjYtoZeDtWyTOQAGjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530302, "uuid": "e0bccfc1-2af0-41d1-8f01-c43732b30e96", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530302, "uuid": "0b5f913a-8a8b-4d19-9880-1cd1ab2bc709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530302, "uuid": "c9b44951-f73a-4922-8ad9-df663399251d", "value": "EPDA & SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e81c44e-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683534588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534588, "uuid": "19bc3b6f-b8fa-4486-8b96-33d38b92ae88", "comment": "Malware payload (AsyncRAT)", "value": "9431e2a625b43dcbdde6c9f7669c653c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534588, "uuid": "aefd94e2-b275-402f-8983-4ec9e1175dac", "comment": "Malware payload (AsyncRAT)", "value": "1139866f47d640744a522f86679627e568b52197f58b6484355b6c4544a6da22", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534588, "uuid": "803e80bb-a390-4ca1-80ed-a63d9739379a", "comment": "Malware payload (AsyncRAT)", "value": "982c4e8dac9603148295e7a18532b668255f9ca1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534588, "uuid": "9fb75e2d-3fd3-434e-9772-62be6c7dc0bf", "comment": "Malware payload (AsyncRAT)", "value": "5d97d90fad40f762833dd8c48e1eb92a6430aafab8fbba12a44fa405e1acbc59f13cc62548926080ea23648709277e23", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534588, "uuid": "a5941891-fe79-4af5-8836-be506c03a9e3", "value": "T144753B335213FCCA2B7F3DC4E50428662CA8386793769658FB8C0DBA74E6254DF295B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534588, "uuid": "2ba40e16-ee2e-454f-956e-9a20b507ae57", "value": "24576:QRGa/yfp2xvks0uzuM6auN58aNRHINcemsHtE/+sSs955FBgnGAcbvMvfklxepUL:48pafKMz4RHoceXG/+sSs/Bgnw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534588, "uuid": "aa2e8058-6ae3-4656-91c6-2b8febfdcf49", "value": 1594984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534588, "uuid": "dee32494-d3fc-489a-b4af-53b9598b44e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534588, "uuid": "9c4c8374-002d-4ea6-be1a-aac0019ff0aa", "value": "confirmation-swift-payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7340fcbd-ed68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683526838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526838, "uuid": "b68c73ef-6ba7-4ec4-a3b5-10684ebec10d", "comment": "Malware payload (RedLineStealer)", "value": "b0ef31b9867e97491ec9470333231730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526838, "uuid": "ca5e915d-00a4-4327-80de-724f0c7b17d0", "comment": "Malware payload (RedLineStealer)", "value": "1273432c8ab01a3162ce6025ea1fbc11353ecda5655e3ff204e3ef64f0e509de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526838, "uuid": "2ad12f71-8bd5-41ce-8a57-a1f64c361911", "comment": "Malware payload (RedLineStealer)", "value": "ee9c11a3c6bba510bbb3c46901208948177700e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526838, "uuid": "ada997b5-b018-4b8a-baa1-1e2569540c3b", "comment": "Malware payload (RedLineStealer)", "value": "73c46784e0ced8aa15d67ee000e923a9a0fc31a8e81178cc73585398dc3fe52e2708a967d0dcae77b6c48a15baaafefd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526838, "uuid": "455c8bf5-dc45-4b78-95d3-78866bcd0f90", "value": "T125641A4382E1FDC5EA264B72CE1FC6E8769EF2508F59776912189B2F44B01B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526838, "uuid": "5a3300c0-ceea-49d1-91af-3c538c7c868e", "value": "774eae4c41c92ea810347ae7a14e6cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526838, "uuid": "73b31028-73e9-4a5e-9537-6ed988a5f914", "value": "6144:hCmy/LOYSLEmnji5Y7DWocYI5u42W+GN:hCjKY0E0iCqocYI5XAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683526838, "uuid": "7b5f6c0b-74c6-4048-967c-db1186396382", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683526838, "uuid": "a97e82f8-4f28-47fc-80c1-0b37f132d4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526838, "uuid": "2540c984-40ed-4f0a-8f11-1dcffab86ee4", "value": "b0ef31b9867e97491ec9470333231730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a59cd5-eddd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683576912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576912, "uuid": "1536f79e-9aa2-4677-b55f-94679f3d78a4", "comment": "Malware payload", "value": "eb21cbdf9c4254dc568165efe717f913", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576912, "uuid": "e38e1c1b-1b20-49bd-992a-6bfafd09e455", "comment": "Malware payload", "value": "12c7cbf78d296ce5d51cf1f36b96c7ed6bcecf22eb400e6cf172f792ccff0838", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576912, "uuid": "39d0bab9-b392-43e9-84ef-dce3a0af992a", "comment": "Malware payload", "value": "78c79076080aa20e78a42ee1d1b3a6037aeacb51", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576912, "uuid": "6f775462-6108-4efb-807d-481893184bbc", "comment": "Malware payload", "value": "1ad81468644120b43ddc8d3c82fad833002ce38dc168c6816281354c27c6faecf17a0ddbe0f37bf4a678c7d798815944", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576912, "uuid": "e2b7f7cd-c55a-484c-9759-3c9c4ef4fc21", "value": "T13381F899120DD5910855043798E2B3154B786363F240CF4CFAADE7E8E82FC5B61B607E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576912, "uuid": "75ad0c2f-fb6c-45f5-93f9-e2201a56876d", "value": "96:e5UZqDpGAlvpi2uwYoKtNEeKalCPNrqE73CVFWzbC7YC:eWqDpGG9ubP8iCV2rob/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683576912, "uuid": "719cec99-d750-46f9-907c-2ffffc8738a4", "value": 4146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683576912, "uuid": "dc6aafd2-0653-4bc1-940a-8ea2f70e1c18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576912, "uuid": "8e6efc68-84f1-43fb-9e8e-9820d59e2f7d", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb6a00e-ed6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683527772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527772, "uuid": "09b82f1a-11f7-441d-ad94-080706033af9", "comment": "Malware payload (AgentTesla)", "value": "1eb97051a24774f802bf64228de5a497", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527772, "uuid": "fb61e932-864d-4916-b201-9886b2f5b1a6", "comment": "Malware payload (AgentTesla)", "value": "1302dd8497ba8909d81dce0a4069767bc358b0879443c1982ffea0292f9707e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527772, "uuid": "bc811db8-7d4e-4094-a7b0-d822e562aa69", "comment": "Malware payload (AgentTesla)", "value": "8f7d049e58895edef39d2d32aa397000c2f26895", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527772, "uuid": "0750c346-e0dd-42f8-b464-c983f221f1c6", "comment": "Malware payload (AgentTesla)", "value": "eb54f79ef61c8ddd6b862aca72d50748fa82c8f7ffdd42a3f32c789f884a8ee080db68eec9408dda1309f8c548cfcf31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527772, "uuid": "d95a2957-f392-481a-a373-aaf0482b51ed", "value": "T16AF4E02137B9B7A1ECF683F86608E401AFB46D2153BAD5E80DC7A0CD6154B09FB50B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527772, "uuid": "cda78354-bed7-4fa9-8273-897880f29597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527772, "uuid": "3d271ae3-11f9-423e-b70c-9afcbd09fbdc", "value": "12288:Ld11KA0cq8o0BiiVxuXmd090q0EbN5+gqGUmS:pPKIyJXmd090q0Ebup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527772, "uuid": "76368163-02ba-414d-bdda-c17ee808dd6d", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527772, "uuid": "56e144a2-c5f9-441e-964d-af570f80cb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527772, "uuid": "1f021c4f-54bc-4e2a-a0a3-a5ecf2173eb7", "value": "Quotation#97889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010fd2da-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683550698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550698, "uuid": "c2fc1229-d9f8-4dde-8b0a-fb5b6f5c3e9d", "comment": "Malware payload", "value": "03cf9eed1799e49c8530c0b95769d78d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550698, "uuid": "05d79ee8-6d01-49a4-b422-19cb68a58217", "comment": "Malware payload", "value": "152a3a9807d0619f61c65233b73348a6a38586cee81ddba59c5daa1158b89c30", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550698, "uuid": "ceefc5cc-bac6-41f3-a9f1-e280dfa0214e", "comment": "Malware payload", "value": "7c1bf653b454918291a6e7aad1b8b8dd1fcdef0a", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550698, "uuid": "fc75019e-e02e-4615-9368-68f57a6d55f6", "comment": "Malware payload", "value": "6a3b92b501f3823a9cfae17226c16acbc4400b1526344a786f870063bb8a74d41d8ec36d158c43a3ab3d9bdccd08037b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550698, "uuid": "2846520c-2791-472f-a800-7bf9513d5e9e", "value": "T158933610F75180B7F1099638B886959756603C73BA41DE1A26CBB70F2BB7F729D32E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550698, "uuid": "e6a758ff-3fcd-4899-9d7b-f0c8808a8cfa", "value": "1536:xh/sCkNWZ3c3a44wfU250NcaqGw6Pld410YWjTtYoVasJ7G+HkN95Lsd:xMN2u4wfaq2Po0YWHuoVasM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550698, "uuid": "48e8dd2b-8165-4700-a7de-930d15e0b690", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550698, "uuid": "91fbbb3a-4c01-4c88-addd-4afc5a4463a2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550698, "uuid": "78d6bb93-39b6-44f3-90f4-e380e8a2ffda", "value": "1835DIR231029551-CRE001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d643617b-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683570383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570383, "uuid": "d5763089-9aab-403a-81da-37e9228c62cf", "comment": "Malware payload", "value": "d680fbc45a02bdc934a7e0eb36f6b28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570383, "uuid": "ff3bb871-eee4-49e4-b045-d56dc4d19a72", "comment": "Malware payload", "value": "165d31d8ba042952b9d0b56cd24703de15154434cc65788a563febcd1619159a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570383, "uuid": "3d0d9f29-0436-4313-94a9-0c767d235871", "comment": "Malware payload", "value": "d9aff2d51f1547811328a7e51807e2a4acf8eb60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570383, "uuid": "b0f075a0-85c0-4cfa-ae86-4d5a5be8c563", "comment": "Malware payload", "value": "87e4ade1aefe97166534f639022c91451246369336b3b17ffc75c4c90d7a4ec82395849f9d0f6870e7049c904e876cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570383, "uuid": "75226519-d6b9-4147-b0f8-ebda63fbb908", "value": "T17B3633772150008490FBC46AC537BEE071FA62BF46819C7895E7BEC52F1A8F9E60365B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570383, "uuid": "ed3c3640-3ca2-49cb-8162-132459e82b7e", "value": "792bca1af4713aa19956190e65b11a98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570383, "uuid": "6f88973b-5d10-4886-ac0a-1eb97e44e578", "value": "98304:z618dO+C3TAgxK+ZlEWY78izXRfmLeaLrNLq3OMb8QZualaK83FH6JJwwvUZTtWP:zLgXhxRZlE/hfrONLzQ+wvv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570383, "uuid": "2cba670f-5553-4d65-9db4-8c8c1412be75", "value": 5312731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570383, "uuid": "0b77f2ae-8959-4679-b24b-e0ed5e2de151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570383, "uuid": "d51524e4-b8b4-4ad7-87e8-a70c1f8d7c5b", "value": "d680fbc45a02bdc934a7e0eb36f6b28d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff1ecc3-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683551018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551018, "uuid": "0c574c9e-be7d-463a-851a-cd688bc2cca6", "comment": "Malware payload (zgRAT)", "value": "228c9565a2641fa1ae7ecaa5f4b32e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551018, "uuid": "48838d2c-772c-4be0-9a13-5d84d055afc9", "comment": "Malware payload (zgRAT)", "value": "16e0f70aaf0cc2f3c42a4733756a09896247876b8f17e371c378f1ee4c0076d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551018, "uuid": "8a2b2bd1-7c99-4e68-acb5-25499475016a", "comment": "Malware payload (zgRAT)", "value": "0d9e77c19fb383b1d6afc75868e9505d620cf495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551018, "uuid": "5efd4a0a-190b-4eb8-9d93-014b267a7c3e", "comment": "Malware payload (zgRAT)", "value": "993891eacee18e25bb4f02f47a2a1cc9ad0bfcfccf990ba5c5fe492e93680597ac3016d0a2b86a930f1acf9a412e49af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551018, "uuid": "4166f6f6-9773-4dde-a124-18581592b81e", "value": "T1A934E016779B9501C959A671D1E3042803F3F3C722B3DB8EB98D42960F837DD5A8DA8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551018, "uuid": "d14a5f0b-3e08-4ceb-848b-e4036f13806e", "value": "6144:KiDYCq6sWqfAIzuMeh38KfkZxNQYFZVwvtZ9In4:DYCqMqluP29xFI39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551018, "uuid": "c8a5d3f4-043f-433f-9848-e8229fd56d5b", "value": 249928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551018, "uuid": "d6f46c17-54e3-401f-b21e-8211e0e44f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551018, "uuid": "5b9664a7-fef8-440b-8535-a583988375be", "value": "228c9565a2641fa1ae7ecaa5f4b32e70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd66cf0-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565883, "uuid": "ea9a1c43-d92b-40d5-a70b-08ee3549671c", "comment": "Malware payload (Gafgyt)", "value": "937c02adad327dd4046a5d0a8f31e3e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565883, "uuid": "b4d76c0f-53e6-4ddf-b5bb-64f3a63bc831", "comment": "Malware payload (Gafgyt)", "value": "16f3472f5b8a6c0eeb0e89415f188ee44da9b66cc58298bfd7e71fd6d8fcc1b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565883, "uuid": "dfa4abe9-78aa-4ed2-80b8-999a618b3ab9", "comment": "Malware payload (Gafgyt)", "value": "ebaf29fdd0beb2041acbd6f3017705589add3b6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565883, "uuid": "6c290718-5cd5-4bf7-9ea3-8cdf8b9157b7", "comment": "Malware payload (Gafgyt)", "value": "c2610ba8fba748d6fdb417d264a4810f2df9da6c094c480ad38ec6711a3619011e7bcaf3effe312408de19c7135da25b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565883, "uuid": "0aad7c42-89ba-47e9-9507-c1ae831b620c", "value": "T1A0D31905F4608757C2D217BAFA4A425D37221F7893CF33256A28BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565883, "uuid": "33745237-0d31-494b-bf6f-13e3e06fd48d", "value": "3072:CdHpf5wyawRCzQArASotp6y3kpkYzftmCQA9FX9aH:yHPwyawRC6p6y3ezftmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565883, "uuid": "7f970085-e643-487f-9f8b-a310144ae0c4", "value": 139577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565883, "uuid": "9f6c7f7e-8bfa-4071-86f5-dad17fd9be21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565883, "uuid": "14bf2bec-de32-42a6-b5b2-1295b5f6fafd", "value": "937c02adad327dd4046a5d0a8f31e3e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db774fe8-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683551065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551065, "uuid": "f41f86cb-43cd-45da-aa11-8d279a71bef9", "comment": "Malware payload (AgentTesla)", "value": "57319b3e631266848a6424e28f38c194", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551065, "uuid": "d993d29f-f485-49c7-80e6-6b8badfabc64", "comment": "Malware payload (AgentTesla)", "value": "1884b7ff2246263409d8e8d53d03371c80affdc9bc588455d0b86e2a77c5cbf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551065, "uuid": "c2d2011f-2a29-4bab-90c0-3020f28f63bc", "comment": "Malware payload (AgentTesla)", "value": "f44acfbe050730ce0d2742e12465f2b4e5048906", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551065, "uuid": "f14eb726-d4d0-469a-ba22-d73016c51908", "comment": "Malware payload (AgentTesla)", "value": "7103c9849dd1b031af893d221b9e92cf0daf65969cdbe724a49f30411fc2f34acc0afb5ac74e6e73b2f34fb5cae5e864", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551065, "uuid": "04bcbd4f-1363-4b3e-84c1-28ea77a367f6", "value": "T128C4F25522B58F64E9768FF0293DF84403B274E795E0E61D0EE654CA6FF6F006A80B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551065, "uuid": "4c5a8e6d-eff5-4500-a0a5-53e5d87ed4d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551065, "uuid": "5745d10d-1ebe-4494-aec1-5e85709ccbcb", "value": "12288:/m35oTGygkE+vpoXnAF23h1lI69j/Sl3SYFcje/Rb:/UCrgKvcAKRI8bjeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551065, "uuid": "5f3ee10f-0ac4-4f20-afa7-4888ab8a5b66", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551065, "uuid": "1b87299e-860b-428d-ae28-5772f7412bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551065, "uuid": "d45648a5-cefa-43a6-941b-035544f6e63c", "value": "57319b3e631266848a6424e28f38c194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13fed9b-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528687, "uuid": "6bd00577-a414-4f46-8adf-f16724e2799e", "comment": "Malware payload (Mirai)", "value": "274c0b2b4963b570a0bd552fb6589c07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528687, "uuid": "c7c28856-3e8d-456c-aba7-de6adfc6eb83", "comment": "Malware payload (Mirai)", "value": "195434b94b49040d7caac0cde9d32affb93353b55778ea00542b5e632e0ba250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528687, "uuid": "242bd644-6d13-4753-a123-d18488abdf11", "comment": "Malware payload (Mirai)", "value": "76b27b53a751f17fc3f050c17b7e9efd91946ecb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528687, "uuid": "c952dd2f-d446-43a7-8018-e9e9a6158ab9", "comment": "Malware payload (Mirai)", "value": "aa7412df1139d231ff007a62b070f970be6818c504dff19d89f0b0fe179fd3a141b3242cc8ff69a8ec4f160ada204414", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528687, "uuid": "d806513b-c0d9-4765-ba19-2fc17214e515", "value": "T1BC632851FC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528687, "uuid": "8ad7446a-a997-44d7-8ead-e86ef93b17b0", "value": "1536:ONKlxkmiig51kRmO//kWUzsriAsDwY8rNRuVAvvWK:ONDWzk1oriAsDHaJvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528687, "uuid": "e30f16cf-5224-49de-8b95-38239eb29f89", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528687, "uuid": "2ef317ba-2021-483e-9186-00d9ca5153c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528687, "uuid": "346932c2-677c-4762-aa0f-e8f0826b19e1", "value": "274c0b2b4963b570a0bd552fb6589c07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7af4597-ed9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683550119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550119, "uuid": "3409ba9e-adb0-44df-a1e9-a2fa179994d0", "comment": "Malware payload (RemcosRAT)", "value": "30b37d8ba42f3ca92a2f2541ab99058b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550119, "uuid": "cfac7cc7-1bd3-4818-b6f9-5ed5c3fdcd89", "comment": "Malware payload (RemcosRAT)", "value": "1a925bac006fd8d7a5d58d0229eabe2e30634626731add96939b0ab542c446a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550119, "uuid": "738b4885-3222-4117-b96b-6add250c86df", "comment": "Malware payload (RemcosRAT)", "value": "9c6e40b657d10569cac692d6888b42ff60012a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550119, "uuid": "9a382ee4-a376-48d3-b933-0d52163df9c1", "comment": "Malware payload (RemcosRAT)", "value": "d4b1b6bd77635009f00556f93c20c9f3e302571171155604348b91014058dedff5224692109405b9bdac71b4e09b9076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550119, "uuid": "8cae994d-9cff-4083-84c4-cf89a72fed10", "value": "T1B4A4230973B0D773D9F64570AE39EBAB7AFBB03264E0905F975007BDB926601E56A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550119, "uuid": "d4617ba1-bb49-4277-98c3-7fff33b396f8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550119, "uuid": "73de664f-8d49-4077-924f-b661f865b678", "value": "12288:PYNJZPg/IKOgAiojNGDAkfDMFt56ErNQq0eZdL0yoCG:PYNHPMIWAioodD056cQqHZdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550119, "uuid": "d56b9da8-66bc-4139-8cba-a970cce1fc12", "value": 483917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550119, "uuid": "0ee4a97a-c711-485c-9217-0d1f68fd89ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550119, "uuid": "18004544-9de0-4ed1-bbf5-25c845a2d50e", "value": "SW009858984022_DE_009838221_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d26542b-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568784, "uuid": "d2dc119b-1c5e-4f28-91c4-a9c5dcd2c3dd", "comment": "Malware payload (Gafgyt)", "value": "5e6061ee64e34417c7ed0d4707f492d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568784, "uuid": "09c14524-c7e0-4b50-b5ca-b6cf108ded02", "comment": "Malware payload (Gafgyt)", "value": "1b1c1e47117c9196cd1a6a086541628fdd2ce3d694a4a6a3d4e3a270eef4ae05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568784, "uuid": "c8f000e3-e20f-4c30-986f-70166f98758b", "comment": "Malware payload (Gafgyt)", "value": "3d9675045b3376dfa593591feb53a02f561bd446", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568784, "uuid": "b405d08b-99cc-4298-9bc0-4b5902221452", "comment": "Malware payload (Gafgyt)", "value": "bda15998cd6b3ce2bd5eb26c90dae899a06fb6eb36d26f558585a866f0628e42a7e0bdf971c08506bb289dc323aa714e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568784, "uuid": "3eb2f99e-4c93-4c90-a968-9ab3f89a5645", "value": "T14AE3962E3E21ABBEE16886310BF76F70C39529D636A19346E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568784, "uuid": "3ce0e274-d568-4eb2-a07d-c3a8b2e51524", "value": "1536:mVNs7K397V+nT57Abf6l6T6B6v6N6/6AePe1ebeZe5/s18c2rKA49xXAQTI/e0h/:vMQhWTXAQT4NqFj/ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568784, "uuid": "c0ca9185-f653-49cd-ba98-37b2ab205a87", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568784, "uuid": "b78aeae6-07a0-45e1-a645-66143cd006ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568784, "uuid": "86bc1fcd-51ff-4fe8-add2-ed503d3dac2c", "value": "5e6061ee64e34417c7ed0d4707f492d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e588ee-edc7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683567732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567732, "uuid": "0509f3a4-baaa-40e0-a1e9-2ea2e0922f46", "comment": "Malware payload (Gafgyt)", "value": "3f82b0e7744a9d5d8212185d5a364577", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567732, "uuid": "ed65a6ba-89e2-4209-860b-a262998fdcfe", "comment": "Malware payload (Gafgyt)", "value": "1c1374614b3433325b9756cae61777c06eda2395d0ac3e513b016f2bc09c2e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567732, "uuid": "f281dc85-faec-4832-a59a-87a577af8073", "comment": "Malware payload (Gafgyt)", "value": "ed2e0277c5fb4c6c6d465356610b3fe3f7a1615d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567732, "uuid": "7ea5aee5-555f-49b2-9d95-004d48976140", "comment": "Malware payload (Gafgyt)", "value": "49a40368aa0957936cbdd468ea4cd38f522ddc69834ba84de2d7172865b45a848ee8c6ba5feb77a7b0c612fc0b05ae98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567732, "uuid": "fda84688-76cc-43a8-9dae-452a9db879a4", "value": "T15DE2D706A642CAB7D8930BF502AB576A5671BC1A5F234F46E32CBCF89B134CC311774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567732, "uuid": "cf9a8b5f-47de-46af-95f5-03b41886a76c", "value": "384:fcE23cxYH9dPDePr2j+HjqTeHOIpJ5q1suqmhP1CUuZEw8NoE9ZDIruQbtFHpC:0YyHCPljqTeuOosnmhzvNnQBFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683567732, "uuid": "ddac14c6-f0fa-413e-b489-160615c1deb3", "value": 31286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683567732, "uuid": "c0e20554-fd1e-49a3-8636-fcfff44680f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567732, "uuid": "43785625-52b9-42e4-8a30-46815934273b", "value": "Corona.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b09f0c-edc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683565529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565529, "uuid": "7b37c4a5-069e-49fe-a2c6-9c273a72c2f3", "comment": "Malware payload (AgentTesla)", "value": "8cbdc7d1fc24baa19b25ed1d3661cc5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565529, "uuid": "52f26313-9fec-46fc-a0cc-afdb15480c41", "comment": "Malware payload (AgentTesla)", "value": "1c3e05c1dc57b82fb25bb8af32bad88ef17a5078818598c30738675ccc4729fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565529, "uuid": "e23dcc59-8b00-48d8-910e-4b248ff43db6", "comment": "Malware payload (AgentTesla)", "value": "abda75ce50c8c619686c22de6077d5e1c4ef78dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565529, "uuid": "9d2d1980-6f57-41c6-8361-35521e95d755", "comment": "Malware payload (AgentTesla)", "value": "9a0613487c1fdfb9196c975e5bf456db46a2300eb7b26f12a81c447e5a2d74a77d192b3d420fa886e08ac857c851c122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565529, "uuid": "6f9edb61-2ba1-4176-a368-be1b2c67c59d", "value": "T112F4F122B169AB56D37C47FD5608890007BC2522BF7BE7282DCF50C9ED76B406711EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565529, "uuid": "e801ecba-d2ef-40e4-902a-a67f7c88ac94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565529, "uuid": "0e57d195-26a9-4104-a0cc-f0e32d90881a", "value": "12288:mRFGL1gmxsGKpbRyDPaNKg1p0I9eOuSD1VUNu+5ybMmYsRDf7PTHBz:KU1gmqTpbUTaNK4p0I9vrnUNbZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565529, "uuid": "0a45e61a-2d51-4053-90d3-0a5c9e339cd4", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565529, "uuid": "e4636911-bce1-403b-a224-5b0e51200b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565529, "uuid": "3bc6d1c3-6d2b-40ba-bff2-881512e36752", "value": "RFQ for Ticket#672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbde7f3b-ed68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683526987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526987, "uuid": "32b53452-4e80-456c-8f82-1f708f80db4c", "comment": "Malware payload (GCleaner)", "value": "81b4df047a3abad9ed24f93b2651bfee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526987, "uuid": "8ce1dc4a-7f51-4cf4-8bd7-97d9073d8877", "comment": "Malware payload (GCleaner)", "value": "1ca314c9c69ed42a7a800542757d83c7e34e9fdc5cb5c2cd9589a17094fa6b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526987, "uuid": "df8c4b2f-581d-4773-8c15-09a5b0bbb4f7", "comment": "Malware payload (GCleaner)", "value": "919f46f4e5a406948ed7ec83af75e87d7e6240eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526987, "uuid": "4ad67234-cc28-48e0-ad96-70826132bf4e", "comment": "Malware payload (GCleaner)", "value": "f749f698d5516b605a3833395ca527c35e114400705b9030b1e565dfa34a1be6ddc62a04ea2681155ffa652f0bcac057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526987, "uuid": "0fbad935-85a7-4aee-9d35-196c65f36653", "value": "T1ED953383E7E183B2E3BE9B362D46C996C67C3D75182C84A3175C496C7E3A2857C8E057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526987, "uuid": "42c8c8d0-3167-435d-97a8-e1cacf4fbc3d", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526987, "uuid": "8a01fc83-1399-4c5e-8ea9-52ecd401e3c3", "value": "49152:I6bRaQNt6LEuime9R2TPumCukx/tzYIdjE+KCegGrFhAG5cG:IiYQNsimCR26vzYEBKvzTXcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683526987, "uuid": "c3faa5ba-9e12-43b2-b38c-b8337450ee62", "value": 2024219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683526987, "uuid": "8694c366-cde9-423d-8c01-a0e4857a8482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526987, "uuid": "3bfc493b-ed9e-4886-9565-408358827b4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8e6ad3-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530102, "uuid": "772f5e17-eaf4-48ce-b1d7-4b74fedbba0a", "comment": "Malware payload (Mirai)", "value": "2fca28a13077a0c55744580f26c65132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530102, "uuid": "72302da8-8c50-425c-b3ee-a1cc12e8e0f0", "comment": "Malware payload (Mirai)", "value": "1ccde5057994934ccf53e2876fd1a19ed7ae423d83d2c9cfde0bf4b0d48171aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530102, "uuid": "bcadac09-41cb-4aa4-8e89-0391e7cb773d", "comment": "Malware payload (Mirai)", "value": "56e74820dab7644a0484c85540553e6e6229956f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530102, "uuid": "ee14aac2-e249-434c-ab39-b3279b2f16c4", "comment": "Malware payload (Mirai)", "value": "bd160ed3a89af2702f5ad2ed922f92df0b8481bc751df489954793838891baf7a610f513d2632c0230607eb2cd189f7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530102, "uuid": "245841e1-6252-4625-a032-668cfd7ecf1b", "value": "T1E6433B85FDE0DD0AC9E522777B8E41CD371A17B8E2EA7107AE195F603B8A46A0D375C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530102, "uuid": "44980518-5c65-450f-805d-82b93403ee7a", "value": "1536:4ipRWaWw0pu/u5GkjzC/BNErtALlERLSzFks:jxEudI+NSALlmLSzms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530102, "uuid": "d3e77303-5557-40b1-807b-3e45455e7e02", "value": 58440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530102, "uuid": "b6c5562c-fb68-49ea-9516-c761ad7d81f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530102, "uuid": "dde7d471-cfbf-4911-880c-56d09a537f42", "value": "Andoryu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f064548b-ed8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1683543798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543798, "uuid": "e79eaeb6-0544-4e49-838f-7205f3337b8a", "comment": "Malware payload (DarkCloud)", "value": "f039cad76ad3bf2ec8bd5143f86319d4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543798, "uuid": "b07d9619-09d9-48cf-ae92-cdad82fbfe6d", "comment": "Malware payload (DarkCloud)", "value": "1d4eb9077c97b5ad001206eff72789b01386a2c253d34875fa1c1acb716e2e56", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543798, "uuid": "bd4d9d18-55fa-4e51-a597-c10c11614678", "comment": "Malware payload (DarkCloud)", "value": "af481ed8f7f97787ec9e7f772cac808b5c946314", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543798, "uuid": "b5b7a7db-5902-4f37-be27-f0e45f6563fb", "comment": "Malware payload (DarkCloud)", "value": "3f1d671d3a10722bd3ca9f4f07b0c07047d9e4acd79e01af342fbb92c7a0cfef17257ca98c50282f487d700142e07227", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543798, "uuid": "c27caf5a-effe-44f8-a2e7-78fbe7b09cac", "value": "T1F66523D0F2F4DABAE40A4AF038B87325233174F3E4C4E6D44EAA5C845ED6B512D5496F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543798, "uuid": "a902434a-abb9-4877-b32d-73fff383f7d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543798, "uuid": "cfbb6d36-2a6b-4273-8021-f129b215bccc", "value": "24576:hM3tRebt6C/vnTFnmQGJa95viDoO6Q3M8hrbR61pMYY5CnFz/9nKT:hM3tgb1FyJ2iDoD8hrbRSwszlnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683543798, "uuid": "d9afddef-93b5-45ce-87a0-a9a1beb20fe9", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683543798, "uuid": "be4e3051-eb1f-480b-85e7-4bbae08d39b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543798, "uuid": "10dabb41-8847-4b89-8387-c6970a585eae", "value": "REQUSET FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f2a0df-edf2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683586086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683586086, "uuid": "7bb3f905-5cd6-4752-a70b-122b2d54cf28", "comment": "Malware payload (Mirai)", "value": "edf0af5d14422e7d7324848ed16b0e64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683586086, "uuid": "7c462663-70e0-4275-9f5f-fa9ea2c7ad11", "comment": "Malware payload (Mirai)", "value": "1d6ca15ce9e039726f1bcea0c5c0016430af86e9830d231426a0dec723a4c7e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683586086, "uuid": "c07e0fe1-88bc-4086-81c4-0a01ddf5b009", "comment": "Malware payload (Mirai)", "value": "2b8bfb57aa937cde5b80e8c7a067578e80fdc406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683586086, "uuid": "df327cee-c7c5-445a-ae64-232e7544254a", "comment": "Malware payload (Mirai)", "value": "7ea6366e9401b375326f6ffc2ed5460eb9d346883a5255cb41b342258d789ac2ebedf0aa569963368ca5ca1bcf884450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683586086, "uuid": "653c75ea-cd37-4585-b987-54ef921d3bd7", "value": "T18DC2D07092AD1DB1C6500532EAB856C5BB830FBDF6FA3C90224057BB38819052DDA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683586086, "uuid": "a889d7b9-30b4-4572-873a-ec2641deef4d", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEq1C4gqEhymdGUop58:A7soTAZ3alkXLvFh8nNE0gqEs3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683586086, "uuid": "4dbe1707-e188-4a3d-b840-66998a3c9b72", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683586086, "uuid": "03fa22f4-faaa-4f2e-9c87-5a847739818e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683586086, "uuid": "37e5bb77-f849-4d97-b706-ec3925694837", "value": "edf0af5d14422e7d7324848ed16b0e64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58622b0c-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683534524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534524, "uuid": "3e3ba5e7-3a0d-4350-a11f-402e97307cd0", "comment": "Malware payload (AsyncRAT)", "value": "415c13ec20308d91e64ca0a2c177c2d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534524, "uuid": "7bac666c-a0a9-4b40-af1e-8f2747e13a4e", "comment": "Malware payload (AsyncRAT)", "value": "1de2e96d4ccbc3954e5a7932b823f268e565639a0aac20e41fae23248d32d1a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534524, "uuid": "3f752006-1ae0-4b85-ba61-6767ec2a9ff7", "comment": "Malware payload (AsyncRAT)", "value": "ef368fb29031160391eb870f544db9d99d7dd163", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534524, "uuid": "b381cfbe-7fe4-4d90-b4e7-5a212b17f295", "comment": "Malware payload (AsyncRAT)", "value": "63b1fbcc52da6bc51a1c14231ba720030ee039626d9b2af6e9179caf02562198fc587b05e29d1fcab3ed10b0746e8f51", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534524, "uuid": "2d584fb9-924b-4a86-addc-f45c186bf816", "value": "T16E251242F6D288F1E1731A360938B724A57DBD711E34CA2EA3D47E2DD972191E221F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534524, "uuid": "729bdc17-7f54-4ca0-aa3e-78f149c75db1", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534524, "uuid": "085811e5-8c28-492a-a867-4e3c9d293466", "value": "24576:wNA3R5drXUD4pLBEl4fcGWDNdxf9Cfs4foN61HH:p5KeBW4fcGWDXDOsuoN6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534524, "uuid": "ff22b054-711c-4c6f-88c3-9be1d35b900b", "value": 1006000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534524, "uuid": "7dc7b41f-57cb-474f-92e0-1edc46d65d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534524, "uuid": "f6c4d234-73c2-4327-b32e-317b201786d7", "value": "ODEME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ae0701-ed9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1683550028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550028, "uuid": "abacf2bb-bd8a-4ca3-b3f2-286825fa5bf6", "comment": "Malware payload (ArkeiStealer)", "value": "7af7a8b9317559080dfccde33958602c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550028, "uuid": "ec8c95f4-aa72-4d68-bd7d-0616d1371cd1", "comment": "Malware payload (ArkeiStealer)", "value": "2068c94f118c1921f4333d97935e35ce175803820c44444277563fe0f82398fb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550028, "uuid": "fa7dbfda-cfe8-4ef9-a187-943491731e68", "comment": "Malware payload (ArkeiStealer)", "value": "9f60525ddb66fc5dbcb355c35d8cec054958d51f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550028, "uuid": "a536cc4e-98ea-4dc2-a3d9-0e730985defc", "comment": "Malware payload (ArkeiStealer)", "value": "49735facbe8d032e2470de6120249d13b02bae393f18a98d277286cf96c0c777df56dbfa2ccb7392008ede1594b059aa", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550028, "uuid": "e3c3d42d-bba3-410b-874d-00472272630e", "value": "T12494BF5372A0E873D5164B32AE2ACAF46A1EFC60DF5576DB324C7A2F0A701E1D532712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550028, "uuid": "4de26fec-7a86-4540-bc2d-c7bef583f35b", "value": "51ff29d4db4362644e59273b02a12d87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550028, "uuid": "10b1dcc2-52e4-4dad-b3c5-cc9e68c2fd15", "value": "6144:faJd7H3ThoyQbU22BWTg5+j0iH9gE2WgI2hfX5lbA:fad7H3TLbBQH9jXSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550028, "uuid": "81629ede-91c3-421e-9416-40e8f1c6a8ee", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550028, "uuid": "16611461-c508-48e0-bef5-95879875e47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550028, "uuid": "0b4fa792-8b59-4d07-94be-d02de398b243", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f88b074-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683570265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570265, "uuid": "56a36bce-1d49-4395-a658-e4a9509975cc", "comment": "Malware payload (SnakeKeylogger)", "value": "da8c6efa2807d4a85dc2269f4f763951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570265, "uuid": "cfc75b7e-4610-4aa1-bafc-d109a180c163", "comment": "Malware payload (SnakeKeylogger)", "value": "20fb89955cb329bf5597f90a7510f92a33ab31d05c21e1374a52e89dde377a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570265, "uuid": "6e03d26a-2476-4c34-be95-d5eed7e0b7a4", "comment": "Malware payload (SnakeKeylogger)", "value": "d0b3a2066f1a3aaf34431c4e2cca840cbcb2136c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570265, "uuid": "38732d0d-9d2b-434f-897c-84d3d1d609b1", "comment": "Malware payload (SnakeKeylogger)", "value": "facda1f7db45715b6ac4f19f1fffac2757c6e6f336ec259abaec18a9cbdff402233ffa77e245b16651f5dc36fda431e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570265, "uuid": "05cbd976-8386-4255-b5dc-771a8f151cfc", "value": "T1C3C4F11172E9BF92E93E4BF42424724007B1316B64E4F6AD4DE2A4E97AE5F810741F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570265, "uuid": "7f9e6410-977f-4f14-90e8-7531b4781d33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570265, "uuid": "3f97b01f-580d-43fc-8830-17ecf3244380", "value": "12288:6LdowDNQo1KHtLUnJroFFxAK0h4pDyxJ:6LTNQhLUnJKLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570265, "uuid": "f02efd39-3665-40de-8e09-0b3adb0d7f2e", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570265, "uuid": "ed44f653-27a7-4543-b66c-a53e7c86dd3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570265, "uuid": "21b70fb8-1149-4f78-8e3d-15024199feb9", "value": "Signed Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c6b70f-ed7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683536851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536851, "uuid": "e69b67f4-4b3a-4963-91b3-b841447f3b1a", "comment": "Malware payload (Loki)", "value": "e47e3bd985effc1d1352ac832a09da14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536851, "uuid": "f5a0056e-7f71-47b3-a34c-dfd2859dc7ec", "comment": "Malware payload (Loki)", "value": "216c876b63a28c7262bf7e425521f035509db0260e830710fbaf94dd2b61212f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536851, "uuid": "9c4000dd-b4fb-48a3-8b44-a18d2fbabf01", "comment": "Malware payload (Loki)", "value": "826ea8e2487a12f27fb32039363f64361e4def3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536851, "uuid": "8dd179e8-0cd0-4e50-a412-3435af19f025", "comment": "Malware payload (Loki)", "value": "4da078fece14783d066c9b53f76f9ac82239366d14df6935c7a9faf6d186cfbcdc2a4aea5bb8aa87a1d885a7b6d9dd7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536851, "uuid": "9ef5703b-0135-45b2-abc7-79907360c8f4", "value": "T10DA412A4B2FACEA7F82D5EF4142CB95013B0715384D4DAD84F7766489BD3F101E88A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536851, "uuid": "c45d2fa9-c9ec-45f8-be91-df6b52686bfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536851, "uuid": "ec14faec-7df7-4ba3-83aa-d23575def719", "value": "12288:SCrm0b2E3zgm2RFDESHmx9w2DWUUwXSx:SB0b2wIfDXHmbw2DMwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536851, "uuid": "53385900-8f46-411c-912b-52dc75d23db0", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536851, "uuid": "29f3fb1c-6407-47a4-9898-631c22650e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536851, "uuid": "2cd86479-a444-420b-8b89-0498546a1701", "value": "e47e3bd985effc1d1352ac832a09da14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6bbb98-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565907, "uuid": "f27650da-f456-4bb5-a5f1-8649ad4c511a", "comment": "Malware payload (Mirai)", "value": "11ac9d0f74690af6d613a7fd92001642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565907, "uuid": "7ace9254-1814-45f2-8324-1d49c01c3fa2", "comment": "Malware payload (Mirai)", "value": "21ba496a638eb57aeea8b90331f9913b7d92e223a97668a5e991be3910291e9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565907, "uuid": "dfc7de34-0259-4632-9006-3e8e32253c2b", "comment": "Malware payload (Mirai)", "value": "b7d6b315a213655b32826bf512967bed8071a82c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565907, "uuid": "e6b15d60-149c-4cf7-8e99-ba6c208730f9", "comment": "Malware payload (Mirai)", "value": "a9394599b20924f0ab5d1c664d4eb34a46840350173cdeb4af5e783414ce3573192c5eec0747d506ef692c57afaec373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565907, "uuid": "4046ee8a-8fdd-4d1d-b447-5a036bd947ae", "value": "T18DC2F127B0AA124AD6139936D24DA02A842F5CD07BCF654337CFF5ED3655C0CA87AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565907, "uuid": "f954bf58-bbfc-423d-a759-443c46944088", "value": "768:726A29MSaInDSzLWikmJR5rT0iRnKG1bEtl:C6n9DczJ/0iRndbE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565907, "uuid": "266dccdb-95d8-4168-92fb-473fc40ee0ac", "value": 28196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565907, "uuid": "33039b48-de90-4d55-81f4-93f8ddbf1f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565907, "uuid": "f7365db7-ec8e-4fb7-a51b-4f245f566064", "value": "11ac9d0f74690af6d613a7fd92001642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7cba6b-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534235, "uuid": "7a3cbeb4-3678-4cd6-a982-10e41ef55253", "comment": "Malware payload (SnakeKeylogger)", "value": "bfc5e1315fed56b749614134f5e6bfb0", "object_relation": "md5", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534235, "uuid": "e3a78808-5282-4dcf-a885-083ba7a90dd7", "comment": "Malware payload (SnakeKeylogger)", "value": "224aab197e463ac0475240b508cd22a3657ce4d5baca37a7e05b7629912f9ac6", "object_relation": "sha256", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534235, "uuid": "28795137-51c8-43c3-817c-546befbf987e", "comment": "Malware payload (SnakeKeylogger)", "value": "e95bcdb382b6736461110bec3ee77b25fff506df", "object_relation": "sha1", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534235, "uuid": "e97ed9ba-918a-4abd-aeaf-f9090ff20053", "comment": "Malware payload (SnakeKeylogger)", "value": "3d724a26a991bd08fe0109491efd93e0b9594698cffd3e397e2be02d8252266115a93f6662d00ed2f5217dc537fef427", "object_relation": "sha3-384", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534235, "uuid": "bfeefa3c-47b5-4cf2-8fa6-b236d0e9154d", "value": "T1E2B412A4F6FA8AA7D41E49F40928F9401372707759C4DAD80FB66188AFEFF104E8495F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534235, "uuid": "2b1713b0-8b90-4ef9-8d9c-3967102d8520", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534235, "uuid": "ae04023f-4ce0-4087-8b9a-a1befe500ac2", "value": "6144:dkQ69Cie3XIQJ6K/jfHSUXJtc0J/IDhc2QDgQHw1ZTrOrZMKqHF8DNjMWV6qOGag:1gy4s/751iCGhqi2RjMWV69NcqQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534235, "uuid": "0fa523dd-a477-4795-a5b5-9dc4cb4e1a57", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534235, "uuid": "d65b177c-50ef-449e-8b57-81027e25a74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534235, "uuid": "e78b0978-2ce8-47d7-924b-d5713d2e4e63", "value": "CaixaBank _ banca digital CaixaBankNow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb8e3e8-ed8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1683542884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542884, "uuid": "1c1d06e8-c9a9-49fa-9408-f24ae36cfcc0", "comment": "Malware payload (Guildma)", "value": "0669edd59606bfa7cbd710c2a1976b4a", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542884, "uuid": "3a459df2-d899-4bab-bfdc-e77b35097baf", "comment": "Malware payload (Guildma)", "value": "22aae52b04e15a32e8c2e59942d284d758e56937decd31f7588749eb26163b12", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542884, "uuid": "583f16c9-b3d3-46d5-ba20-a7c5c652651b", "comment": "Malware payload (Guildma)", "value": "b2630072720f4e8c08228101cfe8d78dfcde21c4", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542884, "uuid": "f3f5e886-87b0-4006-972a-eb3d954ca8a9", "comment": "Malware payload (Guildma)", "value": "1be444e38bd04a115318d96de9b5251a678f7b243c98fcc238a2ad0890771369f388aa36049feed637c008bf95a0efb0", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542884, "uuid": "5d7adc3f-60b5-4377-b7eb-62b7a358ad03", "value": "T11901687C67175740F12347B1E34885D7CF765150065597C95C8503539B09C63D5A8456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542884, "uuid": "c0852eb4-7adb-47f2-b92c-6bcebfa3b591", "value": "12:5jouA3Syl0/ITdbwgSooSPFIN64ok1eMqOkTaJ3wXtaUQ/:9ouACym/WdbwcoTNf1HBkaJAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683542884, "uuid": "f9ceecca-3fa7-40f8-b5e9-9eee931fd55f", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683542884, "uuid": "dc6b88c6-c580-4b3f-8e94-30788b4dd682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542884, "uuid": "a7e2eeba-33cb-41fe-864c-ec21ffdbe238", "value": "NFeExportacao_downloads9878571473.010676.89744..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254a19b0-edc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566221, "uuid": "e37c3d56-7449-451a-a6d0-157a78b60bd5", "comment": "Malware payload (Mirai)", "value": "77db44ba33019252150aecb42781e304", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566221, "uuid": "2ecd743d-6890-47ad-bf85-09e7f29f57df", "comment": "Malware payload (Mirai)", "value": "22e4c31dfb6b53abf0df909ce7c1e6837066e625ab9e1dbbd426d0608792cb8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566221, "uuid": "b4e2a3fc-597b-4673-9487-01408f2e74f0", "comment": "Malware payload (Mirai)", "value": "b638860f099dda8970182ac7011d0e817ff615c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566221, "uuid": "be6a9686-f924-4094-a751-109aba859c2a", "comment": "Malware payload (Mirai)", "value": "c760b05c0bbf336e1c72627ea914e7074269e4be2ab39966c4b6cfc6434f61f621b418dc6070b629f2acccf5ff6fdc07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566221, "uuid": "7d84e780-f110-429f-a4d2-43dfbda19c8b", "value": "T1A083087C2515B6BCE9F28074F40328E738510A4837DDE1D3B59340BAFEB574CA62AD6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566221, "uuid": "f361a396-0b52-43de-9922-4c6338d0215f", "value": "768:Tf/GfJKaMrYNFA72oxlNThMP8ZWWoeJ6FhUL8ggw3NPXgKDeW1q/g8748CNlz4VA:T3wI3rYylduFr6nq/pefz4VcjlVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566221, "uuid": "5ef3a061-1d02-4e1f-88a4-2ffdb60ef563", "value": 83420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566221, "uuid": "e5a858db-5966-4f86-9176-6e7da2ef5f98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566221, "uuid": "9789e806-a38b-4c62-8efa-81e625317142", "value": "77db44ba33019252150aecb42781e304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daca1a4-ed45-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683511635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511635, "uuid": "f08e6e90-65f5-4006-aa75-be86cc1a733c", "comment": "Malware payload (Formbook)", "value": "2742755e3fef9f876e7b23f37b653ee6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511635, "uuid": "04f77cc4-c4f5-43d8-af61-209284c9e9c1", "comment": "Malware payload (Formbook)", "value": "2400be915c3981fa03b79f750cc5e37ae832d21e5e7f6bbd6753761286b036cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511635, "uuid": "6c5a3756-246b-4d2e-8f50-fe12074d2e7b", "comment": "Malware payload (Formbook)", "value": "4c9278714c0aae121f89e1273d02c08b2b4af412", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511635, "uuid": "e3743166-7fc9-48d0-9010-347e5c39cb82", "comment": "Malware payload (Formbook)", "value": "c20176b418b8d106e36d77940d226b6d2a86eec076d653a65392b5f693f45b2defd63a5656fb365e5ac9e4256ce33590", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511635, "uuid": "af7587aa-8f11-43fc-ad4f-e9184c0227f9", "value": "T1550501A314BA8350E03F87B079B8BD2417B335DBE9C69E7403296AC59D5AB113C8D49F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511635, "uuid": "baf7c2fc-fe37-4742-b952-b3bad6cb19be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511635, "uuid": "b378a324-3d05-4a11-beb3-ea5544c341d2", "value": "12288:9bkcdXHwni4IyS+ORD9sGko1fkJgN74XIDUm7ZgQ488fLyDJ5Uio:9bJNwLORD2glbfDj7ZgQ48O215Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683511635, "uuid": "60a6fb64-a9b6-44d1-856a-bb9a0e20e215", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683511635, "uuid": "4b93982f-d038-4999-bbdb-29f6f977f870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511635, "uuid": "9509ae58-cdc9-417b-82ad-e596a99e2283", "value": "2742755e3fef9f876e7b23f37b653ee6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ce2e78-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565928, "uuid": "b19eb3eb-4c46-4c48-8ad0-0a806f5bc14a", "comment": "Malware payload (Gafgyt)", "value": "d8be51a7159d7b5a6a4d34f5ba8928c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565928, "uuid": "0872cb39-97c1-456f-a442-3273a7df9cf8", "comment": "Malware payload (Gafgyt)", "value": "24124a04e21f08ba69090b0b0bbb667d5fa4a0eb2828930067e9891cd82830c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565928, "uuid": "cb8c29db-5ee9-42c5-936f-3b3c2a8bc3a4", "comment": "Malware payload (Gafgyt)", "value": "0e732e2cd7aaffeb6034266a7006323a7714602c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565928, "uuid": "3105fefb-4b67-4b4a-9d47-cfdd6b0fee39", "comment": "Malware payload (Gafgyt)", "value": "d0db585293c7fbbae4c0dad8e9633c0f04c05c8cf5522db5f3f49efad8cd804b5022c06308338131f9914768ccdf23b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565928, "uuid": "d467ba3c-28f9-4a49-9018-da3d4732cf82", "value": "T181B31792F900DFF6F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565928, "uuid": "1f2b7b6a-907f-4eaf-9c50-99c21d546958", "value": "3072:mp+3MNBCpCTyRQpimmrytKys4OWlKhRm2pgYMx3IPtW:m+CTyRQuytjseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565928, "uuid": "76447f7a-155b-40d9-8a41-d6a1707e4928", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565928, "uuid": "9876c89d-e3d8-4f1d-8849-04d4add609ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565928, "uuid": "5571b533-3adb-409d-9e49-e3736ae3ea4d", "value": "d8be51a7159d7b5a6a4d34f5ba8928c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeb7ab1-ed7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683536087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536087, "uuid": "cf5f38b2-2c4e-45f7-acf3-07c2628318ab", "comment": "Malware payload (Formbook)", "value": "d0ded728298dbe50960b171495d3e5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536087, "uuid": "36db4e28-7565-408f-9ee9-037a484d4a31", "comment": "Malware payload (Formbook)", "value": "2413b677dc6d6a5c958ce9b8cfab7eab38151088dcbe5a1d3b0ea903a0fc5ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536087, "uuid": "6acdde74-3255-4009-a076-52895c55565c", "comment": "Malware payload (Formbook)", "value": "3bc6975eac4e9dbbf7395128227b01980787ee1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536087, "uuid": "c1f52ffe-fbca-4c50-80cf-299dc6982517", "comment": "Malware payload (Formbook)", "value": "86fbd1ab3baecf8a5568c2cf96a470b9e7102ec804a446a62d477ca53b1aacddec7c1a646a04224757d9d40df2fc43fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536087, "uuid": "9ab39ba2-3d45-4bfa-b2db-1e64a83e3bd7", "value": "T123056C9FF2E39437E4712339895B576568157FA03918EC4AABDA3C8C5F3E2903819363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536087, "uuid": "2be57b04-ca83-411d-8784-b58b3a26c3c3", "value": "39ee9d8fb14f217c683f93ae1bfee6d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536087, "uuid": "e4ac4d82-2cb0-43dd-9c66-5a22c733dc44", "value": "12288:vX44VFiwL9aDSm20iw+hm4m7YHDcbhT4EbLGHrn1XAjQzBTPD:vpzH9aDSm2A+hmD6c9T4EvGHr1QE9TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536087, "uuid": "ab034fa6-e17b-483c-a50a-21a60a6d98c0", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536087, "uuid": "a4e8f4c2-0791-4520-b458-02ab492c8c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536087, "uuid": "05f33a60-3d8b-4c42-8b98-6ce8c1954326", "value": "proforma fatura pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a21edc9-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534205, "uuid": "a21a1592-b4cd-4462-b92e-36f242bbe37c", "comment": "Malware payload (SnakeKeylogger)", "value": "cac8563e5e1813454b699556d41721c9", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534205, "uuid": "d3e9e710-29b4-4a48-a991-fdefa8118310", "comment": "Malware payload (SnakeKeylogger)", "value": "2535b5bde8fbe58fcddfbf7acf196a1290159e707c87929a1ae94bc7970e1c5c", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534205, "uuid": "65e0fd92-8eb8-4b38-a09f-5ffc02127a6b", "comment": "Malware payload (SnakeKeylogger)", "value": "e76013e8e94ac9acc11ea23dbd3ff997fe797197", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534205, "uuid": "07d126cf-156c-415e-a278-2dc7a0b65f1d", "comment": "Malware payload (SnakeKeylogger)", "value": "689cb322b52d4c969da0fc5b854f41a4aecd44a27a7434d51dd2a0ef0bad90eaec5023daa1a15f70f685ca1b9d3c0f29", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534205, "uuid": "0bb6f68d-d76b-4c19-85ba-194792f035d1", "value": "T14CB412A872F68667D82E89F91538F90013B1B1A395D5E6D80F7215CD8EDFB001F48E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534205, "uuid": "8f01ba5c-eb0f-47a9-8c9b-878f293bec52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534205, "uuid": "5dc9b1bc-d13f-4628-bcf5-fa8df2c375f0", "value": "6144:8LHy9CiejeHdPvqIAcfHqes4/UfmDHoQHP7cUGZYmwZTln6Algv6+w8WVz5fH4Xj:CoCEpvlqex/Uaw9MZ96nW1tYXrnis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534205, "uuid": "b380f5f9-816d-4045-84ad-09894e18b288", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534205, "uuid": "fd25a5b3-1afe-4ea9-8894-00768c648bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534205, "uuid": "14587030-a368-447e-b645-32f7741eab47", "value": "Comprovativo de Transfer\u00eancia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bf02d3-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683504669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504669, "uuid": "c6dd6750-012e-4eb7-966a-b64d20d824fc", "comment": "Malware payload", "value": "28fa212e19560b1bf74a78ad921c5862", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504669, "uuid": "36ef11a7-22d7-44fc-8513-f46f82e801a5", "comment": "Malware payload", "value": "2663db7631452ad059733c8a586210b19e9f497d21c01fac9e386e195ff225ea", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504669, "uuid": "97ac4fc1-b067-4669-94dc-b6e89f716edf", "comment": "Malware payload", "value": "0416575a601fe394007619523e10844f57d44e82", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504669, "uuid": "8ade150d-6bfb-4972-b97c-d3e1713aa90b", "comment": "Malware payload", "value": "c94e5969b4be4c443316f43000ac74f3227ba6e342dbb4f0d8f45b996ef3e512221cca2d2371d9b904af4cf984adf77e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504669, "uuid": "311ce604-2e15-4ada-9cc6-8fce6552bcaa", "value": "T193B2F4565B8C4C61E26AE8BB435DA00E18BCF63234C205C5FDADE2717B7D10E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504669, "uuid": "0d733916-d525-43f9-8257-2fc0a4873a54", "value": "768:4KVZYOClUBAuqn3qRs4UBVHXJxq6t2Um08uEi:4KVZY7lUBA13asjNu6t2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504669, "uuid": "0539b13a-39a7-4dd4-b8a6-a34822de5c39", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504669, "uuid": "ff5e694f-1c26-4187-acdd-134f3f2c2915", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504669, "uuid": "9b34b27a-86bd-4d87-9c84-ce15da576353", "value": "28fa212e19560b1bf74a78ad921c5862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f711ef-ed68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683526814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526814, "uuid": "5950bde4-e0c4-48fa-8ef6-eb422c556459", "comment": "Malware payload (Amadey)", "value": "59db0880cd3ca5b6b90d788f2563c8ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526814, "uuid": "df9a61d2-8e04-425f-b8d2-fca40506d048", "comment": "Malware payload (Amadey)", "value": "26a0d827866e344e7c2d0dadf3a45bc70e9fa7bd7a932605c0a27939d9e43a0e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526814, "uuid": "16c48dbc-4278-494f-bc34-2e2d4322418a", "comment": "Malware payload (Amadey)", "value": "05f077548316b38e066d1bb04223bd526669d03a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526814, "uuid": "9d686682-38f7-4726-8b74-a6a02a144676", "comment": "Malware payload (Amadey)", "value": "4118f561753d0e442d8b519603f8dfc6e5c37382ad8c7c96ea07c499f1b03fefb4eb4ead8ce44bb6039287df6e87a946", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526814, "uuid": "a9b46ea3-fad5-4e66-a36a-5541ad4ce5f1", "value": "T121642B0383E1FDC5EA264B728E1FC6EC7A9EF2508F49776922189A5F45B10B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526814, "uuid": "a0ca21a3-3f42-4f2b-b45f-ad9855527b45", "value": "513663070e5d163878e1cb9d4a5e6408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526814, "uuid": "348e30bc-06a8-4d0a-9807-e1c8e3b9e06b", "value": "3072:gAXTttA5vkO1kCL2Bhw+7A2mb4+bmCL9jGD92wQEzd4VbAmfgI5gMn3PZ4sHQ+T:hXA5b1Lchw+U2M4+I92WJkKyKsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683526814, "uuid": "1c7c7313-c49b-407a-8d9a-e3124c4abf4f", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683526814, "uuid": "da3fb509-263a-4e11-bb48-d909b2333555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526814, "uuid": "cd418398-0115-4959-bd2a-b2478a37626b", "value": "59db0880cd3ca5b6b90d788f2563c8ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c7adb0-edb7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683560695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560695, "uuid": "84448384-29ac-4e38-9e13-1002f1db9142", "comment": "Malware payload (Formbook)", "value": "41b41296821338a634d99d5b5c749ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560695, "uuid": "acfeef39-bec7-4f09-b050-e9aa6a939a84", "comment": "Malware payload (Formbook)", "value": "272872a41e4e0ae720f6f61e50320720cf0313fe65d4c039334ed6c0cb7f37b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560695, "uuid": "a462beae-50cc-4171-90cb-6c71e5899316", "comment": "Malware payload (Formbook)", "value": "747470c76d47d50eaaa891edcc2f17b22b07d1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560695, "uuid": "3bd0a673-4e88-42a0-925e-cec5a589fc67", "comment": "Malware payload (Formbook)", "value": "3fa228ac8d70b37fa715b712777e4ffbd0d091cddd84bd132f0d18d3020ef80b5b2d30faeffb5bb7d287aaa3151d882a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560695, "uuid": "ee7065dd-53a5-487b-a795-c64dc6578f96", "value": "T108245B5BEB4C9606C4269A3008B222759335DCCB1E799FD3F46C76298E3B3947886376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560695, "uuid": "85a17089-849d-436a-a44f-c98e6f295ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560695, "uuid": "60bcc8a0-d2e5-4aed-9198-1582eec667b2", "value": "3072:d0gHHDGWvgDE4u+gCGHjEmELWQ88ffVls4:WkDBuEawAWE3Vls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683560695, "uuid": "915773cf-5665-4c41-a854-f2b34521d1f6", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683560695, "uuid": "5b294d3c-1c49-4ff3-9264-fb1aaadbb406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560695, "uuid": "140150df-eaf8-455e-a931-9a97da015b9c", "value": "PO-230102_May 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c97e50-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683527325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527325, "uuid": "4750a7a6-0c9a-4134-b1b7-c0c4a09df3eb", "comment": "Malware payload (Mirai)", "value": "70da98591385e66f27d23287df60fe97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527325, "uuid": "fdf8fe3d-8340-4f03-b45e-38e97512dd7e", "comment": "Malware payload (Mirai)", "value": "2784d5a3a712ef3dbe5e84d8a0e48fec73c6f9300dc153cb171f1f206e09ad1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527325, "uuid": "6c5b3089-0d8f-4e44-94db-9e8724fe147a", "comment": "Malware payload (Mirai)", "value": "68cfe28fffb47d14273bdb881338f2424b97445d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527325, "uuid": "cdd5c88a-24ef-4649-b797-a3331acf6158", "comment": "Malware payload (Mirai)", "value": "1bd49b61018bcf7c26b57c0551462109637e3800bd843373c2a9a353779cdd329d2c4dc03b99436409b176f52c192bc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527325, "uuid": "ae98711e-9fd7-4a9f-b0e7-f841568d2e8a", "value": "T1D8436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527325, "uuid": "3b8532e1-2c74-497f-b43f-5b01a3763cf6", "value": "1536:JeESt/basV2rcZhG6ySN7naWlSR9zWOIaEjrqMEs:JeESt/basVTgS7naWQRVtXESL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527325, "uuid": "fe532b0b-32a7-4642-ba66-4c8ed92fde7c", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527325, "uuid": "1a095b3a-0405-488d-a69f-1ea405fb76fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527325, "uuid": "e8218e66-95b4-4778-8914-60f02cca4194", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4829f2ac-ed78-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683533638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533638, "uuid": "bdbd783e-f722-4746-9b43-42420416ad64", "comment": "Malware payload", "value": "ce76eaf9fefcac1ba0ae6abb3d03acb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533638, "uuid": "f22f5ef6-5e2d-473c-9874-6a0064f48a98", "comment": "Malware payload", "value": "27c97c12f697a19100c97e75f8f61fe75c2b995d904594c554a5b35681c3ace4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533638, "uuid": "7b882aa1-39ba-4d98-9bff-e3f88402dc6c", "comment": "Malware payload", "value": "9ae451a95474ca2fd23eeaeab85559bac705b1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533638, "uuid": "afb76104-6462-40df-98ca-15fe0cd01a72", "comment": "Malware payload", "value": "541144aa9610641264c8477ec4d1345097a552b948f6dc97033f5acd83068d82451c48663ed96263343ea4b53d3230ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533638, "uuid": "43b6f6f9-f56b-4e35-82dd-c35f03c6f62a", "value": "T14B063322E358F1A1F21991BC2AD3A5771CEE753A026F40CA771341297F6CFB43A943A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533638, "uuid": "eaf9bd25-1616-453a-bd69-6bb296d92a4d", "value": "46582683e79e897ced5eb8a1828704b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533638, "uuid": "e4c51eb9-d899-4fb8-9e17-89cd2cfb4f8b", "value": "98304:n3l5k2QIyhHd8r0YNXZ/3C2cYHoy+lLHHCO:nV5R2hHd40YXH6LCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683533638, "uuid": "047c34c2-b720-492c-8845-d7f6dd27907f", "value": 3826784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683533638, "uuid": "d06ace37-c852-4baa-98a1-0cd0f464ec8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533638, "uuid": "cabfb177-3639-4a70-81cf-cce0ed672948", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71dd260-ed3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1683508054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508054, "uuid": "f7e01434-d22c-4ece-a1a1-17c1c8c715a1", "comment": "Malware payload (Tofsee)", "value": "0a0dd74c400e848fcf84d1217695746f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508054, "uuid": "43facafc-840a-496d-afe9-cf96aeb1628e", "comment": "Malware payload (Tofsee)", "value": "27e3ed0b63c7aaf1cdef8ff971fdf5c60fbf4507ef55343096f94ff6feb5f516", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508054, "uuid": "76c09683-55c1-4744-8e36-21a3b6883138", "comment": "Malware payload (Tofsee)", "value": "87a35d0bceabe086f8bfb0b286dd678a9c93d35a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508054, "uuid": "767ffe6a-55f9-403c-a933-d0fb49dc828f", "comment": "Malware payload (Tofsee)", "value": "28509387720083e1da41c515e3e9fa71ae2d4498a9ac3f4a952109348a2a190d5d4b3744ef11488bbda8f295fb3d5d16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508054, "uuid": "fa9743ac-e788-4876-be92-df65b2d5338d", "value": "T172642B0383E1FDC4EA264B729E1FC6EC769EF2508F5A776A52189A1F44B10B2C1B7711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508054, "uuid": "51f08392-8d26-4410-a0b1-51c4b9125745", "value": "e0ad233aaf9ebf0d2e326ac5df912cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508054, "uuid": "4e0e424c-ca2c-4111-bac3-916187039729", "value": "3072:8pXIEUbI/4pLTdJdBaLh6MbISGRiKT87mk/PGXZuZQ2y5gW5cF3PF1YWUqqT:MNU8ApLTd7BcpbIRR1sjFqpSdtS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683508054, "uuid": "2a3ec5e5-b5c5-4198-941a-c5a19beee56d", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683508054, "uuid": "b33986c3-8777-4149-92af-124efd11834c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508054, "uuid": "16039f25-b502-4161-9555-4cb91e52dae2", "value": "0a0dd74c400e848fcf84d1217695746f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7d3682-edb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683559764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683559764, "uuid": "5c5a217a-358a-4db3-b254-59abae46eb5a", "comment": "Malware payload (AgentTesla)", "value": "f8001587bbb6e217b0f812e0e6e797d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683559764, "uuid": "12ccafbb-b575-4a82-a640-e65f3c2faf89", "comment": "Malware payload (AgentTesla)", "value": "290900426b7f0450c34ffe8152e39484e70c6bd90e59958524074c70e3b19290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683559764, "uuid": "4fa50636-1b54-40d5-9eba-cd3c25584195", "comment": "Malware payload (AgentTesla)", "value": "4a7cd7bd476043fa41eb10ec27b9fff7440226ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683559764, "uuid": "f95bd0cf-0394-4b10-9e32-c659eaec3fc5", "comment": "Malware payload (AgentTesla)", "value": "28d2b3c9552ac1d3ac81b536ed7341347906242dce9e8d42e3b3e6171239daf6ee518e51a16a9d3c7d157bf168146d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683559764, "uuid": "02e39bb6-99c8-4281-b342-dc2d8e7bab60", "value": "T1ABF46BEC725179DEC927CD768AA83C64AA20747B83CBD203902315AD9E0DA97DF141F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683559764, "uuid": "8aa00c1b-1a61-4617-b7bf-97cd9ed92ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683559764, "uuid": "f6954437-ee7d-4fc6-8c84-758922988bea", "value": "12288:Adh5/nwKHStdaOubHFlqWskFNHVVnXW5EChryL8DVbL9Ly0sBjQ15626awsvsaUz:gh5/nPHSLaOevqWskF85EC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683559764, "uuid": "42742319-8b21-4b66-bacf-968156538dd5", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683559764, "uuid": "72b0bbbf-911e-4be6-a5b3-84b979797bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683559764, "uuid": "c815e10a-62ac-4041-9050-ef52285c466b", "value": "SecuriteInfo.com.Trojan.Heur.IEC.908d4036d15.14935.16396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6ced4b-ed6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683529293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529293, "uuid": "d692dcc1-b967-4385-bf8c-4a0c66673d02", "comment": "Malware payload (BluStealer)", "value": "b07439ae25abcf2d281132533f2c4aa4", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529293, "uuid": "f5826cff-6aab-47dc-8c23-ab1ed64931f5", "comment": "Malware payload (BluStealer)", "value": "2a84cd5f54e03590ad92e86ce6618dc5c31cb290e0845bb5de357f8c92af8749", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529293, "uuid": "d36a8e2c-371d-40bd-8eb2-dde52fd308d7", "comment": "Malware payload (BluStealer)", "value": "4137af7edd5400e7e87b1ef31ad3d69da6f77d82", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529293, "uuid": "08a6c3a4-70df-4052-80bf-1fa615073864", "comment": "Malware payload (BluStealer)", "value": "c065b69689ccd2e5f2496a3937331f087c2be67fbc7f7410c7421a5659fa63f6f9f0cd753ef044c29c5375727401170e", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529293, "uuid": "7adb8f69-e8a4-44a4-bf68-b1ef6e4b2f0d", "value": "T1297512312379BBA1ECB683F82618D401AFB46C61A7B6D6E84CCBB0CD9555B04FB50B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529293, "uuid": "dd8cd6ba-5484-43ad-b242-15fe3ce952c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529293, "uuid": "b2b6317d-e8fb-4bf5-ad8d-6b4f82004a54", "value": "24576:CPKc2E+VeksjscdkmsRzUHr+3KcQh3GgVqIB5WtS4DW3mkh9YnpZq7ZPGAw1c:GpEE3qzULUhgGgVqIL4DWPhWnpAlnw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529293, "uuid": "03f0a221-793e-4133-87dd-7716c5442a93", "value": 1665024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529293, "uuid": "e8b4c2b8-9f9a-491d-be9e-13675a07cd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529293, "uuid": "6f6796cf-44cb-454e-8b83-00ade91341ce", "value": "Technical Spec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ff5b12-ed96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683546411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546411, "uuid": "c0895d76-c56f-4c87-9309-ef29569e5753", "comment": "Malware payload (GuLoader)", "value": "f6b70d9395134f497326454146dc93f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546411, "uuid": "c41334dd-119f-4dd7-ab6c-f495434d0b29", "comment": "Malware payload (GuLoader)", "value": "2b1f9072d11a6ac9170cb1ef608dfd7369f63639cb78296f7643fce2b4192a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546411, "uuid": "84fe78a5-abe5-4ca4-a9cd-bb8566605bf3", "comment": "Malware payload (GuLoader)", "value": "e9d798df5b4d303b6fe54dcc3dc34232ff19ce28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546411, "uuid": "a4c008ef-09bc-4bcd-b9ab-98d9cb357c11", "comment": "Malware payload (GuLoader)", "value": "e1bc215cab63b337934c7de35cef6abd36e0d3be1f84369a81a4048a53bfab4fa8bef36969c8f22be824a180c52f3221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546411, "uuid": "486cbbd7-379c-4b88-bf4c-6dcf18471008", "value": "T1B0B49C9239C965AFDC2F4674035FEAB22BB95CE07381496E4F80361D5C3694A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546411, "uuid": "9b93b1b0-bf2a-412d-aca9-1f5b0db4401d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546411, "uuid": "a116ba89-258f-40c3-95c7-55d38a59b171", "value": "6144:GQ606xGPZVheNA+ff0/Cv/DsTO0pMzKiEd3uykFc9lLwoC9C0qiQ6Lfm1h3/sFJW:xnhe2eyCHDCOFKvKFcvwoUhU043/cZsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683546411, "uuid": "2f9072e4-d4b1-4dd1-83b2-eba8f6e4dad1", "value": 516106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683546411, "uuid": "cb668ee4-8819-42b4-8e3b-b61ee64c74dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546411, "uuid": "7778ed64-a372-45a7-9285-9213bd1ad40b", "value": "Justificante_operacionpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbf4644-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683552783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552783, "uuid": "c303fa84-6f93-4ad1-9bd0-f32900587fee", "comment": "Malware payload (AgentTesla)", "value": "4e4a378a7ccaed8a5780ebc01fd93afd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552783, "uuid": "60af8a4b-fb83-4a9b-a7ba-d3a9f498d870", "comment": "Malware payload (AgentTesla)", "value": "2c245c349bf18188ed56488cd0f42e05706c07dad4484847583013fd577fce72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552783, "uuid": "1030f5a2-a4bf-4d12-a8f8-c10e4db8a2a7", "comment": "Malware payload (AgentTesla)", "value": "9a20f4b2f0e760bad8174f6bd1620df3bea8f4ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552783, "uuid": "f7f189bd-0c60-4ada-8a74-fcee67666633", "comment": "Malware payload (AgentTesla)", "value": "3cc1263b34b441f2613ed2603780a80249da1ab09e08cf13bd78e7fd823dcdcadc35cd7b9dec7370ff3009d26a6121e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552783, "uuid": "ab9b9d0c-7e43-451e-91e3-9091fe5528fd", "value": "T1B945BF3D5C8127D2F0F215B18BC38E7DE6E79D19A3C841F9D2D462A717D84B28822D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552783, "uuid": "a0d8c3da-b70c-49a5-bfe6-feaa1eddef81", "value": "12288:F38OXPzIkfMPuVE0QwBeJ8hfdlS9wMWGRWaGV+sUPj5qA8UVe4vhRNFF9TCUn:d8a0kfMu5QJ8hfdaq+x6UEAhRNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552783, "uuid": "3fa5569a-98a3-4b2f-972c-d9854c61b522", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552783, "uuid": "23fac06d-cbe7-42fb-bbf9-c2db340278fc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552783, "uuid": "5fcb1ffa-1575-49ca-b031-e23cece28c94", "value": "Purchase Order _ HONOUR ELECTRONIC CO. LIMITED.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d94c51-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565906, "uuid": "14ce3a8b-dce0-41a9-93bf-e82427cbe09a", "comment": "Malware payload (Mirai)", "value": "6806ab3e23c595db94ccaa1c239da207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565906, "uuid": "b95361ec-7fd2-4890-9575-c96390c6299d", "comment": "Malware payload (Mirai)", "value": "2d204e0a17b9333d2b5d60a01cc57e0398cfa08d3ac5544b76962f8e8b524980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565906, "uuid": "d5dc8b14-95cc-4ed6-b54d-d2e263536eac", "comment": "Malware payload (Mirai)", "value": "06fad3d49ffdba791a0913b292dab4e51e9247db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565906, "uuid": "52126907-3d0f-4b26-9df6-5c2aa99406d4", "comment": "Malware payload (Mirai)", "value": "d31d213bd47c8bc2c4e7a823162a9b36e8c48c69e51419a0da8bc26bef0b5137b494749d844198fedf448def90f36882", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565906, "uuid": "ea0d1dcf-7c92-46df-b6a6-9068c67fac87", "value": "T1DD24B80598A0576FCBE3A7FAF755B1CE723247981F833309D71C4AB013C16EA9929297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565906, "uuid": "11f3ab67-5161-4efd-a646-6f7f8ae44711", "value": "3072:mRosx4mz0wygRKvi1av0Y6JlJgvIfus+qwqEi5gfRFsFnkNvcFoV/KAv4hkFLnn0:mRoTSMQCa5StCDcSIpPMmyW49QjSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565906, "uuid": "a9e02da1-3005-455c-b048-c70bda246bf2", "value": 210645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565906, "uuid": "be011798-f76e-44e9-8312-64c4ab32c9c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565906, "uuid": "93405e87-99bc-4897-8945-dd55ef5da218", "value": "6806ab3e23c595db94ccaa1c239da207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bf3be7-eda1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683551318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551318, "uuid": "2d5396b1-f071-4b30-9b60-d8d5304cfdb3", "comment": "Malware payload (RedLineStealer)", "value": "40e90387647e4c47f2b492006d0babcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551318, "uuid": "da5273a0-c633-4eed-abb7-15ca217b8fbf", "comment": "Malware payload (RedLineStealer)", "value": "2d22008c64c85e23e6436e2ca951ccc52305835949c90f8b952446969bd6e75c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551318, "uuid": "de3cbe97-6c1f-44a4-b72b-525b4f8b5ce0", "comment": "Malware payload (RedLineStealer)", "value": "d09cb9e5042c0766b0d65a4e69f4442c5966bda0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551318, "uuid": "8a631ae3-02f5-40c6-ae74-229821d38734", "comment": "Malware payload (RedLineStealer)", "value": "6bb55e5065b38c787b394e490f44eef910f2ec4ebc5dd6a7e6b7b0dffdc9f819c3188bdf51a2d056ba7e8725effe8928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551318, "uuid": "0061a820-a533-4e5b-8944-839b97491d86", "value": "T19DA41202B7D84033C8F517B05CFB43D31B79BCA55D38937A2785A95E1CB2A84A97932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551318, "uuid": "69dec096-66dc-44d8-a56d-8c159a617535", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551318, "uuid": "e70a28e2-9030-47d1-9c5a-375316eae11a", "value": "12288:wMrUy90I6LuoC8Ljv8s9nBbbuuqjLjjfYV4mExu2b1Br:0yb8bjv8atDqjLvfYV4zxu2b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551318, "uuid": "f6738df7-8760-4dcc-b1b2-d493d194c5eb", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551318, "uuid": "0fbc9fd7-d617-4c95-a2e1-0d77806b53a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551318, "uuid": "8673210a-2500-4c35-b4af-895f248db63d", "value": "40e90387647e4c47f2b492006d0babcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d370ad0e-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683578109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578109, "uuid": "a3fd2003-9250-4714-8fbe-b058f018a6bd", "comment": "Malware payload", "value": "fe77680fd51ac3e43ff2c5a99d6b572e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578109, "uuid": "d747d682-ef52-4560-bd8e-f434cb72634b", "comment": "Malware payload", "value": "2d65ab89e2f72fe03eae822528c575b88ef45c2eac901573cb69ffeb0023991e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578109, "uuid": "8e47afa2-94d9-4fd1-9fdf-8bc17db7c80e", "comment": "Malware payload", "value": "7d2f03e2996aa4ad672dd5c6491f9b89014526f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578109, "uuid": "7bb2cf36-fd14-4bf0-a9a2-a45087fd2c04", "comment": "Malware payload", "value": "89b3167e7adb1cc00bd54e8fc5772a8bd7a1b4e515c40c1a1fbea09b47eacdeffb1630711cf0ff404880c3dec900aa3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578109, "uuid": "fa194931-38a1-45b4-b3c1-b21280ea8ff0", "value": "T14616B0B262C3FEEE276F0DC8D00433459D58792B9728519CFA88127363E6924ED2ED75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578109, "uuid": "764bb3e3-b594-4438-8865-9a07932945de", "value": "24576:PgTgDlH4cY47Yg+Bz1zwu5ocsYcEG+gKeEIRFL6ieKwNlrqpdYxKfxDeKpmmrzNO:AOfhssm2BOwyoh6Pfhh2iLP0oKWpEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578109, "uuid": "cba93811-fcfc-484c-bd47-757899056822", "value": 4172460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578109, "uuid": "172565bf-fc41-440d-85e1-1bbc1bb82fee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578109, "uuid": "a2f41de1-c5a0-4c6b-acce-a3486f97627b", "value": "new_rump_native.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea66b36-ede4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683580222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580222, "uuid": "ba5fe3bc-c2e5-40b8-8d9c-7cf59e1983b3", "comment": "Malware payload (njrat)", "value": "0b896479ef3f0a0462f48320a3ef16c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580222, "uuid": "199ebb0a-2446-4073-abf0-e88136f1428b", "comment": "Malware payload (njrat)", "value": "2d8c76c2bbd7c5a00595ff4e870d1b4009006bb7befd48258d9c8859e440cc28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580222, "uuid": "6d5a707c-b2cb-47b2-8bda-87a28cec2df4", "comment": "Malware payload (njrat)", "value": "2f5dc4481c5252643f8528e6f20950e8edcfbc5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580222, "uuid": "d4cd6411-de1d-4f01-9511-ca397e52577d", "comment": "Malware payload (njrat)", "value": "d94cff7db24b79077a27ec7db9e2f01d48ca6afbaebe8a11041cec470f2e6153b5e6667979a2ef51aa3bccdeab44219b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580222, "uuid": "9c0fadb9-f119-4688-9f94-25425e91c2bc", "value": "T15CC2D101D18C67F6DC6A1F7247B302C1B178C26A2EDB4E21A8940E6D5855DDD49737E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580222, "uuid": "fc24973f-5fcd-4382-9233-3ac9905bce7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580222, "uuid": "6366d9c4-4b86-454d-aab7-ca428d02142f", "value": "384:sv3ZIKmJWLbkgo90gryXYEQk+ghFNWOek56RZKNASpvKe0:svp8JWMgMzqYEtMY0QFce0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683580222, "uuid": "a171071a-19f0-49c7-8de7-924f2943af1e", "value": 25956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683580222, "uuid": "73885582-2b6c-407c-9876-91da6002f57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580222, "uuid": "704ed41a-fc3b-4645-b236-7189faed0471", "value": "0b896479ef3f0a0462f48320a3ef16c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8e1a55-ed43-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683511093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511093, "uuid": "533b945b-a54e-4b79-bd99-7b03f31b0c49", "comment": "Malware payload", "value": "0efad3b94fa6bb52c515f7979966f841", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511093, "uuid": "09db3041-31db-45f5-a0b3-f91813214f90", "comment": "Malware payload", "value": "2e450c0f1e8389bcfdf9e71f21b7ccbdca0dce47f84093aaee1ddaa039f6a6da", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511093, "uuid": "d51f3004-5bd4-435e-a262-46dbeb4ecd57", "comment": "Malware payload", "value": "aba13e3599a37855294dec72e788a39bb9f2709f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511093, "uuid": "e5f53547-2055-40e7-ae80-710c75653d56", "comment": "Malware payload", "value": "5186bab04c768ab7d49f76f2fe6ae70a43b0e1f84cba67cee33d32a83dc6eac2cd73aafd7b8a8c661f6fc31ae254abd1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511093, "uuid": "8e1f17a1-c258-464f-8d7f-7d80d68913b2", "value": "T139A2A4665B8C4C61F369E8BB824DE00E09BCF23631C215D4BD9DE2747B7D54E0B6A1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511093, "uuid": "0340593f-9364-42bb-843e-fb828f17aab3", "value": "384:/sQHxnD95M5kMxuADAkrUVyiqvEbN8NqdhWEIezwCY5ZBUsclLAJ0pf3Gf:UwxnD92kMxuQAk+yiqvJRncwj5HUs2Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683511093, "uuid": "bdc05440-d817-4a15-b1ff-cfe117efbb5b", "value": 23195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683511093, "uuid": "eab0d4ba-2226-4164-8c54-8459d95d87c0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511093, "uuid": "358449a0-8a70-43e6-9393-bb2c2e2a9cb2", "value": "0efad3b94fa6bb52c515f7979966f841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9fb636-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585691, "uuid": "17787338-feb1-4605-a792-670a7d905b28", "comment": "Malware payload (Mirai)", "value": "7dd3f06da15d8346db5ca734572694b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585691, "uuid": "9cdce806-9c70-4155-bc87-f491350c3eb9", "comment": "Malware payload (Mirai)", "value": "2e7656a610c6f4572541dc2a39056d1a457918626a2d8507bcdc0b38c4bc1a9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585691, "uuid": "4aedc1ec-60d3-4a4e-82dc-11c422a22394", "comment": "Malware payload (Mirai)", "value": "d043f18b6fa26bb31d63bb681e2b9709909488ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585691, "uuid": "0b53add6-4057-48a2-886b-15c1a32e92d3", "comment": "Malware payload (Mirai)", "value": "39cdbf624cc3a7c1dc6ebfe85a46b91ea36a1a710912bf344af3faaf5b358af674a77e79fc6ea37981cd904ff8dd2864", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585691, "uuid": "307f1e5e-1fe6-4019-8f0f-ed1c80217c9f", "value": "T109735D24A9792E26C0D4A17B62FB8361F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585691, "uuid": "e653fd9a-e0a4-415d-b0d7-371fd16836fd", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8p:YwfdNu4cmZvFqI3w7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585691, "uuid": "aa70a917-e1ec-4ece-ba6d-c38f5f09609b", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585691, "uuid": "589a6ec6-0617-4bca-af00-68bb2cae4333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585691, "uuid": "a36257fc-cb96-42ba-b84f-3e3024d51acb", "value": "7dd3f06da15d8346db5ca734572694b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a36f9a-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571597, "uuid": "347a21bf-0ed9-44b8-a240-6c0c8931576c", "comment": "Malware payload (Gafgyt)", "value": "b3cd4183db4309c288dd502df476aa88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571597, "uuid": "553e228e-521d-4c75-9d97-2f35f9fcce62", "comment": "Malware payload (Gafgyt)", "value": "2f845886e5f42f7ee6b21adf699e1b7e6b0f679ee8c9141cee4c94a52f8005bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571597, "uuid": "f02d873f-964c-44bd-91af-39924c63ac64", "comment": "Malware payload (Gafgyt)", "value": "b0d430400ebe928596a0460b75332aa78151da19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571597, "uuid": "2f4699b4-f531-4f30-a691-c40f87dc8b93", "comment": "Malware payload (Gafgyt)", "value": "37136b9d05ac420f767cf7de56e1a6f115df3104684278182f01cd6f271689bd3cd2f6da0a0e0a731827202a1c5be0b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571597, "uuid": "ea4097e6-17a0-485f-8b48-311f839c3e5d", "value": "T171E33905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571597, "uuid": "1e8c1609-5238-4fe9-972e-9e01342b3259", "value": "3072:Bt8iFDKEfFN+Fa+1sW3h7a8oXV7pUMbmQwfCMQiGW:z8iFDLf/+FaNSh7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571597, "uuid": "076cdce5-c35b-48b1-a89e-78e57529b359", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571597, "uuid": "e4d926ef-04b1-4a53-b5e7-12cf0c24b90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571597, "uuid": "a244e10b-1c62-4096-bbb5-baad6a3a0062", "value": "b3cd4183db4309c288dd502df476aa88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f3a5d8-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530258, "uuid": "326fce5c-5153-4acc-b2d6-8cce34c1473a", "comment": "Malware payload (Mirai)", "value": "0da940e36a11bdbd2ab30067408c0796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530258, "uuid": "7a08e7e8-fab3-468e-9a70-1c1e702d9d00", "comment": "Malware payload (Mirai)", "value": "300fe97673668d2051ade53fb08ce730518f06fc50391d53b2ca4e9f5297075d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530258, "uuid": "294f3981-75bd-499b-bf1d-0959b0868ae0", "comment": "Malware payload (Mirai)", "value": "a7021fcec7df6759f27c6539a953de701f2717a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530258, "uuid": "b80a64e7-a7d8-4084-bcbe-03f9e943986c", "comment": "Malware payload (Mirai)", "value": "7b79eaca8e2245ea10ad53d92e56004f45860e0f03b6d8d6c538d638a13e35ba4a4ba7ba37448fbf3336d2e806e8513c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530258, "uuid": "102401da-9693-421e-8514-7aa67cfaf730", "value": "T109933C89F9809700C8D455BFF94E518E334743BCE3FAB1D19A26BBB1578B88B097B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530258, "uuid": "1fe9ad15-694f-456e-9ac0-3600e63e7626", "value": "1536:FQUnAv1eMsSju0yTwHUbgQn695wqPtZTsNMiMMaa31QllEuOija+X9bVx:FG1eaj8T7nq5BnYNMiMMaajuza4Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530258, "uuid": "c91a8979-98d7-4b8b-bf06-0ccfbfc62638", "value": 94320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530258, "uuid": "e7a4cdc3-1a42-4a26-b4f7-01db75feb08b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530258, "uuid": "71b02206-b689-40c2-b2f0-fe0e1893f5be", "value": "Andoryu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fc1f0d-ede6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683580823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580823, "uuid": "0e4cf0f1-53ec-4931-be8a-a010425b81b5", "comment": "Malware payload (RedLineStealer)", "value": "02797f7558acb033fe4752db0cebe906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580823, "uuid": "fad89f60-9307-4c50-83d6-0617d1087669", "comment": "Malware payload (RedLineStealer)", "value": "31c679761cde0dde6ca8218c6a3c372897800a3cbe5d4e6917b57c429c8010d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580823, "uuid": "a9715201-33a4-431e-8a8f-1018be14f74b", "comment": "Malware payload (RedLineStealer)", "value": "a93385918326d8555172a14908980280bab3d2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580823, "uuid": "4adddff2-cc61-4912-b4f4-2759b94eb354", "comment": "Malware payload (RedLineStealer)", "value": "7c5448c585339d17b90a5d09e8574b498447b32082c6c05f15cdedb60f5de44151d528ccf939a460da0d1d32bfdb684e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580823, "uuid": "223af354-c977-43e1-bcc6-5f3ef3c072b2", "value": "T11E546C1277D1BC70E5120A318E3AC7F46B2EFC608F5566DB1758AA2F09B42E1F5B2712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580823, "uuid": "894e058b-3653-437e-bbb2-b03a32bd4399", "value": "5d1142e6b5dd917186b13ffa418932e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580823, "uuid": "9faafd55-9797-4c5c-97cc-93076eee5669", "value": "6144:FxbgNWD2l8sSdqSBESnNQePgwxK/k/49iAYuC2K:vkNWD2q3BBEqa2LU/tDC2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683580823, "uuid": "b5b91f0a-5ae5-4630-9d82-40c405968002", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683580823, "uuid": "04ad6b30-9b04-497e-9a68-d1f86a337e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580823, "uuid": "6f85a48b-e1f6-4ea8-a4d8-6699d93188f8", "value": "02797f7558acb033fe4752db0cebe906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e509b13-eda5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683552868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552868, "uuid": "5b58a924-677b-4e4f-a195-9e84355e0ef0", "comment": "Malware payload (AsyncRAT)", "value": "9ac9e3944cd2d56862b5d3012aad96e9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552868, "uuid": "53a0e4df-3fea-4bc3-b70e-f17f655541a1", "comment": "Malware payload (AsyncRAT)", "value": "32a084421d796d7059cb71d81ee59779b55bf556e82ab8d5cb5389fea36d1f33", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552868, "uuid": "3165358f-5c7e-4f7d-a154-de63d77518fb", "comment": "Malware payload (AsyncRAT)", "value": "fa98a7b5b9d83adaa570b68ee8013ff356bdc235", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552868, "uuid": "5015a90c-9da8-4de6-aca5-7ee6a1fe2aaf", "comment": "Malware payload (AsyncRAT)", "value": "8071566492e34698b7492900720830f5ece037a777a1574bc0cd44a9a4578ab45ec3bd7a95dcddca501de2cbd29f9371", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552868, "uuid": "acc59adb-fee7-4b7a-9004-09883e4bc1ac", "value": "T1F904DCE65E2CDA5B3D9DCB5AD1416F83F614809F60650D6ABB8BA50DD0FCB02F34E608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552868, "uuid": "970f843d-e590-4dcb-88e1-c9ea69b85a0c", "value": "3072:xTPTwLhFrOBsc4VsTKkcU/DNv9O9d11HftCsmN:VwLKpKkcUbNv9OZ1/tCsmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552868, "uuid": "38dfca4c-53a4-4db1-9730-7757603af86f", "value": 182619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552868, "uuid": "5d59a571-ee97-41b8-b0ed-8090b6d214fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552868, "uuid": "847041e5-9de1-4ddb-a06e-b113ce6970a7", "value": "32a084421d796d7059cb71d81ee59779b55bf556e82ab8d5cb5389fea36d1f33 .ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7f33ec-ed6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683529756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529756, "uuid": "0ce63832-f14a-4789-a9bf-b7e661d5b103", "comment": "Malware payload", "value": "fae403ddba0f8ddc589aa4ce16409571", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529756, "uuid": "8e785e30-9491-4bcd-b6ec-0bc2265d21cb", "comment": "Malware payload", "value": "32b4474225af93ed2d1cfd31e0af6939d3135eb6426a7cf8d7303b1d2d52b1a5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529756, "uuid": "649b3172-346c-4f8c-aeca-e5d71528f8d6", "comment": "Malware payload", "value": "7aa2b052edbf3f25076cba2277ab364f989998ce", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529756, "uuid": "747abeeb-944c-49dc-ad60-bbf0a218a9ef", "comment": "Malware payload", "value": "b6d729fc6073eb5c86584c2033ee45d19f76842103722adc9f1cae0bfb014af3da4a496caa0471bd1ce6c3a8e0dae40e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529756, "uuid": "02e1b04c-fc12-4d09-9329-779ea04aadd0", "value": "T18D85336E2EA917D9CC003AF39A44973CCD9CA4242A354C2F2EB7D6F74DD5729C8A8D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529756, "uuid": "ecae8473-d294-42a6-8276-8aa2a0432c3f", "value": "49152:Lm9XffSqoStmegkvzrSYsqNdtcmSHlKAR:Lm9vf3l/PSYsqnWoAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529756, "uuid": "7cc07481-70d9-49e5-bfef-aa8ba6de9e57", "value": 1851971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529756, "uuid": "6bb233f6-5342-4292-8291-bcc2b96cd489", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529756, "uuid": "733f4116-0137-4869-938c-0e4b0dfc19fa", "value": "Factura-MP81L.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecac596c-edef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683585024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585024, "uuid": "bff90e65-e6bf-418c-a2f6-fec492a9b6e7", "comment": "Malware payload (RedLineStealer)", "value": "eafe753a6fd3d7e298974135a34d565c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585024, "uuid": "ba767041-02a0-4edc-82cc-0880d2d32bbd", "comment": "Malware payload (RedLineStealer)", "value": "355187cd71c38b58210b22e41e9d3df14dbfca37503289038b1c0a71c08491c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585024, "uuid": "65754949-c9fb-4b6e-be3a-20c3cdee4e01", "comment": "Malware payload (RedLineStealer)", "value": "730746fc357826b16bd05d3b7d387d9e70b8f3e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585024, "uuid": "65706aec-77d6-47b0-877c-e88fb916f6f8", "comment": "Malware payload (RedLineStealer)", "value": "1c5ead453c7c227bbdae81a70c446810a06d01211cb601975b1989d0c50560d9137be545a3327696bd7fd656fad0710e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585024, "uuid": "125d4510-c278-4a12-9cb7-6401ca7aeb23", "value": "T1E525E73C18FC3622C2B5EAF2DB94E561FBC0859276358DDE1AD6448616EF90236CBC1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585024, "uuid": "7b08876d-f379-4cfa-b437-b95fc16f52c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585024, "uuid": "378d8fcb-6df9-404e-b323-960f665a52ca", "value": "12288:AfrDf9O0ktG6Iq8mZrAHOtEpx/CvwDN+JouZDIuVP50nziW9g9:GPf9FktZ1Zg5p9CvyNqo8BQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585024, "uuid": "9d0c8a38-65b5-4091-94e9-a8bb1afb4fb6", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585024, "uuid": "880fab1a-698c-441a-b901-53c47039cb6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585024, "uuid": "063f8d11-5893-47c1-80d4-7a0e8511fd69", "value": "355187cd71c38b58210b22e41e9d3df14dbfca3750328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31415f23-edc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566241, "uuid": "a2ef3500-61ec-4235-a446-bd1ba1111d06", "comment": "Malware payload (Mirai)", "value": "d4faee58b932293ab2f6947171e0ae6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566241, "uuid": "4f829e91-4e5c-4435-a9b3-998d62452c0f", "comment": "Malware payload (Mirai)", "value": "359b1981b8435121bdc929d449385f50fa844823efe5bc49a24eeb8446f63257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566241, "uuid": "5a6b43f6-de3b-46d9-b1a6-6c368ee7021d", "comment": "Malware payload (Mirai)", "value": "70c7c8541b7fde29bad189fb00d61d03029a5097", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566241, "uuid": "38213f9f-e9d3-46b6-863c-b3209e72dcfa", "comment": "Malware payload (Mirai)", "value": "ccbb0b1fc33af1efa15722a9a9fb25ac25c1ddee8efb4f100f69d17baf59fc1094a8ab86e425fa84973f28ad7df56aa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566241, "uuid": "aace240a-ebb4-48ed-8186-16cdaaecf953", "value": "T15C634A25B97A2F17C0E1A47A20FB5B54B2E156CE26E4C61E7D720E8EFF106006503DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566241, "uuid": "548f7ee7-37eb-4bfe-aabc-8534d9f710d1", "value": "1536:XqQAJ/WxtRX+gRrnbo7tno1drgbGcT8ZoQOK5G6VN:aNfgdrOBQZiKEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566241, "uuid": "71e469d5-f78c-4a63-9a16-c4fbb8d8c1c5", "value": 67240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566241, "uuid": "243dbdbb-825d-496a-8865-27ad9241cc11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566241, "uuid": "ef346efd-8a51-4e19-95db-2b991cf5d481", "value": "d4faee58b932293ab2f6947171e0ae6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ebfa91-ed43-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683510849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683510849, "uuid": "dbe08f45-6438-43e0-8107-193e6b9c4554", "comment": "Malware payload (GuLoader)", "value": "60fe8551507506183ef3fdeb094fad2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683510849, "uuid": "3f259327-063a-4811-8e98-f336bc281a65", "comment": "Malware payload (GuLoader)", "value": "35e6f90c54c30951b3b43337a43001b4e96aaa3a7eb4892b1cf54360a63942a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683510849, "uuid": "6b3eeb6a-074c-451c-8701-e5e0660adcab", "comment": "Malware payload (GuLoader)", "value": "0299334668f706c101773807958e5429cf9435d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683510849, "uuid": "304c8463-03fa-4b5d-941b-3fc53aec50b7", "comment": "Malware payload (GuLoader)", "value": "4a42ecb24704526ae3fa2e8410d47b7a68e3d3a051b21b5e5a88f3cb84a06d2a10f8bd09fa62df6e3387aae0590dcd40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683510849, "uuid": "f2cf1291-ba26-42a8-9739-1aa70c857896", "value": "T183B401313615C853DA297A7F2453D67B6BE4AD20385C25077BACBF6EF8B21C16C09A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683510849, "uuid": "3c222a46-44c4-424c-b9ce-a3433bc923c1", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683510849, "uuid": "61502ce2-9b44-44d7-a9f9-b6344a179bc3", "value": "12288:2cWH45I1pACPdhJ9UBciMBNCYQtqQR2kvE/lW:21Y5IkMUBNMBNCY4R2kUlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683510849, "uuid": "18cefd9f-4541-4331-98ee-460c48727df5", "value": 509096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683510849, "uuid": "088a78c3-b829-4df5-a0a6-4e3b27398495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683510849, "uuid": "1a5e4cb3-ffe0-41e7-b305-c103cc90fe83", "value": "rRFQ-FGIP1-MR-MS-010-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd0654a-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683588814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588814, "uuid": "cb5c9522-1bb7-4eea-a52e-b2b38944fb5e", "comment": "Malware payload (Mirai)", "value": "d74b2c019d8c54cd980079992628fc41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588814, "uuid": "c027d4c2-1c16-4785-9cfe-8937b7bf7323", "comment": "Malware payload (Mirai)", "value": "3692115fd0f87d2680c9376f2d7e4873610a50736ba243ddf168a5cdf183c22a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588814, "uuid": "5243f8d7-a147-4e4d-ac8f-08f07e46b8f8", "comment": "Malware payload (Mirai)", "value": "c04e24df2acd13145fffde10a6cb156381236cf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588814, "uuid": "e01172bd-75c1-4612-8583-3c5192cb0c9c", "comment": "Malware payload (Mirai)", "value": "11059344803df794f58f230d6b0a2db83ed5e8e795b6c98dcab5a6ccb702734bb202011724de8915d396da884a0fd295", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588814, "uuid": "39f56045-863e-4fe0-bbaf-005e7daf064f", "value": "T1CE441881A9818E26C5D817BBF9BF018E3321A7A9D3CBB1178C145B7437C7A5F0D63A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588814, "uuid": "389e93fa-4501-4ae6-9b0d-21888ecb7f86", "value": "6144:pMtDF16WglC1RbRcZQaC9mrsplDKZUfQBKXAVantX+F8Jyvp1G6xxn4J+fBhr2ld:pMtDF16WgQUo9mrsplDKZ2QBKXAVant7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588814, "uuid": "c58e101d-5816-4a84-a28f-4cfec9e31bf8", "value": 269924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588814, "uuid": "c42a9bce-4930-4b1b-ba0d-370b5d99fef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588814, "uuid": "bd2ca0d0-a24a-4169-8f88-7fcf04d3b66d", "value": "d74b2c019d8c54cd980079992628fc41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ecb6de-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683550604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550604, "uuid": "cd0a5538-c1c3-4e35-a743-04bdd587fe43", "comment": "Malware payload (Formbook)", "value": "78747cd74d32201095bfe1e6d6914d47", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550604, "uuid": "ec144bed-73fe-4e77-aa91-2378cb54ebc6", "comment": "Malware payload (Formbook)", "value": "370d84c40c7b03fbf799cfb90ed498dc479945deaa2b1fbcf1320da59a234e80", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550604, "uuid": "0f4b6952-f33c-4b2c-b11f-c39455f9a52b", "comment": "Malware payload (Formbook)", "value": "2067b7fa9e66052f3c4e14b314736124f5bfce12", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550604, "uuid": "1c13dbe3-6ca5-4e9b-857c-a9eeeb4873d8", "comment": "Malware payload (Formbook)", "value": "6784139e93a860ac5feec16d5d1716c97656825ac7fad09bec41d935bc0bdc6b9c1c4260b2a2051e5ad5ffb519437721", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550604, "uuid": "4c06eff2-621b-4b7a-89c0-ee0378d1001c", "value": "T17F45D01AF588CE4DE581CBB56A63B488421CBD6377CD24821284730EADF39E5A6D3DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550604, "uuid": "c8832427-8ed4-4434-8052-6b4baeec5e29", "value": "24576:dLKpWQmmav30xSPWQmmav30xmG+MXUv+MXU5WW+aGsWnyXbs6VEe:dLK4QmmQ30vQmmQ30R+MX8+MXqWjswyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550604, "uuid": "21f8709b-7f39-422c-895e-20b473e43771", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550604, "uuid": "1cc53a2d-2223-4e2c-903f-cb544ab9dcee", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550604, "uuid": "af70953c-eca5-47c2-aa9a-1bd510b137c0", "value": "Purchase Order - 2023-04-17T120308.893.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69376377-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683552591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552591, "uuid": "9bff4065-a295-4a5f-a21c-75154e551250", "comment": "Malware payload (BluStealer)", "value": "235c2d00b691656b63a715eac1e7511b", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552591, "uuid": "aa4142bf-1343-4aff-81cd-fe06e49f1f3b", "comment": "Malware payload (BluStealer)", "value": "374bd46f94cdf56eb2775ec23f0b70e8179541f348de2959a4a885b8f22af99c", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552591, "uuid": "6ecbbd50-35aa-4d70-8e77-805551a073e0", "comment": "Malware payload (BluStealer)", "value": "511e1e3646ad2ca0012709c56544ca9497b969e0", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552591, "uuid": "9cffe066-d4d1-4923-b1eb-c97bf35be438", "comment": "Malware payload (BluStealer)", "value": "2b2306c53d5542c937bb83f6caa5b1787becbdc24994af7ea743348b33e89cc00a2701d5821ac90d355f893fa9a58727", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552591, "uuid": "792c891c-0c8e-4d94-86b8-12e26c0be8f9", "value": "T15265232572F2CAD7E85944F44A3CB05816767197E4D1EAE83FB3440D9FEAF406E80A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552591, "uuid": "11cb529c-dc8a-46ce-9559-80445babcc42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552591, "uuid": "5ef8e877-15f2-4b2b-89c3-af241a92d760", "value": "24576:AR8UY0b6vrCWFHojNYhS8vE1BiCJQwcGJVdOeyYZ3pnFchs1D3x3PWh:28emvrCmIjNYJv+BxHcGJy+3pnFcWpNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552591, "uuid": "ac30afe2-ce77-4a88-93fb-fbb5f689290d", "value": 1428480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552591, "uuid": "27698e88-8f90-4994-9b9e-1b5c0e870800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552591, "uuid": "fabf213a-053b-48a7-932d-7f6f32f93584", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ad7b2f-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683534789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534789, "uuid": "120ecfbe-b72e-4f9f-bdf3-500a9745979f", "comment": "Malware payload (Smoke Loader)", "value": "d15699881276cfe1bd940f6137fb1ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534789, "uuid": "d93fa8c5-e1e7-4690-844c-2078ca697b6c", "comment": "Malware payload (Smoke Loader)", "value": "374e1a295df446b79b3d27fb45688ff7879f0b0798745e963cb94397a4ae9105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534789, "uuid": "3041b0a9-c401-4083-bd4c-91d96ee10258", "comment": "Malware payload (Smoke Loader)", "value": "35ca8bdea2d29679bf03ae5067b8ad5834eec604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534789, "uuid": "88a5f4da-34f5-47f0-ae22-757cde56fbca", "comment": "Malware payload (Smoke Loader)", "value": "4245062f44b9621b9fdb215ae054f32825ba742928c07dd2e2cd7923284a7b59fcfa717f79b1d8f4437e864946bdf384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534789, "uuid": "82379f2b-e867-4b09-bb05-12081fe3fbba", "value": "T1D5641A4383E1FCC5EA264B728E2FC6E8769EF2508F49776912189A5F44F10B2C277791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534789, "uuid": "5a02d8ef-f197-46b9-bee4-4f41bce36522", "value": "774eae4c41c92ea810347ae7a14e6cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534789, "uuid": "446c891b-8cab-4102-ae04-d7851771e658", "value": "3072:dAXnjWMxxiOLKWHYpwLLqo4E1Qyg995bUHPJtZg/5wsPdPh8XqT:GjWKLLjHk0p4E1oDIHfIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534789, "uuid": "8ec050ff-15f5-4ec5-973d-4984f7177d8e", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534789, "uuid": "ffd417ce-c234-4a1c-b5e3-19796a26231f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534789, "uuid": "4c1913bc-1741-44e0-ab06-98b2960fc387", "value": "d15699881276cfe1bd940f6137fb1ac0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f4b1c5-ed59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683520486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520486, "uuid": "20177700-0ce3-4ecc-b051-ec01417677ed", "comment": "Malware payload (RedLineStealer)", "value": "f03c5a8db0692c724cc4f3568d25e062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520486, "uuid": "dd6119ac-375c-4e8d-8014-036b73fa86fb", "comment": "Malware payload (RedLineStealer)", "value": "37b8387d3e126e057247e99ae3d0e0fcce3c0013ac1d1442cc1dae21eb3d15ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520486, "uuid": "8bcb2439-9efa-45ab-a228-d0c355d0043e", "comment": "Malware payload (RedLineStealer)", "value": "23f5017f7aee63427f6ef2cb8552e17d3047ad0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520486, "uuid": "172f8332-b32f-4367-9ff4-9b2784262ce2", "comment": "Malware payload (RedLineStealer)", "value": "b4a674b983401dc8e893a0b02abb525f69c88878d9a9dd814deb07281216a38a80ccb15eeb4b45a6d03206b76d0d069a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520486, "uuid": "4b805e12-309c-46bc-ad63-06aade75db3a", "value": "T1F6946C1382E1FDC4EA264B729F2FC6E8769EF2508F49776912289E1F44B01B2C277751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520486, "uuid": "289ffc85-9a21-44db-9c0f-919593e62a6a", "value": "09ad811c7b24c560499d47bd7c66a41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520486, "uuid": "b85d05e3-6ce7-42dd-9c65-5f28e9e08184", "value": "6144:5otNG6L4m446Lw6/m+RS67SplQIjPVYfvd9RYGSbHc3ZBh/R6oV53XcS:5o/l4fw63RS67ClNOflbYP8Lh3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683520486, "uuid": "2752335f-525b-45ef-883d-bfdb696ede62", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683520486, "uuid": "8c3ba59d-a65a-4069-8a29-885d4db28bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520486, "uuid": "0f277303-e2fb-41ee-b4d0-06d5a11f14bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b910b37-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683516463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516463, "uuid": "6d73cbb7-e5e6-49ba-b158-bc1d0349bb39", "comment": "Malware payload (GandCrab)", "value": "6db21f204251f3239be93431f9a3a804", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516463, "uuid": "533a4a09-8913-4cc0-8e9a-b0ca6ea9b658", "comment": "Malware payload (GandCrab)", "value": "39213ba291c04a7c2092a8a0654c6bdf39da7ba769bc3a233de8882f5d597b01", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516463, "uuid": "e835f298-64c4-4883-9e14-9b0dc465f6a8", "comment": "Malware payload (GandCrab)", "value": "52687e0790996e57c6d0068b0fa623cfedbe2015", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516463, "uuid": "94431bd7-6f69-44f6-a454-fb9bd67bf4ae", "comment": "Malware payload (GandCrab)", "value": "2c1f46384fc7e49ea604d64994efe498d28ed4c9e26164c6387b5210213c345a9b4056b3a88c8fead996675133c973ae", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516463, "uuid": "f36ee102-61aa-45c9-b930-40a9280c78b6", "value": "T10A64BF1471D1E0B0D4E24A7E98B9AF81057DFC1A17B33EEB26F9158A1D690E2953FE03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516463, "uuid": "c70b513d-15bf-4ee9-8a9f-fbce39a5fbb3", "value": "6144:lcytwbV1yTS+xqqDL6HKncgy0WtQwPBg+ZVM82B+EYR:CyiV1Rqn6qncoW6wP6+c8m+jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516463, "uuid": "02407f86-0be1-45b3-bf47-cbc633b5b9ca", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516463, "uuid": "affb241d-8fd8-4e3b-861a-c3accf2ddf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516463, "uuid": "3b0aac32-4410-4db7-a632-176d5fc4b8ec", "value": "2023-05-07_6db21f204251f3239be93431f9a3a804_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e64884-ed66-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1683525931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525931, "uuid": "b1ac31d1-960b-40de-9971-875cc4a009e8", "comment": "Malware payload (STRRAT)", "value": "9b3e70814414ece3b61fbf1bcda91bbd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525931, "uuid": "e538beed-e8ac-44d7-99a8-3f8bff65a0a4", "comment": "Malware payload (STRRAT)", "value": "39b2579e79869bede2ba65366cde7b71a5125a2e96604f29b4107a2ec1137c2c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525931, "uuid": "ffdd628e-e016-403e-968b-1e1054642ee9", "comment": "Malware payload (STRRAT)", "value": "c4fd63a731231ff098a46fd8f3b9b677f94e9b5f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525931, "uuid": "8be631d7-815f-43e3-9218-ab13c8dbf6b4", "comment": "Malware payload (STRRAT)", "value": "25099c30dbc5d9b6688066ca5a2805255d94059116b34bf291710ca79ccafdcf041ef18527d60429dc0d4e148332d974", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525931, "uuid": "edfbd942-c315-4c51-b9a8-a2b5b24d396f", "value": "T14324017F7DABC9B8D19B3439004882229A0806DDD532A67F35FD585A4CF5C6D2B0A2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525931, "uuid": "8545e00a-adc8-40e4-a3ab-08124ca68399", "value": "6144:osiNQ+9FfjAwGIuC5bOHsp3d5YtWL/EXSpertsM+b0:osiNV9NNGdWbOM9bYtmeeedU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683525931, "uuid": "4c99040e-17b5-4e19-939e-ea742075411b", "value": 224763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683525931, "uuid": "d4e982d8-24cb-4afb-b93e-5593a154ae03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525931, "uuid": "4d716e8b-1078-4689-9015-5220d8fa363a", "value": "QUOTE FOR55665 55228 ISS SINGAPORE.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a2edd6-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683535061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535061, "uuid": "817b9ced-5e01-4c42-814e-6766b58cfa30", "comment": "Malware payload", "value": "0e2a4765d5e77ea83afaaf74b4ebee61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535061, "uuid": "43134a9f-12d7-427d-8f59-c425792be09c", "comment": "Malware payload", "value": "3a2bf257d6c6ecb246abd6e50163f126ea4683ffaca7d20fbd861ddfa3dfe0a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535061, "uuid": "a5bdbfd3-42d7-4bf9-b7e7-53105dc0f890", "comment": "Malware payload", "value": "adf9dd03fad70cd2493889c97814b1e7090604f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535061, "uuid": "45cbe54b-292a-403c-a767-870b11d8d728", "comment": "Malware payload", "value": "90d0e51e0d60ab702cde6ba68f609060826cb175d012145d61c7d909e57ad3bc7e45fef06bfb060b02a8142c7d2d5e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535061, "uuid": "59ac2afe-9ed2-4cd8-8010-34a1349dbe7d", "value": "T1B6E522A434F87563FA0878700B2B5EF768F1B9B325084C17DB9E34AB426DF69F025166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535061, "uuid": "d5504cae-9467-41a4-a5b9-9fd9dc08feaf", "value": "4ecfbe6e42943fae92c4582752c63b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535061, "uuid": "6a59098d-b1ed-4ff3-8b00-e5c8bd22cf71", "value": "98304:kSJF1MQUm126K6cmRMiypcBIdZAqsZ4Ex:kg1MHRbzmmFndZAqsZ4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535061, "uuid": "26807754-b2ee-4d0c-a816-2ba94ab1bb30", "value": 3240960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535061, "uuid": "3153918f-a3c1-4917-a45e-dd035920220d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535061, "uuid": "6bfabe6c-ad21-448c-930d-916ea64845b7", "value": "0e2a4765d5e77ea83afaaf74b4ebee61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c3a37c-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683570379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570379, "uuid": "223769ea-beae-4b4b-ac80-1d3440e65262", "comment": "Malware payload (Rhadamanthys)", "value": "45d4fe22891d51f31bfa2f4c986802bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570379, "uuid": "19e8036a-68b0-4940-924b-b231f3793609", "comment": "Malware payload (Rhadamanthys)", "value": "3afa8aa568f26c6dcc9e6b32f376def4d0f54912ca431490e3b6558044fb2368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570379, "uuid": "8d7985d1-46df-40b7-a4dc-4ec545bd26d4", "comment": "Malware payload (Rhadamanthys)", "value": "13214cef92635200f74f68a35e91fcaa7d83fcdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570379, "uuid": "23155a05-91df-4801-8f4e-624e2512727d", "comment": "Malware payload (Rhadamanthys)", "value": "702b0280fef0b44a13b33059e5506e2fd332550e12d69b90725dc401a2579f63d6e0e636a3c6e1d61509723f33dc4378", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570379, "uuid": "407e7181-8159-483b-b3af-3debb7f7f3fa", "value": "T1DE947C1263E1ECE0F5264A72CE1ED7E8771FFD918E4537EB6218AA1F09B01A1C572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570379, "uuid": "02642f0c-d9ef-4289-b7a5-d358f52286a8", "value": "ec3b305847682dd9c2dbedc61abf8a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570379, "uuid": "3c0404b4-325f-4259-bef8-9aaa2bae5d58", "value": "6144:w+6NrfXS17AktlYEk+fySN4nan2o0wVr920GmowUO:x6NrfUtlvk+qSNQo1z20Gml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570379, "uuid": "02462c9c-bb10-4c3d-b344-d1e2628f4be3", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570379, "uuid": "8c2dfb99-dd67-4ae8-ab10-183797d6968c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570379, "uuid": "cd48cc38-dee9-4729-953a-d5017bfdfab5", "value": "45d4fe22891d51f31bfa2f4c986802bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21f2ca0-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534272, "uuid": "2d0bf229-5a4c-40a2-b764-a30748c96865", "comment": "Malware payload (SnakeKeylogger)", "value": "01f43dd83f8352c8fd0fad02863ffcd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534272, "uuid": "dc1bca9f-0df5-4a4a-97de-f0846d42ceb3", "comment": "Malware payload (SnakeKeylogger)", "value": "3b2ad36b753cef8bf7916c7a2e2261bbfea8e44bb2366d86a638e2057a493b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534272, "uuid": "60cc4895-813f-45bf-a14b-c80677c8991e", "comment": "Malware payload (SnakeKeylogger)", "value": "0d724ab36748b3a9308a3ed9628a4b68a35d6776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534272, "uuid": "20a6e196-e43a-47a4-815c-bbfff755d182", "comment": "Malware payload (SnakeKeylogger)", "value": "d59db5efc99a2045d628822bdc8f53d38ec8ca1218a0ccd271b6bcb3015510b679119b8e5bac24847470b35f56d5d816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534272, "uuid": "f92fe90f-f220-491a-9c57-30fc525dade2", "value": "T14FF4E02537A8B7A5FCF683F86618A0015FB42C6457B6E5E84DCAB0C81178F09F6607A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534272, "uuid": "9b9214f9-059e-4139-9156-ea2771ea397e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534272, "uuid": "0b8030f4-a581-4226-8428-38173037e4db", "value": "12288:sS11K88plclSFmBCnpmHua38ZefDge/fDXf0MW9P7j/mOwuJ:lPKNlmHHsZe7P/rXf0MW9zrmpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534272, "uuid": "54f21296-5fbf-425d-aa3b-ef40e2fade81", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534272, "uuid": "eeca60e7-58a8-4e8e-b296-1b641e41d4f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534272, "uuid": "eeed7817-0ddf-47fd-ae08-a2019142da06", "value": "PO No. NS2CALY.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d878e967-edc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683564803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564803, "uuid": "cc31cd12-2861-4f14-9444-37a6f34df419", "comment": "Malware payload (RemcosRAT)", "value": "1dabe739ebbb4626fbf3518569d5c2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564803, "uuid": "65ba7aca-2afc-44c9-96a4-2adee9b55323", "comment": "Malware payload (RemcosRAT)", "value": "3bebabea8a9d00a8add9979fe330b1e0494a4595677929f8c94f3d7e9e04997d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564803, "uuid": "5766e7a0-7290-4e07-8384-88db0a1d8b78", "comment": "Malware payload (RemcosRAT)", "value": "5e67a8a74df63ba0ea30c7a8c52a89bf864ba364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564803, "uuid": "7aebc7e6-f290-4f8c-a68f-fa3b65537ecb", "comment": "Malware payload (RemcosRAT)", "value": "ae420e2831afd0c8db870cf5fbf2f27c1abdd398abbfabcf619f4fa610f1ce4ab09b7ece99a7bfa1e84f1e49163de23c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564803, "uuid": "f43e43bc-9b8e-40fa-9bc7-e5804d32e6fe", "value": "T1F90523267D84914FE8EA6532776F462D21ACBF1132041CCBAB416BDA3D31AE1DD4E7B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564803, "uuid": "2456163e-342f-43fd-9fee-c06b04c95b2d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564803, "uuid": "bebd66bc-493e-46c3-914b-ba519c298b50", "value": "24576:ZYDgv5RjDjNN7zHIH9TS74tkXzcHptMYA:mMtDH+e4tYI3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683564803, "uuid": "28b91e90-aec6-496d-a00b-cb6691495822", "value": 870725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683564803, "uuid": "c499cdde-fe1c-47ff-ae6c-0a01201896ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564803, "uuid": "4020d784-b0bb-4d08-8979-483d1680c27b", "value": "ORD_09989796783792_AT_20237002_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda88e91-edc7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683567792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567792, "uuid": "7b80d4aa-5cc4-4261-bb37-da373684c2ff", "comment": "Malware payload (AgentTesla)", "value": "73e025395df7ff11174cbc83215995b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567792, "uuid": "cb08a90d-cea4-4b70-b941-fb9ed6e1e5f1", "comment": "Malware payload (AgentTesla)", "value": "3c4d4ae6875508403d1c24d4422c588a14cd0515d7c11a388e8ea6403d03540d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567792, "uuid": "2d88ff16-ef93-4229-8637-ecd301507b5b", "comment": "Malware payload (AgentTesla)", "value": "d77ed690c6feae3547dd78935985132032a3236d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567792, "uuid": "433bc7b3-493d-4188-8489-4702e45ec066", "comment": "Malware payload (AgentTesla)", "value": "05b9b14098b0bad37cd5a981775f7106c3f098f4fcdf384ec6bb730cf7451f91a822c89172d553ed87161d08fccd7478", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567792, "uuid": "79455f52-a8e5-4806-bcb5-4e79afe07b7c", "value": "T174D46C3D19B89366E378E7B74774C460B3F5A81F7222DD296CD710950A0FA41BAD322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567792, "uuid": "0b84a492-7173-46a0-8d18-73402e54eef6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567792, "uuid": "c6df2a1d-4432-4f5c-a86d-8248618bf0ee", "value": "12288:rGJ3FopepifeCmG4q5kChWJ4mm1Vy8L1RtJ4nGOtlKFS8PQUce:rYVQoJ3N8L1RtJuZtlKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683567792, "uuid": "0a4718e7-1c60-4603-adbd-dc73bfc73466", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683567792, "uuid": "393cb721-5fea-4050-a5c2-4cc60eaaab51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567792, "uuid": "cc803334-b31e-460b-8137-5e2171576378", "value": "Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285c4df6-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568803, "uuid": "b1faf749-f69c-4109-b6ab-42a0ecef619d", "comment": "Malware payload (Gafgyt)", "value": "06d9258994e203db214a438d09e3e18b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568803, "uuid": "87a5fc23-d679-48c5-afb8-0846f4dc4e96", "comment": "Malware payload (Gafgyt)", "value": "3c6d304487038dd1a72d4d89b50e3159dd4385f63c6c238fd8a8d09d931b8f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568803, "uuid": "901dc764-0eee-4f5c-bcaa-b1b4b497674e", "comment": "Malware payload (Gafgyt)", "value": "6edf327ffc39e3f458c172a84971eec4c259f496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568803, "uuid": "7fbac25f-a1fc-4b3f-86d5-3f5aaf2bd2e8", "comment": "Malware payload (Gafgyt)", "value": "9b672ae664ffc3550c02aa75183b52f91bf3094afc597e695aaaef1493d1acc7bcc717c28e29e4e9c1b23d8ccaa269b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568803, "uuid": "23e69427-32b2-477d-a59c-a449b2db413e", "value": "T153A35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568803, "uuid": "7266c4fd-4882-494a-bcc9-1c17d7101a8b", "value": "3072:EWCjQrLpnr85EdT9Oa8vqbVr7J/CEgmqAgcVyZIcBI:Ef5EdTbpr7JWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568803, "uuid": "a7cea8e5-2247-4938-bccb-ec029a7c66c1", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568803, "uuid": "937fbe9e-b66a-491e-a6d6-244278c01629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568803, "uuid": "cfb746fe-3bf8-4e07-aca3-105fc61991d4", "value": "06d9258994e203db214a438d09e3e18b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c1e2b7-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683552669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552669, "uuid": "02ae3c86-f91d-47d3-9fca-e09c9520f103", "comment": "Malware payload", "value": "5ed2a4e6e023283a2b8ea16612656771", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552669, "uuid": "0cb6578e-7b32-4395-85bd-49e140ccbfdb", "comment": "Malware payload", "value": "3e3ef2c4b7f4643431a881b7ab9f37e684053a54f3c9c75cd919560a9a4caca2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552669, "uuid": "0cf59e17-4912-4ba7-b379-988ae5005b9c", "comment": "Malware payload", "value": "0f16f0744cb158afb871b165c8bed9e94466b72c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552669, "uuid": "af749b91-68d6-41ad-9094-a7acca2a3260", "comment": "Malware payload", "value": "ace5f56fd5dd67698aaef03c1e6900e51dddb65f25e85016c4c56027a0854fab1010c650b092fa8cfac903f5dc06f52f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552669, "uuid": "465b7eb2-c6d2-449a-a53f-cb36aa25c422", "value": "T17A318B1B88EA7058065C87798D3FC898472B3F599978514E11B45C4E19C3B84BA33BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552669, "uuid": "8be1e606-6222-4348-86b9-76e1cb60d103", "value": "24:QWkxlwvNNngM713yqBOkyXlcy9eXKfhovbHVcJ3wh6C2+EXOsbHAbHLoxH2zPPjx:tkxlwFgM7135y1aafh01lh6T+6bQSH2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552669, "uuid": "a476a1bd-4e82-486b-81b7-b9aa8dcb78a3", "value": 1460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552669, "uuid": "035ae43f-6b10-48c4-b108-6c04c3377078", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552669, "uuid": "76cd934e-d572-42df-9f3a-39ea103654d2", "value": "Purchase Order 08052023_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427a62b6-edc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565411, "uuid": "48f606e6-ccea-4e1c-af9e-4d10a438da41", "comment": "Malware payload (Gafgyt)", "value": "252ae2222088f6f04a129cd1f0be6383", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565411, "uuid": "ab0e710b-1609-43ee-9fbd-764e404e0763", "comment": "Malware payload (Gafgyt)", "value": "3ed568821de0658d8a11a31fd1d75f55910009387c1ab1305a55529b2938544c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565411, "uuid": "293b7fa2-7e54-478b-9cd0-2a0069ddc331", "comment": "Malware payload (Gafgyt)", "value": "07986e125d0f72fcf00e7846d6178d0ac7975ff8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565411, "uuid": "4cf6b661-2040-4753-a566-07ed530dd224", "comment": "Malware payload (Gafgyt)", "value": "0d7284816d9690803e219d15dfe0455938f1f3e769f714a8d3626b940a0f22c0b697848b9f7fa17fdc4f6cedee694890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565411, "uuid": "39b24599-bf8a-4a0a-b9ba-0530d53d9474", "value": "T1F9B318436B1C0B83C49B99B02DA737F18769BE7112A351C9A90BFEC04773AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565411, "uuid": "c1552f3a-60b0-46c3-860d-ebd039768b3c", "value": "3072:eDzhqL0vbKlnvZ0pqu9KTqsFh7tm2pgYMidIP1W:eDzhqL0vbKdvWpqyKFFdtm2pgYMidIPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565411, "uuid": "a94b5fed-fecc-43a7-9b95-dcc57b2eb9cb", "value": 113186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565411, "uuid": "76f48462-b3e8-4266-978f-a00b356bce73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565411, "uuid": "0fbbb813-c825-48fb-a0e0-728a3574b730", "value": "252ae2222088f6f04a129cd1f0be6383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8bf346-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568780, "uuid": "506c15ca-b59b-46cb-94c1-e19f1d95af93", "comment": "Malware payload (Gafgyt)", "value": "801644904140cf2620091bef43db4197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568780, "uuid": "2fc825de-6d74-4a8a-b6d9-6abc083077de", "comment": "Malware payload (Gafgyt)", "value": "3f5e3db88b6e8fbe3ba89c5376674077a1cfe00a85cc61f8aaddbac0d4c29683", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568780, "uuid": "8ea837a0-3665-4654-aaeb-ab287f757f41", "comment": "Malware payload (Gafgyt)", "value": "71def504bd7282aff749893fb2985f69d4c900a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568780, "uuid": "858b7b53-0c1f-48a8-9211-6b188efeb21e", "comment": "Malware payload (Gafgyt)", "value": "0d8af3be9686564e7f1e90e99ebab9dabc1319abdfddac42d51f956c67908d7b635321088a9a1ecfb52e57f5f26f86f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568780, "uuid": "0202172b-ab92-4a37-9a91-b6e476081078", "value": "T1DAB318436B1C0B83C49B99B02DA737F18769BE7112A351C9A90BFEC04773AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568780, "uuid": "3c962f28-f495-4af4-b9b0-e6d47a127376", "value": "3072:eDzhqL0vbKlnvZ0pqu9STqsFh7tm2pgYMidIP1W:eDzhqL0vbKdvWpqySFFdtm2pgYMidIPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568780, "uuid": "de67044b-0103-4277-b789-4738cfc6875a", "value": 113186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568780, "uuid": "a08c26dc-7777-4b36-8812-7041b8aa8aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568780, "uuid": "df9939ab-f07f-4fdc-97e6-3784bdbb4578", "value": "801644904140cf2620091bef43db4197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087248b5-edb2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1683558442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558442, "uuid": "667a0768-d940-47a8-a953-7f1c508a3186", "comment": "Malware payload (XWorm)", "value": "dc455e0fc8fb490a442f90d6809c4acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558442, "uuid": "bd03fb43-2852-498d-8a8d-eeb0b21ce5ed", "comment": "Malware payload (XWorm)", "value": "3f81d7b9fd754f15331a5ef322931b07154673d74160c3008b0af32909da996a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558442, "uuid": "9f3a8b5a-ce36-4a5e-88c2-40738f008261", "comment": "Malware payload (XWorm)", "value": "81a5f561e27f4b47d8f9cb75f652590d0b3084f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558442, "uuid": "b25d8e7b-27e0-419c-a8f7-4b4ef2a413a3", "comment": "Malware payload (XWorm)", "value": "8821d38f1a0ec4cf755e12ed5d90d15bc29b0baf9a9b268ccb7133a2ff68e8f5115a827f5b1b388dcdaf36e4493df0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558442, "uuid": "67927088-2b69-4c0a-b051-6747c348ef7f", "value": "T1EF131B95B7E04112CBFE5AF12DB3D34A0AB1A8A36D1BCB4E4CC55D8A276B6C54B005F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558442, "uuid": "8f8c2da2-d68e-4bc7-9d3d-c8292ff07189", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558442, "uuid": "e6374c5f-c4ad-425e-a42e-c0bb97485792", "value": "768:R8ROoJD+YzyzvL0TFe4qjmx7UlOUIIG0h/uRDsQhLODDoR/+t6+:R8ROEDbzyv0BeDjWAIUxNuRv1O3k/+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683558442, "uuid": "6b73db98-6a6e-4d90-8020-96877f4d9547", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683558442, "uuid": "0918b39f-50cd-4505-8cd3-a6abde62b305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558442, "uuid": "654e2056-0a91-4c84-b7c9-721b8a465be1", "value": "bMvg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5bb20c-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683527204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527204, "uuid": "0e8ba76a-730c-459c-99ff-dde39d4b3b0b", "comment": "Malware payload (RedLineStealer)", "value": "1e729e179b4b0da052a39c7c61ed75ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527204, "uuid": "2898036d-87a2-4e23-b0b9-2a599752fa77", "comment": "Malware payload (RedLineStealer)", "value": "3fd79ba1fc89f18be599076afd1baaee113f7757dafeebe0167f126918f4edcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527204, "uuid": "cbfd9204-3b89-4260-b77e-0bcedd8c1c60", "comment": "Malware payload (RedLineStealer)", "value": "c7c87b076dcc9528c7fdc6498abd57c3330218e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527204, "uuid": "dd6c2eba-dc95-4f78-9bf3-c2cd455c84d3", "comment": "Malware payload (RedLineStealer)", "value": "c4d93ade9f3c31f1cfee5513b756fc8c3581ffb9e3bf111323cb5b81abdcad13f94ae1a50a9b32fe1a94ed61b19afcfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527204, "uuid": "0b8ebf30-c932-417c-90a7-6c170aedea95", "value": "T1C9C58621DAF51D0BF022AB3EDCE3B76166ADF6E20317D6A71640578A6D17AC0DDC0623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527204, "uuid": "73df3136-bbbe-4b86-9101-bc906ab30372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527204, "uuid": "36ca49a9-3aa2-4781-bab3-74368c91fb14", "value": "12288:+7uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyS5d3X8NMXzpBLN5zTqgGswq9s:C2MXzzLzvLMyecW9GjKbRVysvXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527204, "uuid": "eca43e4a-e0f8-43fe-ac1a-d1a177b52503", "value": 2550272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527204, "uuid": "29f77959-105d-4982-8e69-c0f62e6bbfb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527204, "uuid": "1101d4db-a3aa-4cea-9727-418990e18de6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f214d9-edb0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Nokoyawa)", "timestamp": 1683557817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557817, "uuid": "ba2870c1-cd4f-4b67-8359-7aa74c22a2cb", "comment": "Malware payload (Nokoyawa)", "value": "add302b551122d0d48c69477c701c58f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nokoyawa", "colour": "#72EC85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557817, "uuid": "59cb09dd-ba16-4926-bce8-1282373c40c7", "comment": "Malware payload (Nokoyawa)", "value": "418c1421c2424f152d83aa6886c15c42dd9947b63fcd4544a679eb0477d40dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nokoyawa", "colour": "#72EC85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557817, "uuid": "be295416-245f-4078-8931-80346b95dbec", "comment": "Malware payload (Nokoyawa)", "value": "0bb3c223adeb0f8c71d93cd6f6c090c3349fb979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nokoyawa", "colour": "#72EC85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557817, "uuid": "e69225ce-c82a-450f-8cab-bcba442935e6", "comment": "Malware payload (Nokoyawa)", "value": "7575477c12d2fb7d0ceb290f0feb3acfab0e61b313c4e7c72b16a5943c4556b039c17fc5868cc5f42b7b36a6c119216d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nokoyawa", "colour": "#72EC85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557817, "uuid": "69704472-1398-479a-91c2-e144cf390f34", "value": "T1B3945A10B281903DECF30172ABBEA52A556FBEB1071195DB63CC99DE4AF49E17A31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557817, "uuid": "05d31a20-ba4f-45ef-8dac-c3d793602bae", "value": "16f793fa2ae6ad62186553be52a52b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557817, "uuid": "4f06a335-7669-4bcc-9734-48ba065a018d", "value": "12288:qPno/SE5b4n0Kddh5tA/sBd/qnFT94qaUss:WWLA/qnFpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683557817, "uuid": "fabd6baf-e3a1-400a-8543-0fa523694e77", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683557817, "uuid": "96ea0a7b-7271-44b2-a410-b81681bbf6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557817, "uuid": "d12651e7-494a-42a8-a9da-72ea73b10521", "value": "418c1421c2424f152d83aa6886c15c42dd9947b63fcd4544a679eb0477d40dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386b9fe2-ed58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683519867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519867, "uuid": "0835ab65-ffa2-4efe-8b84-3279431513a6", "comment": "Malware payload (Vidar)", "value": "3cc3c84c2b53d1af1ef32385194d9567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519867, "uuid": "039aa3b0-48cd-4335-9ef1-1a7b12b0973a", "comment": "Malware payload (Vidar)", "value": "43283967357b7430a89b8904c8ad5022759cf0d5e9adc6505e68e95d7eebf993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519867, "uuid": "3d7b2d99-b003-41d1-948d-3f3b1f0b703c", "comment": "Malware payload (Vidar)", "value": "b39f3f126d7ce4c8d0c4e9466d442dfff1be1b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519867, "uuid": "ba698b05-d773-4151-894d-49795e1c011a", "comment": "Malware payload (Vidar)", "value": "12437a4899969036f3a85d366c3a502387cce12d8ffef96ca9019d846b2055d943c6d6a9bd992442bf030613133a11a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519867, "uuid": "8a6d8c45-1a1a-4154-b4ca-e42037ecf68f", "value": "T19726123351DB2144F0A4E97D87E6EEA972B96ED98D42783E44B57DC3FB309807A02463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519867, "uuid": "071a76a5-f698-408f-9717-24be74d25c63", "value": "f8b7bbf9d430a2bfb9c440a3cf35d684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519867, "uuid": "00c62e90-ca42-4e7e-99cb-a5af3be5720a", "value": "98304:OwH5CqQ9h1l2jhdslXO2NmuWnCCYUryWQ4m+zyrVxigu6LrL:xH5CqQnP8hdscKmHryWXmk4xiuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683519867, "uuid": "46030699-cae1-4f0f-842e-b81379b292fe", "value": 4784680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683519867, "uuid": "c0c91bfc-8ab0-468f-9fe8-553169a5c35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519867, "uuid": "2f4d8f8b-c0e1-4363-a258-d1683de9abcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26c7dae-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571612, "uuid": "9a2ce1a9-e5cb-4fb1-b512-174cc50c77bc", "comment": "Malware payload (Gafgyt)", "value": "7298e80f099dde9db20b0be02971b325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571612, "uuid": "25fc789f-f066-4e71-990e-7c660357f63f", "comment": "Malware payload (Gafgyt)", "value": "4387c1be9255ee394e49a49f2f302d3e0def1b397f3b3515abeb2c88858ae506", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571612, "uuid": "cfbe787e-afa9-487a-a6fb-05949a49ae15", "comment": "Malware payload (Gafgyt)", "value": "aa64cd34bdce015219917edcfffd858984a0ef0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571612, "uuid": "fd9245fc-9790-4a35-bd77-998bdb7cb5e2", "comment": "Malware payload (Gafgyt)", "value": "ea941c01c70e20a4e9135e87c345b6c81084df13f982b4d29210fd0fa746cfd8121ba5aa896d32f9a3c93c47ce40b35b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571612, "uuid": "f15d8a76-eee4-4dc6-b27a-3a4954889d0c", "value": "T14ED3C62E7A61ABFEE169923107F35F7083A625D227A09345F26CDB181F3128D5C8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571612, "uuid": "08685c98-95f6-4fc3-bbea-b067cd17bf91", "value": "1536:DHfGlkuMau3GanIg2rK/c6U1W8iEHLfPti2dSImNEz7ugf7hoWlNDsgrj4hs29NA:Kx+8PtiJn8ugN9syXoVmCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571612, "uuid": "a1e5faf6-2ee8-4a92-ad72-c3e8b02de147", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571612, "uuid": "f71bf877-52c8-4f44-8d6d-6f204bea0cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571612, "uuid": "6f20cdca-91c2-46ec-b162-62ba90028605", "value": "7298e80f099dde9db20b0be02971b325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cacbc82-ed8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1683543658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543658, "uuid": "f7d7038c-e014-4e20-b385-07b869e6e75f", "comment": "Malware payload (GurcuStealer)", "value": "aec814bf30dd191b641feef457a718ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gurcu", "colour": "#3D2028", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543658, "uuid": "18d6957b-18a5-402e-b6fb-e3bee035b751", "comment": "Malware payload (GurcuStealer)", "value": "446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gurcu", "colour": "#3D2028", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543658, "uuid": "f88d60e3-51c8-4c8e-8fc9-16c609374015", "comment": "Malware payload (GurcuStealer)", "value": "96c2bea5b416d10a2dae60acd2b7f9c7cebb8115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gurcu", "colour": "#3D2028", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683543658, "uuid": "81f3fabc-a5ef-4857-bec3-5230c09fbf91", "comment": "Malware payload (GurcuStealer)", "value": "5d14ec0b0d82b1524800cb6cfef9d12aa201c1909c8d98fa0a60366fb412afc6c7b56631fb99c621ad5b38eb654a5130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gurcu", "colour": "#3D2028", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Whitesnake", "colour": "#E1538B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543658, "uuid": "4a562238-0a13-45f2-a00b-50ce8c1169a8", "value": "T18F74C70C37D9FDE0EEFE14B9A8A513105335C4436605752A1EEAC8C29BF26845F8A5FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543658, "uuid": "10e1b6c2-ffe6-4242-ab72-ff6da90f8856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543658, "uuid": "f325e02b-42b9-4d40-a766-f510b4162050", "value": "6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683543658, "uuid": "9b147ada-a8b1-4c89-a425-0f86fe529d10", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683543658, "uuid": "dc65b3fb-9861-465a-aa1d-420848a22425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683543658, "uuid": "1bb675ab-562c-4d9d-9bf7-13481227e64e", "value": "verybigchimpanzee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33098ef6-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683550782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550782, "uuid": "720e3ad0-8a37-4eb9-8072-bf9bea25cc79", "comment": "Malware payload (Loki)", "value": "f7b4f86651f7c73f7ddba7eb40947e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550782, "uuid": "4b4ab942-3a21-4e0a-94d6-bbdd01ab0637", "comment": "Malware payload (Loki)", "value": "446532d38cb4ebb9c65b386158c45599c5215f64a4f7fba9824141ddf33ec16e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550782, "uuid": "00a0230c-cf70-4ca1-b65f-e2a35115a163", "comment": "Malware payload (Loki)", "value": "b076f34c0c71202418fb277ecbc01dde477098af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550782, "uuid": "d0c157c0-edb1-4780-9b63-ea3a9cf3d917", "comment": "Malware payload (Loki)", "value": "982cc19e6d9b01e52875aea95135a107f5ef50eec91c7c60886d0aba4aced04c9da869c7a711dca7834231d72ac5b565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550782, "uuid": "17aa86e2-c85b-4c3d-a66b-4c48505c41b8", "value": "T119B4F15432F58FB1E5798BF01938B94503F230B799F0D6680DE631CA1AEAF101E85B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550782, "uuid": "a24a0b1f-e180-4e54-a048-1d1168eb0bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550782, "uuid": "e13763f6-82b5-404d-8bac-b838f689c3a5", "value": "6144:xWhOS6rr/JqViePRFtPH5sjPj2SKGw354ORQddEiY+ioiNXDvY88IEZsZpjZ3P0h:7k3zDZ35HgOfXDvDisve1e871", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550782, "uuid": "5cdfde61-dcf1-44f7-b626-f5488ca4e860", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550782, "uuid": "bedbdd58-468a-4602-a439-4606c8467ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550782, "uuid": "b54dd347-da70-446f-a7d1-591144b691d1", "value": "DHL Express Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc887a-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565894, "uuid": "ee57d943-af8f-407a-b0a4-1993dd24e454", "comment": "Malware payload (Gafgyt)", "value": "76c92abebb2c428ec42ddb539d0bbddf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565894, "uuid": "c85873a6-8223-4388-9065-520fe23de220", "comment": "Malware payload (Gafgyt)", "value": "44885431a45d3f867466c22a081ab4711102f919c9e40cc508f9892c5009857c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565894, "uuid": "ffc41359-eb64-4a22-ad6e-a4988f53202d", "comment": "Malware payload (Gafgyt)", "value": "98a773d0c63c023cc41c955ffd2f6f14922c074f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565894, "uuid": "e0f9c372-e43e-4a98-a01e-c4aa5f5f9285", "comment": "Malware payload (Gafgyt)", "value": "e3850006235ec443f8deef9ec48b0834b97411a0d19ae6dbfb95d29644b174978654174d9b38e74d9c1cdeb3a5c77fa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565894, "uuid": "af42fef2-ee98-4ef3-b00e-32a26a4a9dea", "value": "T1C5A35B8AD743C2B3CC530AB2124BA6AA4621FD3B492E9F49F7197DB09F374C93125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565894, "uuid": "8cc6a70a-226a-4324-8a0a-3340ff8e6a39", "value": "3072:EWCjQrLpnr85EdT9Oa8vqbVr7t/CEgmqAgcVyZIcBI:Ef5EdTbpr7tWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565894, "uuid": "a36e9ac9-0c69-495e-952d-ace0d702ff93", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565894, "uuid": "49b8f896-3bb1-4468-a3b0-920b1e7e340f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565894, "uuid": "f616d7e7-4fff-403a-aea4-4c30848e2ec7", "value": "76c92abebb2c428ec42ddb539d0bbddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967c45e0-ed5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683522173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522173, "uuid": "b355edbf-c61a-4880-b917-bc7906a80add", "comment": "Malware payload", "value": "110ea9e0f2e27f0cf10bd78e21e533bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522173, "uuid": "0cfc7cc7-5546-415b-af75-a5be87a83438", "comment": "Malware payload", "value": "45d29afc212f2d0be4e198759c3c152bb8d0730ba20d46764a08503eab0b454f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522173, "uuid": "622d7234-5261-4856-b7a6-716cd2dc4b79", "comment": "Malware payload", "value": "d352efb5f30f22ee0f51a1e8c76a82853e390d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522173, "uuid": "904e4e64-112d-4569-9265-23afb45ebeaf", "comment": "Malware payload", "value": "5f3f9af64673eec21d31a22ac8dc32e45bae423e02d39c2ed60b00c3f750baeec75c0059062dc9d4d89730ea24ba12f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522173, "uuid": "8f079e21-7c74-47bc-a84b-4ee0e0e8303a", "value": "T118048E01F99380F2D836157409E3A678C63D3E5006BD9EAF97D85F6B4E31231A226EDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522173, "uuid": "2df5ec25-0909-4507-947d-22ac0b4d0b9b", "value": "9cd292d1fac1768b38a49bc6b288c67d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522173, "uuid": "84d6dcc1-58da-4e8b-86e4-684cd33160b9", "value": "3072:8rWFCCFpT9d9nwli+dKbAjWV98qgleaqdVNlirJ8CtRGeZ4VGLa8fYji5fL+dmn:1bFpT98k+ob2WVQUdyKORF5xfYjix6dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683522173, "uuid": "df9191b0-8dd0-4299-8dcd-978b3a614d76", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683522173, "uuid": "9c8fe479-152c-4cf4-bfbc-c508ff0ccfbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522173, "uuid": "87a3aa71-1b55-428d-b585-e17ab1ebe34d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b36ffd-ed68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683526835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526835, "uuid": "9fbb069c-5a1e-45af-85fb-a2034c085bb5", "comment": "Malware payload (Loki)", "value": "a6f2dc75cad48b19e2c49eb872f759de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526835, "uuid": "42081ef1-05e9-4691-a4a1-323d9300828e", "comment": "Malware payload (Loki)", "value": "45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526835, "uuid": "f0a21640-5328-437d-a8fe-a04757912257", "comment": "Malware payload (Loki)", "value": "581ffa7a871d7c7e760834d5cf3558e82b8289a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526835, "uuid": "c3f11af7-5a31-49dd-b7f5-85e165a02db2", "comment": "Malware payload (Loki)", "value": "21aff2fdbc85ce299db5c7071e79c65fa62c7749837123120a34a33e2c15469395bb62e8cc6bfca4407b894212140c02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526835, "uuid": "1d90f45d-eefb-44d5-a8f2-c78275fb8540", "value": "T1D7A412A472BACEA7E82D89F4186CF48413F170A7A5C1D7E41FB521C96BFAF100E4465B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526835, "uuid": "12c24bef-adfc-4fc5-be0d-01b5a52d4c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526835, "uuid": "a67799dc-7c71-41bb-8eaa-1604826fbd06", "value": "6144:ImMY9Ciecldl1qHpH9+mmgR+PTkgc8mL1lBtdyOhLeDY4nGUXhaVxLMUtrmVK3Np:Mq7j1qHRYk5xHbrIUYoxLrt3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683526835, "uuid": "4a5eb661-ff51-4f32-97f6-095b22113a4c", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683526835, "uuid": "9c2727f5-1a9b-4d6e-9f15-fd4af732dce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526835, "uuid": "780e30ea-8a59-4cd2-8c98-e2f7fd24b63a", "value": "a6f2dc75cad48b19e2c49eb872f759de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1776bd5-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528714, "uuid": "ef6a9807-1131-4b93-a5a2-d78102fad954", "comment": "Malware payload (Mirai)", "value": "b3d21761a985b94c5c949edb9765f246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528714, "uuid": "ae929359-3c60-486f-a47c-1136a7f0de78", "comment": "Malware payload (Mirai)", "value": "460d59de9cad72876c20a644610d17ee159fca2589b3b87ec7ae8845a194fd0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528714, "uuid": "a76ddc01-9b79-465b-b86c-ea928411727e", "comment": "Malware payload (Mirai)", "value": "f637cf2047de1e833391047267894d1a1789dc91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528714, "uuid": "44e1cbf3-808a-4307-988e-474d9f0f7c7a", "comment": "Malware payload (Mirai)", "value": "7c70de10461d13d7cef5cf1427d5d0ad0d657672f958a811217438d2d6a21174eb8c51efbdf8d72d6923a5bb020f932d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528714, "uuid": "b663e020-6810-41b1-a066-fdd9f2e893a0", "value": "T1FF83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528714, "uuid": "ff7c8608-927d-4b7d-bba7-5a0a0f05bb3e", "value": "1536:iVLyu95Kfpkj752dCexuV/8UZlDwfkJ4MYfWA:iVLyMgsFezxu5VD1ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528714, "uuid": "7cb9a045-8e60-4044-879c-0b1e94225dc5", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528714, "uuid": "2bf3cb03-0943-464c-ab71-24848ae603e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528714, "uuid": "c1870af8-4ecc-41b7-96d6-27a908234561", "value": "b3d21761a985b94c5c949edb9765f246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c8fe3b-eda5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683553097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553097, "uuid": "67f27674-bcc9-4a4d-a449-2a55c413366f", "comment": "Malware payload (AgentTesla)", "value": "066302b47c0766d602479bbb02e6e8fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553097, "uuid": "1e618aef-ce4e-415d-8bb6-987b77b2d521", "comment": "Malware payload (AgentTesla)", "value": "4629b5912131c5a9c21c3ff2130f9f021398c15ebb66857ee543a55a076f5c07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553097, "uuid": "8b5832b2-d8af-4cbb-8e85-e638a23cced0", "comment": "Malware payload (AgentTesla)", "value": "90edfe753411d6f676347a8ac91d7b05fd22addd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553097, "uuid": "d389f532-8ea8-4cb0-a1b7-d4b5310f5c68", "comment": "Malware payload (AgentTesla)", "value": "9687685b6982c9651c6d6803b19eafdad9a33c2ec0dda5377ff62f98230222f8aa7afc2fa60e826c4261f5bc7718ef5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553097, "uuid": "f3777d6b-529b-4210-b8d9-73df62fa1d40", "value": "T1C215A33924FC3512C2B5E5B2DBD4E964FBD089923532CDDE16D240861AEFA0276CBD2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553097, "uuid": "e98d39fb-cb33-4932-8cf0-2367d2b409a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553097, "uuid": "51e351dc-7b65-4ebc-a1e9-8d309b5ba5f4", "value": "12288:rx03Cpgq+fSBp2rNur8dyB259BlqJiqTtDKQpNf83mGH:Tg5FxuSyeBcQukWNfLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683553097, "uuid": "930f35dd-fea0-4c7b-8eb2-4c1a2e70a551", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683553097, "uuid": "ece03c6b-e233-44cf-9a2a-e8d569526fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553097, "uuid": "ae37ef9c-6a86-482d-b0f6-9c4562be7db6", "value": "STATEMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44a835b-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683504694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504694, "uuid": "d0f31d1d-5629-443a-b2c3-6150beaa97d6", "comment": "Malware payload", "value": "bdff5c8782a221578cb25c9a8c076ff3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504694, "uuid": "02cc2134-dfb0-44b4-b283-ceaafd8dab94", "comment": "Malware payload", "value": "468a9f796f26c5cdf195a0fecce2c5cb96cc9dde10ee9ed542af0209eade1411", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504694, "uuid": "98862282-5c25-4115-ac48-5be53320a0db", "comment": "Malware payload", "value": "21bec8c9c3821da3735b03d8f6d48c78410cf490", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504694, "uuid": "e0e41475-48c8-4642-9c44-815a9c74b19d", "comment": "Malware payload", "value": "98d7260e5925afa2c80ef34bbaab09c8202a4035eca1dc345e1aa77a03015ba183f8756a72c455dd7adeeb3ed2e8155d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504694, "uuid": "a3635631-7dbc-46a2-b1f5-258a3f1b9b48", "value": "T145C2346A5B8C4C61E35AE8B7865EE00E09FCF23631C255D4BD9DE3707B2D10E4B6A1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504694, "uuid": "7ba60935-da3c-4a63-b7b5-129f357f38b2", "value": "768:wyU7q/zbBomMlIOFJ84Jb9Ae9W7snxQAN6piOLrT0H:zUMvBoDpi4Jb6e9W78xrKNLf0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504694, "uuid": "ee9b985b-edfa-4473-a8ff-db6f58958e9a", "value": 25871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504694, "uuid": "48c56e0e-3035-43cf-84cf-1ca2822facad", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504694, "uuid": "f759fe19-f76f-40f8-9c90-78ec6e4cbf1e", "value": "bdff5c8782a221578cb25c9a8c076ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63aab24c-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683534972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534972, "uuid": "40c0a0eb-ae21-4d5a-a31d-adc9e8bc7878", "comment": "Malware payload (AgentTesla)", "value": "31f4ea7dc8f77d98413d6a7a1925abda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534972, "uuid": "2c7ff0fb-2512-44b1-93cd-d56202c4ee9d", "comment": "Malware payload (AgentTesla)", "value": "468d21c12e3590ec0a5a97a2f515878192f6beaddb4a721346890218af827bc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534972, "uuid": "3e447881-9c58-46a9-8e47-3cc4591a74a6", "comment": "Malware payload (AgentTesla)", "value": "cd528d877247b682609ae82e581297e8d3740270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534972, "uuid": "e7298399-6b4e-4f8a-99c0-b13ddd842fcb", "comment": "Malware payload (AgentTesla)", "value": "f8a0da3222d553d68f74f2021492e0e77b020633e0abac4fa91689dc1e1cd4d42efaa17fd029a671a71f82782ffe7868", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534972, "uuid": "4f3a0238-02d5-44bc-bf54-4eeda9bf45fa", "value": "T142C41284B1F9CAE7F81ECAF42628B641137072F7D4C4EBD40F6614856BE6B211E8859F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534972, "uuid": "6697e8ef-46b5-4147-862c-0459495e70df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534972, "uuid": "c1f2ff54-8d88-481b-8948-40a1aa98aecc", "value": "12288:3pTr50t9yjhBvDnVfxuc7o4Ex3wkriESgJqGK9k3mKzc:3JAgjLxfP7mx37OESgOuVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534972, "uuid": "bc4c65cc-8422-439b-8012-a08a45ca5df9", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534972, "uuid": "82f6532a-dd54-485b-b760-4868e16d6242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534972, "uuid": "1cffb251-ba5b-470e-88e7-b5c2938bfa05", "value": "31f4ea7dc8f77d98413d6a7a1925abda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cdf53d-edc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565086, "uuid": "e05ddd94-dcfd-420f-8494-97e2f68665fe", "comment": "Malware payload (Mirai)", "value": "e9f5fa2ca1ce46b629f90f1ced10f0eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565086, "uuid": "e13d6573-6be7-49f3-93f9-84bceed69961", "comment": "Malware payload (Mirai)", "value": "46fcfb66e679db167fc4f53ab739be7c6849394b841b4b8b8948a9d2d8388abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565086, "uuid": "0d61d97d-02e2-4e0a-ba5d-fa879968d971", "comment": "Malware payload (Mirai)", "value": "aa8465b7a97870a5caae185c2eed192c2af595ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565086, "uuid": "66e5d8ca-b2d6-4b89-a618-33bf0ff38eb9", "comment": "Malware payload (Mirai)", "value": "caef8892af923b68a38f0c9195bca9ed169dbc9a46e1b8cdb2cbe48b55037cd4b2e2a20a27f7562e5c032f19c97b113b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565086, "uuid": "0555af3f-10df-4ba1-8cb6-b23f67015c53", "value": "T15FF3C64BE569C2F9D4460F73A257BC3A03F72526144B2E49F326ED33D5D3887722A298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565086, "uuid": "20617a6c-6082-4dca-ba28-e4593941d9a2", "value": "3072:uJlCYx4VbG4p4tpCmaUEzMlKPN8JOrqtPOQBnL6XTa0Pfpft/TW:uJtx4OEPNiOm8Q9OXTa0Pfpft/TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565086, "uuid": "9f5c86cb-b44b-4719-bf1b-067b82543789", "value": 157983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565086, "uuid": "7f74e86d-f75f-46f9-8b85-f34e201d1bb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565086, "uuid": "b5224da9-6ca7-48fa-8745-2b122a5c5940", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f70a8a6-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683534160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534160, "uuid": "884f898b-f3b3-42fa-87c9-cbeb426467bc", "comment": "Malware payload (RemcosRAT)", "value": "f62deeda85413470dbe05565945490c8", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534160, "uuid": "07428790-c36e-49ae-bd9d-82f2aee4407b", "comment": "Malware payload (RemcosRAT)", "value": "470c984d8e1d9413b351c38a01827c7386fd15aef28681559df36574908f7088", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534160, "uuid": "3f604d23-66b1-42c9-9a7d-a31f879e11d0", "comment": "Malware payload (RemcosRAT)", "value": "5d0b9ea8fdd28779beb8873852381bbac3eebacc", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534160, "uuid": "f0780c74-91da-4f03-8030-a58d7d2ba260", "comment": "Malware payload (RemcosRAT)", "value": "c26da765f8b53c885ca57db628fc40f537251a35d35032708cf89a18fa15f20021e1ac5b27856bfca1785db8232a0158", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534160, "uuid": "43691220-de03-4b5e-9a41-0a58c9f37632", "value": "T123838F62A3ED5114F2F33F50BCF955214A3BFEDA9C35C94D42845AAD42A2940ECB2B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534160, "uuid": "59a56c9d-4644-49ec-9d9c-cc6b894c9352", "value": "768:mnHGdUBDCKtfYjE3Luo4+eaWMYFPk9Wai2Y:OHGd+CKtfSo4+DYFNai2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534160, "uuid": "2e182f8d-6789-4533-a6ed-b9c4d28e9dcd", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534160, "uuid": "0eadd8bb-f7c0-49a2-85fb-0b081d5945fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534160, "uuid": "cafb7e45-73bc-4cfb-970f-817ff6f1a5f0", "value": "Bank Remittance Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05155e13-ed95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683545980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545980, "uuid": "63e1dbbc-b652-48fc-acd4-b63221ad73c9", "comment": "Malware payload (RedLineStealer)", "value": "699c684263c7e3ed81ffb2b1df23bd5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545980, "uuid": "b4966af5-b833-4662-a639-ecd8da4dc822", "comment": "Malware payload (RedLineStealer)", "value": "47d84b51a9fb5db387b0ad30fee83657196f181699c7385215c2b1ac1cbd070c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545980, "uuid": "7fa560dd-eb71-4431-a6d2-ad3ae5666cb1", "comment": "Malware payload (RedLineStealer)", "value": "976027d56633d8c5be031759178a5bf435b182ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545980, "uuid": "3f4b9404-1b46-4508-b81f-eeb9439c7e0f", "comment": "Malware payload (RedLineStealer)", "value": "2fc3019fbae700292236706dc42f68930546975677742129607b1a375e8534fee74644f0f39cdedaa4f6505f194b5142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545980, "uuid": "b9c24837-77c8-490a-9f63-b5bbdb9bc8ec", "value": "T139C19414B7F90737DA614B75ADA3A3D107BC7B2669439B7FCE84324EAC416080A31BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545980, "uuid": "2a2eae40-f311-4ae4-892b-33996a26d83b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545980, "uuid": "0667c473-dd5b-4b4f-b696-5ef6505b456d", "value": "96:AzwTd9vgkKzqknu9SQIeEI6AHZu5jMZq7hykE9XQFnU:zknu9qex6qZ42qFypJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683545980, "uuid": "b3aed51c-32e0-4ddb-a0bb-e7e62274ad00", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683545980, "uuid": "906a38cb-30c1-4d86-a68c-64afb56b32a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545980, "uuid": "121a6a5a-25d8-4eca-94f5-253cf6e2737a", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.IAJ.gen.Eldorado.10656.28012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615767ff-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530244, "uuid": "72d6d4fc-2105-4353-8bed-709cd36b28ef", "comment": "Malware payload (Mirai)", "value": "d47238006c5fd51a0150fd6cae3770ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530244, "uuid": "944abd4c-5517-4ecd-8bd8-694703a26a10", "comment": "Malware payload (Mirai)", "value": "47db0007e841a6488c50c3214b3decdd2c405600f215441d335607724e713b70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530244, "uuid": "3180fa00-d6a0-4284-bd41-db7eb3de54dc", "comment": "Malware payload (Mirai)", "value": "57644cd7da164e639f813cf83458237810aab7c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530244, "uuid": "09c0b650-9d87-4eae-9e41-27b21ccc6d5f", "comment": "Malware payload (Mirai)", "value": "b58bb57e9744ac11ec14934bbd43f1f0eb9c5d9b6420c88fe384e229e1999421c3525b066beb304919082a041b9fee77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530244, "uuid": "e1259590-b11a-4ca6-a267-eb0516d57b99", "value": "T144433B81FDA0DE1EC9E5227B7B8F418D371617B8E2DB32079E195F60778A85A0E37580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530244, "uuid": "6002571e-f51a-4a0b-9cac-34ef22e3d3ca", "value": "1536:QFETsQUeIpgii1fz4/BNELtALlERNSWQ08:OKENyALlmNSWn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530244, "uuid": "aab0c67e-e691-4157-ae32-f7b4c7f4e34e", "value": 58440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530244, "uuid": "ecc73f4a-2378-4749-bf5a-13403f6a4bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530244, "uuid": "74c70eb1-e582-4119-8ee2-cf7058ac3665", "value": "Andoryu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3da463e-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683504720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504720, "uuid": "bc34bf52-95c1-451d-84f9-0909e1025501", "comment": "Malware payload (Amadey)", "value": "737e22e4f92ee7846f37474df77e7928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504720, "uuid": "e04fe477-591b-4924-8e6e-9855ed99f7fb", "comment": "Malware payload (Amadey)", "value": "47f1e05e78fb850987db877bb1f3d47f2bdd90ee8222f3072cd4007619779b91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504720, "uuid": "c62229be-d441-45da-a586-68ddf50abb83", "comment": "Malware payload (Amadey)", "value": "83799dafa55508401b7401ad0a629008e4e7e95e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504720, "uuid": "080ab9aa-31dd-4176-884c-1ba3dc96fadf", "comment": "Malware payload (Amadey)", "value": "c068665b46bddd85c28bd52926ecc4891c36820de2e453486893dc4bec563d334c2a83fa29469fa04eea3680f203bce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504720, "uuid": "c0997f3b-ac14-4b73-846d-5efe8faa974f", "value": "T172641A1383E1FDC4EA264B728F1FC6E8769EF2508F5977AA12189A1F44B01B6C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504720, "uuid": "a49698fa-4e69-40fd-8c63-551800ca15e3", "value": "774eae4c41c92ea810347ae7a14e6cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504720, "uuid": "a2b829f0-9f4e-4b21-bc11-1eb3dc4de7e2", "value": "3072:LAXZ72djbCeCLVjIpsE11kAJB+acvzM21hnez3Bg/5wcE3PwAvLWEhXXqT:Ix2BoLxIpX1b+LMkJez3LIhEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504720, "uuid": "6184d376-d02d-461a-b8ab-3474101c455a", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504720, "uuid": "281b9f3e-2a8d-4fa0-a9ab-24523599aa79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504720, "uuid": "5e0ca6de-b4e3-4bb3-b36d-da2716102ad7", "value": "737e22e4f92ee7846f37474df77e7928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48bae65-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528719, "uuid": "71117d9c-9411-42db-97bd-ee8fd5402f01", "comment": "Malware payload (Mirai)", "value": "306b400a773d5558e811abc64710c0d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528719, "uuid": "7b1d3569-98ba-4b25-aab6-2a2c89f7a2d9", "comment": "Malware payload (Mirai)", "value": "48315af03825c3802d77e822316b9365d5259069229e3c99571fd5201d4840d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528719, "uuid": "518b0d64-65f0-4c69-9451-de261a84abdd", "comment": "Malware payload (Mirai)", "value": "0054472ccb842d2f8399553efc3a5bce159bfaca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528719, "uuid": "67782189-118d-465a-9254-87d27dc15d1b", "comment": "Malware payload (Mirai)", "value": "1c3e8c9645e3132d5542a3f0657516149c8312d2d9f3d95e4f4a221b78a41fe3c1d86c1c4a8f77d8803f55f0ba987c03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528719, "uuid": "e5536ca6-7732-428d-baee-73019d8e3345", "value": "T1A7730856B8814B12C5D5127AFA2E118E332317FCE3DFB2129E106B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528719, "uuid": "4f44a4b3-3ca8-426c-8b71-18a27b419d11", "value": "1536:2ln25xPBXk1wnnkL7+KE007IoRMqai90DIyiUNbsvHTGcV5GYIWd:7xpXCMkM/vTaFNbsvHqcVERs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528719, "uuid": "2795aefe-2988-4d52-b4c0-5e29188cbffe", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528719, "uuid": "7cbc740a-4701-4a56-ab25-96f8da4b8bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528719, "uuid": "a400be7c-417e-4de2-ad1a-e6ff95bca9db", "value": "306b400a773d5558e811abc64710c0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb06652-edc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683565217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565217, "uuid": "6fcb54a9-86cc-4b39-9425-5f6338025b52", "comment": "Malware payload (AgentTesla)", "value": "cdc059084e95c6d9bbe572bc62da0a54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565217, "uuid": "e766b99c-444b-48ec-a822-207a76e3d604", "comment": "Malware payload (AgentTesla)", "value": "494979f4e2eca84b240d774c80ad703ada9db1f3314d6431bdb6228045c7e2b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565217, "uuid": "52c52f1f-27b3-4fef-a08a-a782763799b6", "comment": "Malware payload (AgentTesla)", "value": "4d7d338f33aa62145c1f95033657bbb40462e08e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565217, "uuid": "80aba920-f7af-46bf-a87d-cd603fb1a696", "comment": "Malware payload (AgentTesla)", "value": "182fa190e9d9d33a1f351f87a500f942ab6d0e457c17961310936e846ac1ea77ed31e0e293acac53b1f00bccbf715f55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565217, "uuid": "1cea136b-568b-4bdf-9406-80fd3623afea", "value": "T1C5D4F11572E57F91E53E0BF8346472400BF231AB60F4EB2D4DAA51D97AA5F810B80E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565217, "uuid": "5c2c0b5f-ea4e-4b97-8923-2837483b88a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565217, "uuid": "f010c5ec-ae05-40b6-bd62-e831f2337485", "value": "12288:cs5jme4uRMEWekSzxsUBKoktXTGoBjrhAdMBbLk4:csJ4uaEWehzjQo4NjrhACBbLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565217, "uuid": "b31b02a5-2b38-48d6-89d1-6def908beb1a", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565217, "uuid": "6f6f3efd-eaa7-4bf1-98c9-43ca28e95dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565217, "uuid": "c6eda2f0-c100-403b-a4d3-bf673d44d3d1", "value": "SIGNED ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa97566-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585727, "uuid": "08f32193-8e35-4374-be76-640c63706385", "comment": "Malware payload (Mirai)", "value": "46c982fd8c769136b0729969b2b42228", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585727, "uuid": "619fc075-46e7-46a7-93b5-9c399e231af1", "comment": "Malware payload (Mirai)", "value": "49868df3ee08e44d827b66f42bd8d2c5c174cab0e513de0e3c61858c4cc1432a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585727, "uuid": "64504a29-ebfb-49f8-af46-397237aca0ee", "comment": "Malware payload (Mirai)", "value": "3c6ca16b4d94467d91ad3b0e637908d8b73f52ba", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585727, "uuid": "d1a6656f-3ca5-450d-96ff-3b874365f089", "comment": "Malware payload (Mirai)", "value": "ba9a4615c28b81f72bd477a49e828401aaa118e882c219bb05b3f82d69ece2530ee98e88293664cef9b7ddd32207dc26", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585727, "uuid": "4ba0522b-7313-44e4-96f6-3a4dd21dc6b3", "value": "T1A3D2D0A985D7F1BCD0AA66F5043D47C4ED727216C12A1BB708E8707AEF130D80E30EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585727, "uuid": "6a573026-8d1e-4ecb-b8e2-b63036d6af43", "value": "768:sYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBfq9oSx0sZ:sYJdJZiy1aBnQfTqBfUTtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585727, "uuid": "7ee4cae2-6453-4235-80d5-0d15bfa59008", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585727, "uuid": "4b47fc77-74b2-470b-8e30-c083cb30ee22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585727, "uuid": "9322a8a2-6bc2-4705-9276-6a9897d13841", "value": "46c982fd8c769136b0729969b2b42228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8358d5d5-edc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683568526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568526, "uuid": "872c880d-efb0-4903-a567-b2f2c2abd6ad", "comment": "Malware payload (Mirai)", "value": "47cd167b215c6979b9afeecc7987f9a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568526, "uuid": "6e0b849a-3e6f-418b-a72a-d52026e806f8", "comment": "Malware payload (Mirai)", "value": "4a15bc2a7f9e08d7f9fb7825cb78aee115c065e0f40ca932702cdd7953a7d84a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568526, "uuid": "09e739fe-43d4-4c4d-bf06-9fc329770ddb", "comment": "Malware payload (Mirai)", "value": "a95147f7fb3ecf87ef9bbfb5d127a35248fe6b5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568526, "uuid": "f1541b5c-9b47-4d7d-ac81-4d287c52f448", "comment": "Malware payload (Mirai)", "value": "77fe4fdc9ca9a3924196c81bc65530c376b77ce7e4c95c258dc771c88cd4351e5a99db90882ec6c41bd79bff183452d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568526, "uuid": "8a4cfc78-f344-4b91-88b5-6bf6dcb3e801", "value": "T15A23621D3E329FADFBAD823457B34E21A75923A536E1D584D29CE9001FB020D346F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568526, "uuid": "9315ead9-967c-4c39-9fce-1d9afd47ba12", "value": "768:H49OPJnhqUAQLFRfJmya0DgEp/CRG8RppjKyHTkJ5o7Ua9P1py1yayoSybyQSy5+:HLlhqUAQLFRx1GlRpkyzkyaYBdLBa19S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568526, "uuid": "04b0c839-b696-4ac3-ba49-19502771b496", "value": 48452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568526, "uuid": "59e763be-972f-49c2-a58f-c0f849056dc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568526, "uuid": "2da86ab6-2f8f-4046-be8f-00bf0072fee5", "value": "u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0db943-ed72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683531334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531334, "uuid": "ab6e8566-4582-4d04-84b4-715ee3cc7c4d", "comment": "Malware payload (RedLineStealer)", "value": "9f2ed889f0f34f9ea5fa9e4754463018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531334, "uuid": "f0a1afe3-7e3c-47d9-b4a4-1c6cc6cd3052", "comment": "Malware payload (RedLineStealer)", "value": "4a69335a427546cfc1b44efdd2d2be9d1190d271ba8920cfc661ebf352cb48c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531334, "uuid": "ea3bfd00-c1c2-41b3-b018-88246b89f2c3", "comment": "Malware payload (RedLineStealer)", "value": "77a384986dd8e51b3346b341723157f5331b263d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531334, "uuid": "fa871730-8058-4ead-989e-b34142e33229", "comment": "Malware payload (RedLineStealer)", "value": "b797e530c0ce0dacb51be3fa74a78193db117f7b9b5f31365bc0afc3dfd17f29526443d1b8477b3d0012b7d134c868db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531334, "uuid": "79e1048e-c4a8-45d2-a47e-fcfe9725dff8", "value": "T17EA43A81E6AC6161DC69D7316732EEB092337CADAC306C1C34EE3D177BB726A01591A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531334, "uuid": "201df391-9506-45b0-b5db-33086cb5ed57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531334, "uuid": "b2811aee-a799-47ee-bc17-812cda0b28bf", "value": "12288:T+J705VxHzxlKnGyF/QV8soIP7r9r/+ppppppppppppppppppppppppppppp0G:TuuH9lYGx821q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683531334, "uuid": "0d433a87-276e-4188-b344-cdce07d9be3a", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683531334, "uuid": "99de1362-80b8-4f9d-8dc2-b76837c276ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531334, "uuid": "28733ee4-d773-496d-9632-607b191090f2", "value": "Document pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5094e69b-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683534940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534940, "uuid": "6fe9cc0f-a164-4b9e-929e-d878d6fd667a", "comment": "Malware payload (Rhadamanthys)", "value": "6e8e05ddf9fb4387485c47f1abb87b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534940, "uuid": "a74db62b-2a8f-44cd-8bf9-95694ed3cdf5", "comment": "Malware payload (Rhadamanthys)", "value": "4b4fa37e0aa56e673d1fc43a8c99efe824b01c8ac1a7eb838f4637595e569af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534940, "uuid": "749fd1c7-7e6a-449a-b9a1-eb699699ff44", "comment": "Malware payload (Rhadamanthys)", "value": "70c49d33b9675a5224235ac5013469f47a02c7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534940, "uuid": "ba30b65d-5168-4058-9797-26c3285188c4", "comment": "Malware payload (Rhadamanthys)", "value": "7f6fd21191dbfbd42072f5bf39b0b77f3b13ab33b2217e8cb19fcfc47cb3cab7231ef8dddfccc95d8632e61e261f95e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534940, "uuid": "2cbed41f-f2aa-4bd2-970d-eab10cc5edb0", "value": "T11C844C5383E1BDC8EA264B729E1FC6EC765EF2508F59776622189E1F44B01B2C1BB710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534940, "uuid": "a03ceadf-23a6-4e98-9892-76f2f8c9f248", "value": "09ad811c7b24c560499d47bd7c66a41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534940, "uuid": "d037be89-3747-4476-9d5b-e45b21e1abb2", "value": "6144:RJlKZVLZ/nZiIDfhDMk5YJyPB34BunBNKEF/J+i:RPaJn8INpkyPB3CgBNKEr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534940, "uuid": "7a880371-a32e-4179-a5d6-322e6d13b3b3", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534940, "uuid": "2f7f0830-02ba-4283-9f15-6cf7583fd231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534940, "uuid": "66c3449d-01fb-4056-8c50-f0fec70bb8c3", "value": "6e8e05ddf9fb4387485c47f1abb87b9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78343d7-ed3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683508028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508028, "uuid": "12fa9d79-7ee8-400a-9509-b90964d3670c", "comment": "Malware payload (RedLineStealer)", "value": "f5f3cbaa1f53896d3ade7a0f2810fa47", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508028, "uuid": "d2729dd0-8af8-4aaa-9ff8-a6113725ee4e", "comment": "Malware payload (RedLineStealer)", "value": "4b8efa3e6a3b61a378de837d9d136dd50ca8c93a7ca075fe0dfcbf6f8bb0fdbb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508028, "uuid": "fc5fccd1-2ac5-4a8f-99e6-8b15b9883501", "comment": "Malware payload (RedLineStealer)", "value": "028e5ae1b6e6f365b47ccaa790791996c57e30fa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508028, "uuid": "c927d057-e3a1-408c-b72d-7f93de43b2e8", "comment": "Malware payload (RedLineStealer)", "value": "a9ab2a173a2b667815625e3d3f25c04a93ee27879df8dfe70728c79e0ecf3cf7a35eb74e7317e81c15ddd5e9311393f2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508028, "uuid": "9ee9b72f-ef28-49b4-9f35-7cdf2c9eabbe", "value": "T177141337ECA9BB85CBCA4B2D4BB13360D4D7F4D20B97EABD5B90E00050763D09674266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508028, "uuid": "e980bfbb-7e92-4fd0-904b-91665e22bfce", "value": "6144:+1RAXjatMkzPd5l/TC+fllo2raNWXa/x5B3GGgyw:MRAXjaikzPd/2WlodbPPgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683508028, "uuid": "d8b1f434-bbf3-4c28-9212-eadc4e8d62f1", "value": 204176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683508028, "uuid": "59c90d0d-1397-4f6e-b6a8-c5eb30a9f479", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508028, "uuid": "7f736d18-132c-4104-b4bd-7deb90e2e681", "value": "Video presentation of the sewing machine.rar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12a6a5b-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683504689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504689, "uuid": "2b1ad992-2778-48f4-9e5b-a0faf5686b67", "comment": "Malware payload (Formbook)", "value": "58155673d0d47b5ee20a25ea89b07f23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504689, "uuid": "9e624169-4312-4685-99d3-22c408bae7aa", "comment": "Malware payload (Formbook)", "value": "4ba8bb8c08c2ca600d1359b3533af1b50e93083858305d320d30de47a89652b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504689, "uuid": "16eea541-72a5-46bb-b92a-bf214b070844", "comment": "Malware payload (Formbook)", "value": "721bb94b2a06d047862aeb81f3f054d1f1b8cba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504689, "uuid": "1d8b5d33-1f66-4291-86ea-1f2b3e5dd1c7", "comment": "Malware payload (Formbook)", "value": "7c80d336bb2f9f6b2b598b0b1d00b411ebaa0b0ce93471f15a3208af04d9273307d99657fd56cedc40d4392282b4e76b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504689, "uuid": "b0711ce6-c0d9-4608-af20-50070420c6b4", "value": "T1B94412A4651AC4BFDDB70A710F3E0377EAB269332438930B1B209A4D7E65795C91D3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504689, "uuid": "6ca966e1-7345-438b-a385-430833a453e8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504689, "uuid": "6198a3f6-a1ab-4240-abe2-3ab06d991141", "value": "6144:vYa6M/FcMInoIUE3rxNIQuVKJRpnA8JYdDYx9o/FW:vYi/FS8E/iHdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504689, "uuid": "2a6fff27-0d86-47af-b089-e2e0b465816d", "value": 258844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504689, "uuid": "10d001ee-ce41-434e-81b9-8696459e5729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504689, "uuid": "d0e823c0-beef-43ea-8ff7-13ecb145f578", "value": "58155673d0d47b5ee20a25ea89b07f23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cde84d9-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1683550503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550503, "uuid": "1f7dc923-19b1-4a02-bf71-274cf58e67fe", "comment": "Malware payload (DarkTortilla)", "value": "df784d6239b39b4ef9e0581f832a479f", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550503, "uuid": "93bac120-9ee3-4cc4-a0db-052ca28cd1c7", "comment": "Malware payload (DarkTortilla)", "value": "4c731629ffa2d40458ef7901f271cfb524c132f85f50206d906ca2aaf7cfe9fe", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550503, "uuid": "5bff19b4-2a20-4d4b-9d36-25b2ecb173dc", "comment": "Malware payload (DarkTortilla)", "value": "9abf217e0d9c14de5892b8f97faf842a9d9c1f06", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550503, "uuid": "f05996f6-963c-404c-8e58-426e5e998af7", "comment": "Malware payload (DarkTortilla)", "value": "8cad8f35c38b3e0f2ba4b2737ab1585ef23ad6b405de00249a0d95c8461c3d45df8a3f7440820117b2142c8123befd24", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550503, "uuid": "bb1658ab-6f07-47aa-a757-6a1baf8584f4", "value": "T1C3C5876599F51D0BF022AB3EDCE37351766EF6E20327C6E71940678A6D46AC0CDC0A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550503, "uuid": "90c05cd3-f283-4085-8a41-859528ab680e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550503, "uuid": "c8ba169f-2d09-4293-9db2-972431553afb", "value": "12288:4A7uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyUzy8NMXzpJy6eCiOWTQ59oM4:4yMXzXcRI6BunvpSesHHaEzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550503, "uuid": "f8444104-fa27-47a8-873e-a8c19d130ff5", "value": 2637312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550503, "uuid": "545c6fef-ccc4-405f-bb40-2983aaa03815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550503, "uuid": "272fa7d1-1ea0-473d-89d7-f79ad875af47", "value": "df784d6239b39b4ef9e0581f832a479f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59d730d-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683535083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535083, "uuid": "fc7e047c-70b7-42ac-9c3e-f640d605c210", "comment": "Malware payload (Rhadamanthys)", "value": "5e3558efaf755dbc07a8a4b1105cf848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535083, "uuid": "876bc0b5-d8cc-4337-9e5c-bad4f43931ee", "comment": "Malware payload (Rhadamanthys)", "value": "4e98115b5fba13ab772a232e8c454490e7e76df4c844bf02b176635aa737c87f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535083, "uuid": "3fae530c-063a-4ddc-9e35-2d2621817c16", "comment": "Malware payload (Rhadamanthys)", "value": "ab6a0aaa0b197530d95af81ccb9f34f6d9806e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535083, "uuid": "1e09e34a-cea6-4969-a75a-c1e92c1eac3d", "comment": "Malware payload (Rhadamanthys)", "value": "b71726ec59bd4cfb60f3288715e0f8f5314a3dd58a4f7031775f3de69f1297196db9acbf60e0cd5933e46cde6fd1fc95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535083, "uuid": "71c8628f-570e-434a-abb0-1868f6fdbbbf", "value": "T1B8843B1392E13D54FB268B729E2FC6EC765EF2608F59777622189A1F04B01B2C273725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535083, "uuid": "669cb75b-a0ce-40b7-8d53-be784966d71c", "value": "6bcaf949be5bd19d1292e1f0ea301f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535083, "uuid": "ade4beca-d000-4084-97ed-5e5ff82574e6", "value": "6144:ERCLN4L9qXS0Ovke1ffCqCD5bk50iNTJ1AsxB84Mk+:ERCuMXfOvkGCqabqFJfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535083, "uuid": "396179cd-7ba7-427e-8c01-b226204a9934", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535083, "uuid": "7748eb54-d938-4798-9f39-0cf15ec4f759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535083, "uuid": "7cd08242-d4f5-477d-bf69-da885fbf1180", "value": "5e3558efaf755dbc07a8a4b1105cf848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb46afad-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528677, "uuid": "e56f93da-2ee9-4272-9735-9c2b138f157a", "comment": "Malware payload (Mirai)", "value": "e2be73938d75a05fd60fb85955b0d3d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528677, "uuid": "dd4522bb-174b-4542-92ac-5252432fb830", "comment": "Malware payload (Mirai)", "value": "51649ba609ff1aefc517503651a61f1f4784587fd93fee7d39047ef014fb27e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528677, "uuid": "45ac737f-0c52-4006-a917-33776781bb04", "comment": "Malware payload (Mirai)", "value": "de14d78b6b6c290173f03c6528d9a508993ead5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528677, "uuid": "99a630c9-4121-486e-9dba-26c07229f9a1", "comment": "Malware payload (Mirai)", "value": "9496a2f959139b35347ac332db0e64d3fc545c2f9582653ca3b34bd050c9d45b08baa540c0bbfbfb865861057b93b6c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528677, "uuid": "bd00210f-78db-41dc-822e-32def10adec9", "value": "T19C637EC9E283D8F6FC1705706036E73BAE71E0AA211CE686C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528677, "uuid": "b297cfaf-f412-4719-b66c-0269c80c9971", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAa1xsx97qJ7RvsuIr5bh+8r:pnUQJ7RlUXTQpwOaOAgxsn72+uWnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528677, "uuid": "97915dd5-043c-4f86-9f8c-ad35b4c0ed48", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528677, "uuid": "de1c0b5c-8aef-4e4a-8e40-2cec8eb8950d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528677, "uuid": "b52feac8-2134-4c1d-a084-276366351129", "value": "e2be73938d75a05fd60fb85955b0d3d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d154be-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683588552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588552, "uuid": "8c47bd1b-34fb-4bf3-a4ed-3aea268c5d6c", "comment": "Malware payload", "value": "6e20733dc9a6aec9ef1659ceaf76c123", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588552, "uuid": "315003de-7797-4022-80cd-57c57ff30d1b", "comment": "Malware payload", "value": "522a3ff52c1e23e7f36e8e140c4526ff94c561eba0978e524c6b6816ca944ab3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588552, "uuid": "bab2407d-46d5-42c9-bb93-f9e4318509b1", "comment": "Malware payload", "value": "f01ca337813e0f2151439ef135c2082ab86ed40a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588552, "uuid": "4f9f4681-5de9-4226-99d0-96b19e82661b", "comment": "Malware payload", "value": "23fa9938b8ad9760615d9962c8f2e5537a2c8b552ca649eaddc0ca895d101debd3b4905d5260ca34d3aa0be9cce7a218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588552, "uuid": "ca28068d-cd2f-47d1-b7e7-85796efe8777", "value": "T172C3505B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588552, "uuid": "53c54279-dff1-4d84-91d4-b4152db9a833", "value": "3072:wISPhPh28cVCSmdCve0uPgrUiyeVKfj/GPIBWhFb1lqQG:wIyhPh28cVlaPgrUnas/GPIBWhFb1ltG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588552, "uuid": "b25d7a51-983c-4014-9a4f-209698b42be1", "value": 127684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588552, "uuid": "87464fc9-4374-4101-85aa-c3e67161b2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588552, "uuid": "83698eb7-c6c3-4cc3-b176-861f7e730dc0", "value": "6e20733dc9a6aec9ef1659ceaf76c123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635f9562-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1683570190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570190, "uuid": "f78f958d-1e0c-4373-87f8-9e606384a2d6", "comment": "Malware payload (SystemBC)", "value": "11531557917399f40732b120a9a22359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570190, "uuid": "482693af-09c7-4aee-859b-5d8af120cb40", "comment": "Malware payload (SystemBC)", "value": "547c8ae1a463eef31e8d51f27408d144fe1cdde0cd31d4ccd8892f5200e111b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570190, "uuid": "1cfa83e6-fc66-4795-ac76-b70ea6937c38", "comment": "Malware payload (SystemBC)", "value": "ce66abc4cc7aaca0612df449e8e08aad66b74af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570190, "uuid": "d65e9c6f-919b-4d82-8254-cecbb06cb547", "comment": "Malware payload (SystemBC)", "value": "57755a30c8178952745a5338c4ce091c6ed7a488ebc1f3f98573973bf5f97aa3cdcba299575731b5824fbece57fe2c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570190, "uuid": "85dbcdd6-8794-49ac-8c14-5ce929b743f4", "value": "T16B64FA1352E13D98F9268B729E2EC6EC770EF2508F597B69221C9E1F04B12B2C173B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570190, "uuid": "a4eeacec-3153-421e-8728-0ebdc9f331d7", "value": "0f907acfe861920cd55775c62f670cb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570190, "uuid": "cca56c18-3e01-4db5-b711-e2362fd3b09a", "value": "3072:FjtaqjPPsNzEMnpYqMv8RG7FWge89N6oVtpVRIcec5Rr4UrB3x//tKl:NtfjcNnel0G7LdN6epVRIcV8SxtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570190, "uuid": "cc9c52e6-24f1-4871-86ce-fd9f82600998", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570190, "uuid": "574291f8-005f-4989-ace2-4d3e637e3dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570190, "uuid": "83188f85-6586-47be-b79b-61520b5c6797", "value": "11531557917399f40732b120a9a22359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73547d14-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550460, "uuid": "b45dd423-b5dc-4c8b-8c19-41b41cc3a0be", "comment": "Malware payload (SnakeKeylogger)", "value": "6566f6d59a1858fc672de0b6a2213ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550460, "uuid": "d8f4ae5a-ac63-4873-861d-db9f14d5c9ef", "comment": "Malware payload (SnakeKeylogger)", "value": "54c042777168fbf754e0bb6de6547d13398f958344d2e0aa76060ef4daa02419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550460, "uuid": "2e835ab1-2b40-41a1-8457-b7cbb867c353", "comment": "Malware payload (SnakeKeylogger)", "value": "304529c5f2223e2c1c3235ffab67fda9cc9f3e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550460, "uuid": "fc52509d-f003-4540-a362-6df4a53ae08c", "comment": "Malware payload (SnakeKeylogger)", "value": "7abe84edd4582660d6d15309bdc49852e3aa47cbd172437c096a6311f9594299b559f94562443b9fe0ced849fde65988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550460, "uuid": "4770b117-2d3c-46cb-b6b2-a9279004dba8", "value": "T138B4F19532B99E63E03F49F80C28B94003F570A39ED1D3E62DE6A0D52ED9F81278159F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550460, "uuid": "c7e44beb-cedd-4ed1-93cb-81c0ca7e3911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550460, "uuid": "fd26c761-50b2-4f52-b601-a4473a79b482", "value": "12288:Kd/yxPifPt6Z4s3L2yA9MZLZBbnwMLidqPGPr47w95:GfPt+4s3SaLVmoPGD47E5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550460, "uuid": "50b8cb89-e809-4282-989d-59a438a90d03", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550460, "uuid": "567cff09-2e30-4bc7-9eb1-62d72e2bbd98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550460, "uuid": "b773b4c4-4db6-4c54-b163-c94662bc5a51", "value": "Halkbank_Ekstre_20230321_080804_358439.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e8547c-edf6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1683587724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683587724, "uuid": "b2976b27-08ca-4a81-b8ed-ce6921b884dc", "comment": "Malware payload (STRRAT)", "value": "49e7376a7e92c4778686057180ab5d67", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683587724, "uuid": "16c358f4-f2b3-4d52-8f27-471b16c0bf99", "comment": "Malware payload (STRRAT)", "value": "5578f766f6f22f8de8e25ed39f59b099c030247538c22c9938aa12b3a28f34d8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683587724, "uuid": "69f6202d-a687-4459-9f3c-f7a9cb60db41", "comment": "Malware payload (STRRAT)", "value": "0b9e200ae16052a6d64619a8fa5a8d54dee84376", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683587724, "uuid": "f49ec455-7ec8-46dc-b76c-624814e057cd", "comment": "Malware payload (STRRAT)", "value": "14f4239c6a18dcbb3e43678477f49063189443a8e779e85c95a761ca140868813ef611b46e32e7e6d1665b0faf07f35b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683587724, "uuid": "f45a5daf-700d-4e4f-9864-d19f528f2e56", "value": "T17E24029B3EDBD4D9C65F59712618823A7A0E605CD003B62B79FDB2094CB1C6E1B50ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683587724, "uuid": "0228e3e2-5fb2-421d-9e14-9e69c362687f", "value": "3072:YI9LAiB+cj593EvwYkWWgMoM5561RhtnkymIPbFCLG6IztrDnVtRCXHv+K3TExIe:THB796wYk6Ma1ftkx7qJaXGuCvaMiXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683587724, "uuid": "d91a96ff-e8b0-4043-a3bb-4df2ec13b24b", "value": 224765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683587724, "uuid": "6a20cc7d-88a0-40eb-9922-01f4c6cefb5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683587724, "uuid": "ce061e53-4092-4f17-81b4-062e4856c71e", "value": "HY372.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba349b51-eda7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683554015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554015, "uuid": "c010969a-7f81-4852-92a1-85cd0efb7fcd", "comment": "Malware payload (AgentTesla)", "value": "6e4bf6b698c6f3cba9782d96d29ab55b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554015, "uuid": "01c37cb0-b9c4-4ba5-b03e-a24c54bc8cfb", "comment": "Malware payload (AgentTesla)", "value": "5777e088b6df69cb6a38e324ff037a955ecbe8cd04a941407ebf7c09c51fc4ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554015, "uuid": "5a69e2aa-a3d6-4331-b027-039ed267ddba", "comment": "Malware payload (AgentTesla)", "value": "d0f2a7dcc457b2a432f9639378afa7222a61ebdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683554015, "uuid": "5c051ec0-9d0c-45bf-b737-747124421f9a", "comment": "Malware payload (AgentTesla)", "value": "2a6f54f075d4892cb2f0783ccf7fd9ad8850b650c6556dca2a329230552dfdd7bbc427f475c09d6b668bafd55853014c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554015, "uuid": "adc007f5-ffe1-41c3-a662-b1836c56d50c", "value": "T1AFC412A8B6B58761EC2ECFF8293CB50003B071A798D1FE541F7555C52BA7B342A8498F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554015, "uuid": "1dc9d42e-b477-45ab-a2bf-157bed882d3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554015, "uuid": "2573f933-ed3d-41e3-bfa4-3cb9ebc2ee04", "value": "12288:3G0n80QCSatlFYuMteBDGPUk+VEEDn44mzUsx3G4oy:WMQNanFcUkSzDnQLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683554015, "uuid": "1823ba17-ec19-4bff-a499-0d99e2f3e7e9", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683554015, "uuid": "5c570b62-33a6-468e-bfae-5d6fa8fcdba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683554015, "uuid": "98495848-f36b-4002-b492-9420a494e9cf", "value": "proforma invoice#5577383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088e0185-ed67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683526229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526229, "uuid": "5505e0c4-1ad2-41cb-b900-61a733ec6dfc", "comment": "Malware payload (Loki)", "value": "e7ab84b9d7294f86ad5eeda376d14d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526229, "uuid": "f3460014-7d68-4d98-a20e-8eafa659b168", "comment": "Malware payload (Loki)", "value": "57b52ccdf1b1bd983b94eb086e66941aff4f98e99f08083396c24aeefc73a53d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526229, "uuid": "934315eb-4750-404f-a434-00500c913b7b", "comment": "Malware payload (Loki)", "value": "543b09166ba51575d2440c11ba1d4eac05d2d572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526229, "uuid": "f780e832-e176-4f98-bde1-00324accce59", "comment": "Malware payload (Loki)", "value": "943c03c63881ac01a94c9e85c38a34789eaab982808981b9381fb199f03ba211c670aace280cb607af40f046f602e478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526229, "uuid": "836977fa-32c3-4660-ab6c-6863895de71b", "value": "T13BA41214B1FA9AA7E51F89F85138BA4013B1B1B3E4E8E6D80F7674854FEBF01098465F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526229, "uuid": "5e28b333-3cca-4aa8-bfd9-073bc8b6e90f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526229, "uuid": "2d3df61f-5c80-42e5-bb64-87397cb0e9c5", "value": "12288:zj6s3yiRnViJoTwxTbFI8bweyfZp0r/lkgBBdtM0i7c:zGwXV90Tby8jyhY/lkoBZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683526229, "uuid": "8d0fe599-7da5-4455-9ba1-056700fcae6d", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683526229, "uuid": "309e8119-d0c7-4481-b8ee-74c5783907c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526229, "uuid": "4a9c71a5-df8a-43d9-bff6-9db207a743f7", "value": "AWB# 397757825428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7476c2-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683534563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534563, "uuid": "e004aa01-573a-4f90-b6cd-0bf52bb7bceb", "comment": "Malware payload (Loki)", "value": "993034511d2e85ab59fea580ad0c2a4f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534563, "uuid": "732564cd-181c-41ec-8479-9c1ed2320df0", "comment": "Malware payload (Loki)", "value": "583810f9b255c471b1881133ca5d65efd3c96a389cf0f40461c40db3f7861355", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534563, "uuid": "a63a7d74-7672-4fda-aa89-722299fb1128", "comment": "Malware payload (Loki)", "value": "4e33a453744686594045cca00554f91a991bfe77", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534563, "uuid": "e9f12952-791a-4559-be70-263bd9aa6045", "comment": "Malware payload (Loki)", "value": "455932562987d07509c9be237b36797e7a98be9f6067c9e90a1d2ab5ef7ba74b97912a04213711e6efaa0408d71a5ba0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534563, "uuid": "880e268b-499d-438c-bcca-b7ba37cf1ee8", "value": "T197A402C472FACAA7D81A4BF41A28F5411371719799C5C7DD0EAA61C9AFE7F004E08A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534563, "uuid": "f9fd5206-e35f-4707-bc68-04dbc988b7e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534563, "uuid": "fcba17cb-e7d3-4f52-b5d5-c613c1858e1d", "value": "6144:ohI9CiefmhT19c0I6LwrUtC/bi2FinGok/bZjqAcW8YaGKWqrrOBqgOr9:iaQf6LoeSil21aW8YzK7gO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534563, "uuid": "e0c50b70-a011-46ab-9b3d-1be93883f5c7", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534563, "uuid": "749ef6fb-9be5-46d2-883c-e838f7c38a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534563, "uuid": "4ee41091-d786-4b3a-93ec-41dd5b17206d", "value": "DHL Express Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed0a34d-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Kovter)", "timestamp": 1683516469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516469, "uuid": "69e43b59-3354-4672-9c5f-d3b29308ae97", "comment": "Malware payload (Kovter)", "value": "bae33a656ec2563d6e1bfa8057ef1cc8", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516469, "uuid": "851575aa-66e5-4053-b435-fc510cd93dcc", "comment": "Malware payload (Kovter)", "value": "588e591670e9301f47fce1de443b666df3a79a200a364a108e24855bcdb7707f", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516469, "uuid": "7e13bdf1-06db-496b-abf8-411d74bfd624", "comment": "Malware payload (Kovter)", "value": "e65d547040da8ae1dd765f1a8feecd903e5cae52", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516469, "uuid": "22da28bf-2728-45eb-bfcf-499f660c9350", "comment": "Malware payload (Kovter)", "value": "3e717f7b1be65e1c7917d40e3b46c90d017bdc048e80d9135ef2b7e16687ab255089fac59e278833de59d6306cf5ad3d", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516469, "uuid": "86d674fc-3689-410b-9dd7-4c7203819f1a", "value": "T173944939FA80D537D42118BCCE0FD2E5A569F2342D381957B6E45F4C48F9683AE2BA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516469, "uuid": "b8d2c897-81dd-4b83-aaef-23ae96fd7471", "value": "6144:mE9yDzN5oqKVsJAC328uO6s1wQW877buWxjy/qIz+aA/F:tEDJ5ofs9BuOB1wQW87XuWxLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516469, "uuid": "2f9c3865-166a-4b51-8b13-c842671746c0", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516469, "uuid": "bd3be4ef-ec92-4078-b3d7-dd7ab84cc88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516469, "uuid": "ca38876f-4309-4966-9a1e-bd34a9638109", "value": "2023-05-07_bae33a656ec2563d6e1bfa8057ef1cc8_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597a1954-ed46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683512192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512192, "uuid": "65b8311b-16dd-42df-9399-f4f85dae2753", "comment": "Malware payload (DCRat)", "value": "f7d0e149bddca9ffb632c4bc87f30163", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512192, "uuid": "4dea0f3c-a2a4-4529-bef2-e5ce041a9b61", "comment": "Malware payload (DCRat)", "value": "58c06312c4b8a6e6e68873da9afe2a79a486e16a2d764f7268880ae27bf0d8be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512192, "uuid": "78ca3787-6945-4b8e-a69e-1b5225891ec7", "comment": "Malware payload (DCRat)", "value": "d5d2fe6bc68b267a9528d83d6b687295b281d0dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512192, "uuid": "fd7e8722-63b6-497f-a739-d371451326e1", "comment": "Malware payload (DCRat)", "value": "444288dfb9bbb251b6bca6d295397c61a2d03b4ae1d550a45713bef25a0931b32c7b287a2800b58edb3027b817fc4186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512192, "uuid": "ccf11a77-d897-486f-b6f8-90880f9756ca", "value": "T10676BF77B612CE68C0CAC570A19797B15B20BC1404B5A3077ADE372E6EB2B402E5D9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512192, "uuid": "aa2ccdbd-7792-4bc6-81b0-c6da7e4748b4", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512192, "uuid": "d6038346-f8e9-4b4b-9dc0-ff05b648481a", "value": "196608:qfzxcG5n/2lsE6DZiQlPjq/0zSPLIbymyPj:qfzxcYn/28DZiQhlz67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683512192, "uuid": "bdc554c2-2437-4f55-ae38-0831615cc531", "value": 7802507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683512192, "uuid": "fa5cf3f9-2336-4cde-80ad-6839694eefc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512192, "uuid": "1818bca7-7fc5-4520-864e-6b9ceaee296e", "value": "f7d0e149bddca9ffb632c4bc87f30163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4dca8-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683534526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534526, "uuid": "a97c0dd1-9a53-47c8-bad1-1e5a619a6474", "comment": "Malware payload (RemcosRAT)", "value": "4e5f6a63a6294b4a7a380b288556ac33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534526, "uuid": "249fa960-8af6-4961-8dd4-26952d1cd434", "comment": "Malware payload (RemcosRAT)", "value": "58fd0463cf7793ad6cbd0cd048369e70f01051c943a8655b97358065f4e2b0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534526, "uuid": "849963cb-3ce1-40c1-8779-1567031f1cbe", "comment": "Malware payload (RemcosRAT)", "value": "19fb49eca2c97f994491c56066718769ca90cc61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534526, "uuid": "78052cfd-8388-41f6-9391-34d02a9bad6e", "comment": "Malware payload (RemcosRAT)", "value": "537a939f871bb608ab5ebda343f10b835b3ce623179e5c3947b42c8e9ef9e46b0da8d98ae134a6842c523a461d0a430c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534526, "uuid": "273a2e6b-dd7d-4dbe-bcc1-f8f1601b877a", "value": "T17094DF567B816957C22C4735C8F68E11B372EF50AA42273F7254B7E13EF32E29E12126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534526, "uuid": "ad185bb1-015f-4de3-b686-00db4f4baa42", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534526, "uuid": "2344eee4-7d4b-478a-8aac-128c95ed4d9d", "value": "6144:gjSSJ0L5vyXIUqxM5wxsyzPHurmdIZOd006kUplHYLYPGXKYB:RU4KazHurUIgdv6kMWLYHYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534526, "uuid": "fbeb568d-41ba-430d-b77e-4b47c87f820d", "value": 409376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534526, "uuid": "84258905-925f-4e25-bb7d-78656e27afbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534526, "uuid": "a3109919-a7ad-4140-9c50-754cdecda1f1", "value": "HSBC Bank_MT 103 Payment_ Transfer Copy_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e1442c-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683534795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534795, "uuid": "6861aa1e-3c10-4e75-a46e-709c2a051461", "comment": "Malware payload (Rhadamanthys)", "value": "63ee18369c748d7e8e25c3eb6f230805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534795, "uuid": "6d2032c3-8f32-4386-b06d-168dfe0feac4", "comment": "Malware payload (Rhadamanthys)", "value": "5938a2e1c2cd918167c1e7f9e9797e039993c841408c1e4245d0bf8e9c3ca333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534795, "uuid": "3666fe2e-a5f6-4cea-8982-03005ce3a95a", "comment": "Malware payload (Rhadamanthys)", "value": "29d1a21ec486b9a582b4970b205ee5eafd2f8dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534795, "uuid": "ab81f71b-c447-48ed-9a01-768df4410c21", "comment": "Malware payload (Rhadamanthys)", "value": "1dc4a77420d3184392e414d793efffaa414ff444ca5c6044ff26ba8f1bb7346bb6e407bb5d373315038b04aa5b5db98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534795, "uuid": "1f8e4824-7c79-4507-92f0-ed1b798998f5", "value": "T11C843B0382E1FDC5EA254B729E1FC6E8769EF2508F59776A12389A1F84B01B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534795, "uuid": "f02fdd27-2de3-4f48-bfdf-6e03a26d0689", "value": "e0ad233aaf9ebf0d2e326ac5df912cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534795, "uuid": "ac099241-69ff-4863-8df3-a7eeeb960a62", "value": "6144:Fz4abAnLZGcEx/8wvMooxHJdjrCaqDQ4OoYXvOo/rqm:FbWbEx/87ooxHLPLaQ4OoYfOoTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534795, "uuid": "9be085d4-70a7-46aa-b796-295d4a4dd912", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534795, "uuid": "52d763de-85a8-453c-95cd-48f6eb52eacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534795, "uuid": "c0d53cef-3062-4564-992f-dd86cd27d33c", "value": "63ee18369c748d7e8e25c3eb6f230805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7976143-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683535220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535220, "uuid": "f868c94f-83b7-4257-8bad-7305b7a7232b", "comment": "Malware payload (RedLineStealer)", "value": "a600d75df5460b1af2a0dddf25447b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535220, "uuid": "09695c60-717d-48d7-a317-a8017cdffd10", "comment": "Malware payload (RedLineStealer)", "value": "59b3199a56df925054079872734e8750806580e6d0d98ef6e77ed9e9932abc03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535220, "uuid": "afeb5799-9a9e-4bb7-9f87-3a5885658ea0", "comment": "Malware payload (RedLineStealer)", "value": "275b278495c065910ef72c66b44d30d13877761b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535220, "uuid": "f40df3a3-997a-493d-8006-7b87a16d6c6e", "comment": "Malware payload (RedLineStealer)", "value": "a4bb0cf6ec790d0ff83ebef9da692d525e77e144b657802933c88fa90cc40692312e1dc4d860c3e790f9071b6cf21489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535220, "uuid": "7681a47e-4bda-4b9a-b365-1502f4cf0704", "value": "T1ED546D1276E0A861E6224B32CE1AC6F4669EFC91DFD577DB324CAB1F0A701E1D572702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535220, "uuid": "3b1e089b-fef3-41d3-b797-858f048154f3", "value": "d5316530de8caf207058f054d9fc1dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535220, "uuid": "da2e4af1-345e-419b-997a-ca2f767d9242", "value": "3072:gUgkk8FSCz7Qp9AL89ySk+dVDRiSOI1PwprKD7cdbc1knu7OW/GVxWmySc/Hrq:0ozkMKyP8sHIkgOW/GVAzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535220, "uuid": "67445e4c-6fa5-4c49-b460-63772d2044ae", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535220, "uuid": "50c93707-06db-4fc1-972a-a41734d8c797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535220, "uuid": "3eab7e1d-d0df-4020-b574-de97eb6fa5e1", "value": "a600d75df5460b1af2a0dddf25447b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a8ff62-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683551087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551087, "uuid": "bc3cdb65-2e19-493f-9ed8-f0680df87e4d", "comment": "Malware payload (RemcosRAT)", "value": "a102dabe3c5432051e1048f32e19dea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551087, "uuid": "c67ef894-7c58-439c-b0f5-9abc586ce7d1", "comment": "Malware payload (RemcosRAT)", "value": "59d9df7e128711ba9e34b6a6cac31cd50e25c5e350849abfc1b53e8c25854719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551087, "uuid": "95418f3a-2e44-4779-8df0-4c7f1497a586", "comment": "Malware payload (RemcosRAT)", "value": "e5a6e962c24db4dab23f331c9b07b9c619f24154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551087, "uuid": "a75fef09-225f-42f6-ba40-23a57ef092a1", "comment": "Malware payload (RemcosRAT)", "value": "1105fbec42ff8eae661a47ab543ba2462523eec200534af1e053a81b7ae78b054c8be9111041fddd3ea91cfa23dffb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551087, "uuid": "99fae8d0-9643-4be7-b0e4-576c0113f73d", "value": "T1A815125533F58F65E97647F02538F88403B234A768F0DB580ED921C92EE6F102AA6B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551087, "uuid": "c0ffa651-81da-4471-b6d2-11ec93ea2ffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551087, "uuid": "e653c0d3-88da-495b-99dd-178432a05c02", "value": "24576:Cdxzh/LFczgvHEotH8JjKpQyW0J4ht/dCml:I/xBvjtHSjahJ4hXCml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551087, "uuid": "75b01566-2538-49d9-86b9-a323b634f6de", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551087, "uuid": "a80f632b-f352-4f1e-8c51-f4f90b03e7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551087, "uuid": "e8057131-da34-4ed2-a13e-a5988e936b0e", "value": "a102dabe3c5432051e1048f32e19dea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c670f672-ed44-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683511516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511516, "uuid": "32aa6319-160a-445a-b3ec-bedf0a73a5e4", "comment": "Malware payload", "value": "ccba4247e679b42b4210a8faa85013c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511516, "uuid": "08b45288-9ab2-4f71-8209-0b1802eab54c", "comment": "Malware payload", "value": "5af6d34684bb9d39f25626ebe24cfcd9ffecc232b3e8bc4be6de0cd7a3b3f138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511516, "uuid": "6e1fb12b-9ec8-4b9c-896f-d166b3aa063a", "comment": "Malware payload", "value": "3e154b7e8a0932a83a2e33005ae2b1de74b2ca42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511516, "uuid": "611ecdf5-9798-4c59-a717-d78b48a5863a", "comment": "Malware payload", "value": "f92f9e9d03f3dcc0be3c08b17530a62364b09b57056594d1f6f360824ffd1d9d5c3e95c8f3adf2075b3d4a1b5e4726fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511516, "uuid": "a43550bf-8762-44f7-8b7e-81883e893cf7", "value": "T19FD47D1E63AC42F8E1A7D138C58A4612F7757816533247AF43F5866A2F2B6B05F3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511516, "uuid": "9cfde3ca-d555-4fe8-91cf-fbe534d4ce14", "value": "285d342011c02dea92adf9fdaf007cae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511516, "uuid": "5a700cfa-2dba-4528-ac1a-29654fa5eea5", "value": "12288:6RUW/cZgRn7d0A1fwR108twZVCrvg7yseR9HURHBO8BaAgeDsP0TGP9Poq1jn4gR:WUWk9mITDeDsP2G13jnlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683511516, "uuid": "d13034a9-1c72-4e29-af5e-7c5e713b86d4", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683511516, "uuid": "6ac16118-d19b-4556-9650-38db86fd2a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511516, "uuid": "07193277-02df-44ab-a311-f08ba6a1c4a5", "value": "8534277437186_670601511282854_Piracicaba\u00ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63025441-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565895, "uuid": "bd5b9fbd-22a2-48d9-8924-ff96f79e0631", "comment": "Malware payload (Mirai)", "value": "79fa35fd863918e07234946d168c303a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565895, "uuid": "d0904a17-3f7b-4e24-af6a-0b2c5292c232", "comment": "Malware payload (Mirai)", "value": "5bcbc739a4ef555025c9dff21e2159e2ee419cc19261133d162625a790abb4e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565895, "uuid": "c0c2284d-fe0a-458c-af3b-7e25a9bc7ae6", "comment": "Malware payload (Mirai)", "value": "5bfb0a26eb26ed62548d1a1e8f5104617792c23f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565895, "uuid": "78863ab1-581d-407d-adef-e578a5573e64", "comment": "Malware payload (Mirai)", "value": "ab99535ffa0cd250eaeaa83a8643ae79fdde17e82ba45cc187e8ee5cbcdbe152ff05c8fcb5a183fb6794e13f945d60e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565895, "uuid": "5c59a0ed-48a1-4420-b88d-2fa2606ad271", "value": "T17933F22295326CD64B3508B4FF9C11BF2E2B47FC915BB8B28710066C7FA641222F55E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565895, "uuid": "2220a5d8-a5cd-4f4e-8dda-7d0f93fb3675", "value": "1536:1a8ZqK2kfJzQA37UsEiz6ILYwKeokllDi6:1HqK2kfX3jEIJLjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565895, "uuid": "432d13bf-cf1b-4b63-b370-e1e230718af9", "value": 51976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565895, "uuid": "b808e37b-8c00-4226-abe1-1449e4bfed47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565895, "uuid": "823112de-42d3-4776-81e7-5b18bcd787f8", "value": "79fa35fd863918e07234946d168c303a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5e37d9-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530293, "uuid": "9d8f3742-f47e-4777-a250-594f1b4929b2", "comment": "Malware payload (Mirai)", "value": "8b00b918c9a7689a4e3ff12be92b6a9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530293, "uuid": "99bf3458-c9e7-4935-a5b5-8e62b24d1d95", "comment": "Malware payload (Mirai)", "value": "5cca5acac331e08f1bf033d6360be4385c9f2d455ff17fb8f6ebdd319b86fdd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530293, "uuid": "26ab1ca3-a560-429e-8dc5-aaf4ed3e6864", "comment": "Malware payload (Mirai)", "value": "7e0adb124c1cc4446d71f8f160a1fdf169454e90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530293, "uuid": "1f2869ff-c71e-40d4-abcb-9f5bb4a92f95", "comment": "Malware payload (Mirai)", "value": "1a140d502d7bcb7facced75eb98caa03cdd877b934ebef7ea3df193b7072ff0a59d39d66b39ffb925375908996f65fb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530293, "uuid": "68406a69-2437-4209-9d67-990b498b77c6", "value": "T14B433AE6B400DFBEFC0DEBB6A1174906F162E25485420A3267F7ECA79C731B01966F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530293, "uuid": "c69d4510-df5b-405f-89e3-8a744aa32ae7", "value": "1536:BNTgJne3fq11mf3TBPJT88klsyDqr4PA5Gvc:BaAfrTBB8BqrkKIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530293, "uuid": "3f220068-4057-46ae-b360-7a1328fb9b43", "value": 56412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530293, "uuid": "8471d477-33a7-46df-9374-011770615061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530293, "uuid": "1f086947-84df-409b-8819-e221cac3beeb", "value": "Andoryu.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c232fcb-ed7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LunaLogger)", "timestamp": 1683535899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535899, "uuid": "c917602d-7da4-4fe7-959f-22d2a45e16a7", "comment": "Malware payload (LunaLogger)", "value": "69c6478871f8384f298e4379ac0999bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535899, "uuid": "e3d5cf2d-2c72-491f-b0db-14e40331a904", "comment": "Malware payload (LunaLogger)", "value": "5d17781561881f8c412498515db843561d6a8971009431f390de99b3a46ec4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535899, "uuid": "163ecb79-e9ec-4ec1-a35c-775295107004", "comment": "Malware payload (LunaLogger)", "value": "f5b6fd7301a954acfb2b72a3f7bed08d8c24450b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535899, "uuid": "809dbe66-9ed8-4776-aba0-ea6ecdfaaf88", "comment": "Malware payload (LunaLogger)", "value": "b17772ebe18d3b7b3abb33d8adf9db5f07cf42935ce39ceb7f1b5e5af6358ecd6f8d98e28deb6e418132879c6db4ce8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LunaLogger", "colour": "#B0DCF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535899, "uuid": "d99e0fa8-241f-4d43-bfad-40feb2793fdb", "value": "T1276733971A6209E3D2F123388045D374C732EE951A65C74B46F9AD4BBED37429C3AFA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535899, "uuid": "21b6c1ad-17b2-45da-b691-fea363a1e79a", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535899, "uuid": "94b66e2e-5214-4d6a-a503-8157ff67b46d", "value": "393216:FxAlnnafrVzeeuXK9Q+MMIBvPzHI86vic44OsH:QlnCMtK9QTMsPLIMwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535899, "uuid": "aff7cda3-444c-41b7-858c-ab1be4439d28", "value": 30583977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535899, "uuid": "5a866dce-21a9-4cd4-8991-c4bae433be87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535899, "uuid": "822cb301-19ee-4c48-8202-635c576773f9", "value": "Lunatic V1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d326d2e-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683535069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535069, "uuid": "5e733f70-5696-4901-a176-052f1c2bbae1", "comment": "Malware payload (Rhadamanthys)", "value": "03e6b4753886d54474357f55b0930181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535069, "uuid": "4f6eac96-b486-442e-8a87-faf4d4f2a073", "comment": "Malware payload (Rhadamanthys)", "value": "5d19773133777f71070defab8ca8292254cd3db52dea5617868c336fc9316966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535069, "uuid": "efe4b481-984a-4694-a75b-8070cb100747", "comment": "Malware payload (Rhadamanthys)", "value": "c443aebc7cbf85018bc239320ebda651fc55c6c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535069, "uuid": "3a222935-6d13-4d71-915d-c9aa907d9154", "comment": "Malware payload (Rhadamanthys)", "value": "a0b1edc76fbf2b8c4e1d621a4f75a22bc628918d7ad6e109312c2b49fc701217f140cb68b4c4a4ceb61d1af28fb5e732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535069, "uuid": "1cde3f01-c96d-4af8-9ab6-f6347541618c", "value": "T180842B0392E13D54FB664B729E1FC6E8765EF2608F5A777A221D9A1F04B01B2C273724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535069, "uuid": "a62afbf2-1721-4184-803b-78c9dd7124f9", "value": "d69fc05a14cea9e3be0e4e4cd2aac7e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535069, "uuid": "98fe9a16-6eba-49c7-bfc2-c1ee5909c1f6", "value": "6144:daH3x3iLZK5cMIcLaMBkQhfy29vvDuqqH8U03x44sk+:dE34c5cF8kQhfyk88UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535069, "uuid": "267de95c-3760-4a0e-aa1c-6d04d8041634", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535069, "uuid": "dbec36bc-a664-45fb-94a7-d04afa23fbee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535069, "uuid": "98510a5f-7056-4747-afa4-5eb7fd62026c", "value": "03e6b4753886d54474357f55b0930181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595d165d-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683550417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550417, "uuid": "7ad3a85d-d321-4370-a364-9f4d83264f19", "comment": "Malware payload (GuLoader)", "value": "dc4b16b502951b382a32a12fadf3c1c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550417, "uuid": "a567600a-3ff1-441d-a0af-fa66f29cd836", "comment": "Malware payload (GuLoader)", "value": "5dfed8e51baefc0d5183e0a03b0bbcae5e72cf411c6db30bf1a8110d4ae34086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550417, "uuid": "616ed343-6093-43dc-8bb0-b8a432a372cf", "comment": "Malware payload (GuLoader)", "value": "fb8447d3a4c21399c20745d4f33484e86457a93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550417, "uuid": "3dd497e4-51b5-4e50-a2ee-6b0b8542bb88", "comment": "Malware payload (GuLoader)", "value": "b6f6546a2029499552f46d80da93b88f030a10a0e6646c5b08dcefa94acead06118c8c3a9bb080fc1508a8c56217d415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550417, "uuid": "f5c8ea03-d9cb-454d-8ae2-0c6d8ec39deb", "value": "T10AA4F103FA64C9D3F93808704962B56A17E46E2158E41E43FF967BAFF83E0567C1E618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550417, "uuid": "1d6d9267-437f-409b-9696-ee49ae159326", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550417, "uuid": "4ec729d6-359c-41dc-a07b-c0915e366da7", "value": "12288:kg7OvuaRnTb9+CsOOCUT6/VVgMTfTXn+0zCO:k3vpZ+OOCUT6dV1fb2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550417, "uuid": "6aa7b8fa-db83-4b78-a510-141246ac05eb", "value": 460559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550417, "uuid": "d191dce3-eea6-4772-b0aa-2a57796ba68d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550417, "uuid": "4a77f411-13b8-4a15-8715-a2d1152c7cfc", "value": "proforma invoice pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afda4a9f-ed6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683529517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529517, "uuid": "06685234-4e2e-46d0-b7f6-6e23b29aadfa", "comment": "Malware payload (Formbook)", "value": "d0dd81d880c7b5fa76a2bb9b37cf60ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529517, "uuid": "a79ca101-22e2-4277-bf99-0fa1aed184b2", "comment": "Malware payload (Formbook)", "value": "5e793a03ccf02064a081df03e0ec584ce32ae3582fc08f8bca88bc1a26c45e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529517, "uuid": "89f81a2f-baca-4256-9c1b-f1ae4f511c2c", "comment": "Malware payload (Formbook)", "value": "822fc83a924ef0f93f370d0917e2043156a77a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529517, "uuid": "a860e2dc-709a-467d-876a-29d9330f5fbd", "comment": "Malware payload (Formbook)", "value": "cad3a6f97bf715dcb888820337292613a87625174a2b3015587ddec9549a3aa5278d69fc7e5b8e6dbdf91dd227de7fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529517, "uuid": "cad5f556-db4b-441c-9992-d10a7874eee7", "value": "T1A6458D15BBE55612C0AF237564770328677AEC477206CB6BB45CB1E80FF2B088D25B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529517, "uuid": "d2f32929-b1af-4afd-8ef5-2ee93bd800a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529517, "uuid": "e9c83e87-0eac-4c5a-a0a4-929c00c5f818", "value": "12288:6gWJldCD9CSZk2A86Wrr1w45PQxy/n3pW5AB+eIMeIQgQng6RN/AOaXawOk:+xCD9CSK2A8Nrru405AexgQg6zGqwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529517, "uuid": "0b080a56-faa8-4f54-a4ac-299bb58b4e6b", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529517, "uuid": "1d2e0898-cf5a-49d0-b3df-d54fc155ad1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529517, "uuid": "a6aad5ab-e101-4b63-aac9-6080db78eba2", "value": "Urgent Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e64a033-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528521, "uuid": "243e4c25-d669-41ff-90b5-2a9c56921a51", "comment": "Malware payload (Mirai)", "value": "f871419b2958502ebf0f13d544b49872", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528521, "uuid": "afeb788a-82db-4143-9482-9503fda603e5", "comment": "Malware payload (Mirai)", "value": "5f1204a3d0ba95f0d099b953175e43b16ca0f5607aac7a3ce5d32d7680b6dc8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528521, "uuid": "483b5cf6-1b33-4470-8865-868915128568", "comment": "Malware payload (Mirai)", "value": "8f6c9ae6b01d6c3779617c1721f8fbf2aa063661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528521, "uuid": "40ad747a-b47f-4b3c-bfea-57132eb24750", "comment": "Malware payload (Mirai)", "value": "4064cc698e7e83b2900b243ad4a6d6b4369863f4fd1ea5267150b36f60767318e2fd4b58a8707388819ce5a55d5cf085", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528521, "uuid": "7852ff98-47ae-4fa6-847e-449f1099ab4e", "value": "T18A03F751BC829A37C2E1137AB6AE4A8D336163E8D2CF7217DD214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528521, "uuid": "b1fdfb36-1c33-47db-929a-14f2f425a839", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTP/NMwWX:AfWb8G5fblUlfbgeaUv+fEoHWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528521, "uuid": "51fa829e-7736-48a6-9f04-1008e25778d4", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528521, "uuid": "5cc0674e-e1d1-4c66-9bdf-443211010661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528521, "uuid": "1409939d-4482-49ba-b136-ca15b6ea112a", "value": "f871419b2958502ebf0f13d544b49872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553d3d8e-edb0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (a310Logger)", "timestamp": 1683557711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557711, "uuid": "8c48d9a7-269f-4987-b915-1516200d885e", "comment": "Malware payload (a310Logger)", "value": "6194f48fb37a6bb1ba0908abc6b1a537", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557711, "uuid": "6a601b62-1613-4128-b8ec-78c7ec9ca580", "comment": "Malware payload (a310Logger)", "value": "5f323f12b134d9f8718282eeb8d8423c9a6f123545cb8fb4ca3a38b6f8092af1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557711, "uuid": "228286a8-886b-4a73-ac7d-83cce5eb8f7d", "comment": "Malware payload (a310Logger)", "value": "0e80a10e34ca8b23e568f871bdc0eef8f1fe63f2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683557711, "uuid": "83e5ca66-23b0-4b98-b9ee-0642d8eef503", "comment": "Malware payload (a310Logger)", "value": "d52df026e0a17446a7f39544e6c0e539a187dcd45d8c86425b75ffc6e38c15a719c68e155a5f4714a365bb7be070a900", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557711, "uuid": "c5e01c3e-dfc7-411e-a96e-6747c032a8c7", "value": "T1B565238262A9CF60DA3A4BF00539B44113F634D349F4D5581EF2A1CE69EAF506ED4B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557711, "uuid": "8e278e0e-650c-4e87-b476-bef3759c22e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557711, "uuid": "eff4cf3b-2463-46e9-9303-c77dc390dcfb", "value": "24576:m9WFfD+P2kVORHUvU/C88Cx+DDs9hmt9EwONE+D3APRgbUTfNugzT:+U4C4Cx+DQU9EwqTAPRgbfYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683557711, "uuid": "c101a88a-38df-4c9e-b051-41796e10cb02", "value": 1442816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683557711, "uuid": "3322c952-694b-4b0f-a75e-abfd6419cd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683557711, "uuid": "2af7139e-c862-4dac-b084-657c931361dc", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07f3452-ed94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683545812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545812, "uuid": "940afb48-94bb-4b97-b997-5934b97fdcf3", "comment": "Malware payload (RedLineStealer)", "value": "1de36ea7bbefa6cf323ea6334924fc5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545812, "uuid": "fadc0a5d-58e2-4cfd-b57f-1cfc65b0621a", "comment": "Malware payload (RedLineStealer)", "value": "612ece4f1edfa547cb2c224d9018245e3d4407ee587e00c648e80358e0349493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545812, "uuid": "e2f035f5-1c24-4890-8b47-73fb5f4e1b25", "comment": "Malware payload (RedLineStealer)", "value": "707f6f80ea4ae8750ed6f29d3b0418db88870b6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545812, "uuid": "9d6303e4-2a29-4758-b532-598d3d6410a6", "comment": "Malware payload (RedLineStealer)", "value": "8620667130a3d9527879ea465f2172100dc5b1843901e67ddcecaa44fe93de0fa574a5ea491f3993fe02b216e0f77a7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545812, "uuid": "c10f2db2-d993-4c1d-8e06-e6f320b54080", "value": "T12DA41256F7E49072E9B517704CF703831E39BCA29E78836F274899592C72994B87232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545812, "uuid": "846d1dd9-9d6f-418b-9292-cfee7ae0bb8c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545812, "uuid": "fd8d26f7-91cc-48e3-b717-3303f2205d7e", "value": "12288:lMrDy90owqwMhr4btk//o9pT7R0jqQuL/e3JeTBr:yy/lTr4be/o9pT7RQqQu6qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683545812, "uuid": "c6096519-bc7f-4083-b20f-11cb2723e0ab", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683545812, "uuid": "a2081907-cb13-4dc1-8d91-d3d1c4a26a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545812, "uuid": "5a256a45-362e-45fe-b922-3f2db9b1a620", "value": "1de36ea7bbefa6cf323ea6334924fc5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7dd975-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528571, "uuid": "4df5859e-7f89-4743-a01b-476f2b94c00b", "comment": "Malware payload (Mirai)", "value": "84db382c577d92deb846f1ee0b24041e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528571, "uuid": "9f17568d-0ffa-4c1a-80d6-441903daeb6c", "comment": "Malware payload (Mirai)", "value": "6172fca55f1ed866adf6a6d0728ac286f48be3880ca9a54438628215a18e6f37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528571, "uuid": "775b84f0-bd06-4c67-9fb3-54c6518a9a4e", "comment": "Malware payload (Mirai)", "value": "71a1cc365494f0d5966839f715da4162dbd40c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528571, "uuid": "0b372bd4-351a-4339-945a-3442e8b3af6a", "comment": "Malware payload (Mirai)", "value": "becd5547a844c422d050d1bb86fdb5a04732863de259cc78c02f9a2acb6a201dffb0dbe7f36ec6c82f4c96d3cf62480f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528571, "uuid": "3c432942-f943-4276-af3f-7893dbdd0bef", "value": "T10C534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9671E365182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528571, "uuid": "7aeb5109-dc63-4198-be4e-00ea7a6bc88f", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EM22/p9OyDQvSFRMNYL6FV+tg6wWy:+5HAdOmGyNtTAd7OyUaFRMNae+aTWDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528571, "uuid": "3b3de641-5a76-4b29-9d27-4bcd5a8a3980", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528571, "uuid": "caeeee57-00de-4760-b6e6-d9994ce858da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528571, "uuid": "d393bfc6-c7f0-4837-a55b-adb7dc73a1a2", "value": "84db382c577d92deb846f1ee0b24041e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d645d7-ed4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683514142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683514142, "uuid": "a76cd3e6-9ec5-412b-93cf-66567dd6cb23", "comment": "Malware payload (CoinMiner)", "value": "519a4bd72f7bc8a67c137c34d411b5be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683514142, "uuid": "e65a3b22-58cb-4225-9875-9f73e9e93df2", "comment": "Malware payload (CoinMiner)", "value": "61df65948553b5e1e385bcfa866cae9a30ace0e427ab57e455985988d30eee20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683514142, "uuid": "bf208976-3ab3-4201-a2dd-c0c7b1a0db32", "comment": "Malware payload (CoinMiner)", "value": "37ca60f3bf1a4d7068cd19b1e3e9cf69afa269dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683514142, "uuid": "55e4d4e9-b2bc-4409-85c4-ea574257fe80", "comment": "Malware payload (CoinMiner)", "value": "d907477844be2458d653d183ac47775f5f335109ff231fb1c32cd94cfd69b527327e793cb6b5ca3744d28726fec62c0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683514142, "uuid": "0ceaeb08-bbb9-4c95-86ed-a4b6907be7b2", "value": "T11364194392E1FDC5EA268B728F1FC6E8769EF2508F59776A121C9A1F44B00B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683514142, "uuid": "d5d785bc-70a4-4989-92c6-b8590dac5761", "value": "09ad811c7b24c560499d47bd7c66a41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683514142, "uuid": "e1d85c3f-ec80-41d4-b25c-2040d7f69aa3", "value": "3072:hpX6/jiqnsLTpqy0ZXRtmYoGLA5///Px8S5gJXga5MydPAv7wqqTM:T6/jXsLT4y0ZXRtmUA5HXx150wa87a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683514142, "uuid": "c9ae2271-0328-4118-9cb2-7289402c1067", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683514142, "uuid": "c84f86cf-af3f-4b81-bb03-78312983a43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683514142, "uuid": "cb4ae56c-c0fa-4ccc-bfe0-65565c87897e", "value": "519a4bd72f7bc8a67c137c34d411b5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cd179d-ed83-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683538524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683538524, "uuid": "4bd4fdc7-17fb-4d7c-ac9a-664a90f28ecb", "comment": "Malware payload (SnakeKeylogger)", "value": "e903ccc82511fbeff34f78236cb81609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683538524, "uuid": "0ba6a0ff-be3f-4a1b-8d76-93b5a17a9bdb", "comment": "Malware payload (SnakeKeylogger)", "value": "627a8e84326a097362789f0fa864cbb4b2bbbdd8b888c3ee1b180a9a345b14e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683538524, "uuid": "aa72f090-d8ac-42fc-be07-240d59120e21", "comment": "Malware payload (SnakeKeylogger)", "value": "2a923b1db95f1e2aab06184d39b8d763dd4589cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683538524, "uuid": "938a71b1-8341-40be-8539-1bab1ecbee92", "comment": "Malware payload (SnakeKeylogger)", "value": "ff4672286dd73a966d61c30371c54d2ecda58da25dd136c692df50f68ee9807684e2ab6ca8556479651679abde0720ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683538524, "uuid": "d433a0e3-d10f-4412-934b-2dc77bf847e5", "value": "T1C8E4C0D521BA8B92E03F87F00478B45413F631AB69FEDF120F9670C95D99B102E89A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683538524, "uuid": "c61a8a13-e7ab-407d-8a3f-271e1e3e76de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683538524, "uuid": "051a77b3-07f3-47a6-b87c-9149f787a677", "value": "12288:x6ni4IyM75X9I+pA9yyO9aWt/jOaoVVtUJ9MziHHjGw:x6U7V9YLO9aw/KawVtZziHHjGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683538524, "uuid": "695a17a5-5c55-4777-91a3-c5af029346c0", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683538524, "uuid": "c6c122b2-9e4b-4217-ac9b-6ae76223a6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683538524, "uuid": "d839027e-f697-4fae-a3c3-980ea98ff91d", "value": "comprovativo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce3ed01-ed6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1683528277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528277, "uuid": "b8b8a6ff-5298-4766-8819-919454d55a8f", "comment": "Malware payload (Tofsee)", "value": "b7c137a18093f43fa0ac50865cc34f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528277, "uuid": "a7e7d407-4446-4295-b76d-dd80d365adaf", "comment": "Malware payload (Tofsee)", "value": "63e235b92d97d6c3d5a5dca42f31279b674d3140affc1e26c5971d12fc1d7667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528277, "uuid": "beacf4c0-710e-4d6e-ae83-a1217447fc87", "comment": "Malware payload (Tofsee)", "value": "93727de39d92f6934d4ddee26728b207a212428e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528277, "uuid": "fc2d23d6-56e9-49b7-b4df-a929a727e0a3", "comment": "Malware payload (Tofsee)", "value": "afcd90165db0f8a27435292f6e3784459273a71d2ee00da483fcf16556e3ec089ecd412a88bf714699472a3a3f2f9e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528277, "uuid": "aec22b68-e1e6-426a-94f0-faf6f53a9de9", "value": "T113546C12F2E19871D5130A3E8E1AC6F4661EFCA09F55E6FB224C6A2F0AF01E1D572752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528277, "uuid": "22533d5d-ed8f-473e-a68f-41eb551a44c6", "value": "d5316530de8caf207058f054d9fc1dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528277, "uuid": "7f327c90-eef7-4346-bea1-822212b73397", "value": "3072:/UgGk8D2CKiH+U3XmE5kDOXkqVDE/zpUp+rqdyy76kgREiwUP7A6qVxWm5iT/Hrq:Ret/X/GDwpELm04B710Ej2qVA8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528277, "uuid": "026c8c89-f3d9-47c3-a33c-b4adbb80fd20", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528277, "uuid": "2f8c1bc7-1d9f-4703-bb36-a842a3126489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528277, "uuid": "02f7c212-5261-4a35-85f7-3b4bacb9a16b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af156cf-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683516462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516462, "uuid": "ab4be083-f998-4dd9-a737-d77f20abbb2b", "comment": "Malware payload (GandCrab)", "value": "67a42d22d97467e277d0027913cb9b8a", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516462, "uuid": "86e10fb1-c3ad-4def-b755-65c32ef53d32", "comment": "Malware payload (GandCrab)", "value": "63ead7101148bab37e009da2b9969da6afcf47fffef3c2e09382ca17e0162015", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516462, "uuid": "a0f5dc8d-ad40-47bd-8b61-8b644438bd3e", "comment": "Malware payload (GandCrab)", "value": "642356efe91a9128459389afd8edd991a41dc783", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516462, "uuid": "c1290d13-7bf4-42d5-a161-187338bf4963", "comment": "Malware payload (GandCrab)", "value": "0e9eda4a4de9ce1dcf2626ac8963e0035894dedf47ad7ec451dddc722fd66287b3cdd7c0ee8d531f07b38f659696e5d5", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516462, "uuid": "926972ac-fed1-47f5-8cdd-7fe9c97f3551", "value": "T181F68D19B1D1A0B2E4F34576D5B4AF11442DFC211BB07CDBB2E62A9E19320E39E39B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516462, "uuid": "aa12a269-ed19-45a5-aa6f-2da9d43d6c8f", "value": "3072:S5K/B0toLOSNJslxwsx89TSdBgjMqqDL2/TOK21Gl:ScytwbTTTSdBgQqqDL6SKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516462, "uuid": "3f628d71-7770-4769-8447-8e566ea81a9a", "value": 16777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516462, "uuid": "4b4bacc2-dcc5-467e-a959-b56a182d16a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516462, "uuid": "933956d3-8476-4e34-a908-dc28203e9961", "value": "2023-05-07_67a42d22d97467e277d0027913cb9b8a_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6498e504-ed5b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683521230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521230, "uuid": "ae348334-a571-4c9f-bef0-701d24b8920f", "comment": "Malware payload (RedLineStealer)", "value": "6f33cee4a80c10629b381a27e2cd4c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521230, "uuid": "6ddd90cf-9182-4649-9c29-739d1a23bf8e", "comment": "Malware payload (RedLineStealer)", "value": "63fa3c9886f2ecbfa8c4cd602e3862884d49f63e5c72d5e36314f5b1945bd18e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521230, "uuid": "4c2cdb50-0623-4614-88c8-01ed18e53ddf", "comment": "Malware payload (RedLineStealer)", "value": "2e2b1aff25bc95d4c66da23ae8d46e5cfd888afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521230, "uuid": "04a3dd90-9c9a-4c52-8ee2-2cd213927f68", "comment": "Malware payload (RedLineStealer)", "value": "c40f6e08d5cb0a8f478395621774943e87766a7f454d6a80ce7f9be13fdcf98b512438809f8c243743de9d0ea238f82f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521230, "uuid": "5396f6d5-b177-42db-8656-e679b4a61d94", "value": "T1DCF3E668364B667EC96F883E9C600CD076BCAC561242A7479D8FF0E8793B7919F150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521230, "uuid": "43e5dd5d-90bc-48ee-bdb1-8a4971e66f27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521230, "uuid": "bea5d2b6-4d07-42b1-8c6e-0cdab2dc14cd", "value": "1536:hcKy3rBJqlVZRGWYdzrDtBg4Pk175BuD47TGqVWbuX01x+1N1V4183wYkU8e8hu:zA9DjsNkbqViT141N1V41S8e8hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683521230, "uuid": "a9f666fe-ce8f-4fd5-9b2a-aa569f0a19f3", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683521230, "uuid": "e31a7938-dba7-43bf-b554-df186d52d18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521230, "uuid": "432d2ccc-e749-4934-9d4f-b728726e99e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d956d14-ed3d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683508306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508306, "uuid": "bb7f00f1-d494-4324-baad-2e4b05f3044f", "comment": "Malware payload (RedLineStealer)", "value": "c234447fa42ba021cc57d291a3666b7b", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508306, "uuid": "92403d7d-cdc2-40a0-9ad2-aa6f6385c57c", "comment": "Malware payload (RedLineStealer)", "value": "643fd58fba5c15957f9414e9e82cc2cae0756b924e89740fe4d402dc0cab8912", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508306, "uuid": "aefa202e-7513-4e35-bbf9-d4233d7bbdd2", "comment": "Malware payload (RedLineStealer)", "value": "55b91416f6da06cb9d66029c82335ea2a4b4890a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508306, "uuid": "bc131be5-65f2-4923-b128-fab8e126bbd1", "comment": "Malware payload (RedLineStealer)", "value": "6a33b9267e980b65b10fe8c7a7426741756aae19645eb8d73b42d0409d953a70229b818d0a453c77cc36533e57b6d4b3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508306, "uuid": "0210cabd-48ff-42e1-b6bc-4c34a8cc30b5", "value": "T11354F6743B5893EF40D6F144DA27E82C3F613E7E9918B6EAF3D25BCB4698854E812530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508306, "uuid": "f655ccd8-38c2-4737-b17f-e41a0f4739f3", "value": "3072:JrHGl69CuPWbP80xHGD27XC22NJa155YYpKCmF1EXsr70xj0ptXdvkjR3jDcd:JrHq/pQGXC2iM5zpKDYssittvk93jgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683508306, "uuid": "2bbf2a49-70ca-48f9-aed7-84881a18bdf7", "value": 279660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683508306, "uuid": "f93c8a00-f50a-4c5f-938e-7a4bf1c46c71", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508306, "uuid": "3b8696d2-9591-45ce-9d0b-827e4f10f3b1", "value": "Video presentation of the sewing machine.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a5d2a2-eddb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683576320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576320, "uuid": "15e63340-f995-48a9-834b-fe576c91b8a4", "comment": "Malware payload (njrat)", "value": "0ec8c3c2398d384e8f53ce811a488b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576320, "uuid": "b4f62dc9-ec62-46eb-8981-d375bc74c19d", "comment": "Malware payload (njrat)", "value": "644e22017e7ea1528dca300ff5efc8a07f8587b3b15ea079ea0b9b205b0b4d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576320, "uuid": "83188c63-f2a7-4baf-a2fe-e8da258b51eb", "comment": "Malware payload (njrat)", "value": "6de36a097b8d734bf242a22efb0f64fc433b87cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576320, "uuid": "0ca044a4-72f4-4cf1-bd14-da5b6db479e4", "comment": "Malware payload (njrat)", "value": "76edb5d1d41059d811c94700da1c4fa8558e76d3429812df59fe9fd0d1abe828191d43c282f428fcac8e6ace162b1812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576320, "uuid": "f71df5a4-c7eb-4d8f-9775-15d1b2a1bbd7", "value": "T1ED94F717339A6A1AC23E233A59F76410C3F69C138732E79E3F6024FC052659BDF66646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576320, "uuid": "e6d040d7-4512-4c2d-b92b-31b85d6a22a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576320, "uuid": "11dff2a8-3716-459a-9507-c80dc6e6be19", "value": "6144:GvuswBr11L2Ji69aOZjYqnKhTuo7Ebr9bH30+lDPt:GvuxnOo4brxH30iDPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683576320, "uuid": "eca9a5da-3489-450c-aae0-1de0a4bd4f87", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683576320, "uuid": "7c1de3b0-fea6-4bc7-b3a1-a12f6707d115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576320, "uuid": "5f0713bf-a4da-4bfe-afbf-f7a93dfa930d", "value": "0ec8c3c2398d384e8f53ce811a488b49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dc991e-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528532, "uuid": "0ee5d3d4-4306-4234-b238-c3ce09f24e6a", "comment": "Malware payload (Mirai)", "value": "2657084e82e48518beb159f90fc230a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528532, "uuid": "60f1b07d-90d7-4da5-9566-72d781a633e4", "comment": "Malware payload (Mirai)", "value": "648098e9cff59b6d50f97324621ad2120cba039ba72b2d00d7462d2fd3156a27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528532, "uuid": "a60bcf5f-7c7f-45e7-8894-7056d60a0465", "comment": "Malware payload (Mirai)", "value": "503247102703a31e4820b070c333d0c782aa9a96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528532, "uuid": "f1e9317f-9724-4579-920a-dc83c49ed940", "comment": "Malware payload (Mirai)", "value": "46fc2e4f07641065f6e01f7700e3f637d26e5c67954638e486c434d9da995deaf717b7215e406726f13fdd992c4803ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528532, "uuid": "c566b7f7-105e-4c21-9260-78a9b4853a9d", "value": "T18D83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528532, "uuid": "bf3f4192-4cbb-44cc-81ae-8ce338b2cc3b", "value": "1536:iVLyu95KMUkj752dCexuV/8UZlDwfkJ4MYfW6:iVLyMgOFezxu5VD1eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528532, "uuid": "226ead13-e501-45f9-ac32-3b5a6aaf18de", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528532, "uuid": "0e5fd521-44a0-4620-ade1-71da821e090e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528532, "uuid": "3f540044-4ae7-4595-ad84-0cca6422a747", "value": "2657084e82e48518beb159f90fc230a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f65181-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565868, "uuid": "4ae0c2c3-33aa-40a8-957e-9a4a738fd652", "comment": "Malware payload (Gafgyt)", "value": "12c26af8392c86dc4fec416b9eab3162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565868, "uuid": "764ca7ea-d984-460d-9b66-91e9af3abab5", "comment": "Malware payload (Gafgyt)", "value": "649592adca3e5101328d9aa423c115f68640f044d268839d4488e930c9b4296c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565868, "uuid": "ad700a65-1065-4805-9e2e-ba4df81c8636", "comment": "Malware payload (Gafgyt)", "value": "76c898f3975cf7280916d7ffb12cc5ded0cd2ba3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565868, "uuid": "717b13ba-4ace-4a34-bac6-488809e9ea6b", "comment": "Malware payload (Gafgyt)", "value": "29b1df9df0b71ee27964873c65d78bd01139b6d05e8e755fae3900de306dc7934073c2e768bcc624a7bfdf4d30078283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565868, "uuid": "1b7f8c4e-0392-4da5-a05e-8cbec16e6a0f", "value": "T1CBC30904F901875BC3E227BAE78E038C77355E6457DB33156A38BDB42BE1B982D29230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565868, "uuid": "93baf37e-b10d-46d6-afc1-93f1fa427272", "value": "3072:TGGhNnu3jGOEHgsRqI53bhISOMmyVUQuiXfQd6W:/ruxEAcqI53pmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565868, "uuid": "6152120e-44a0-4038-abee-9d13386dac9e", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565868, "uuid": "a282f1a4-432f-458f-80c0-b3b2389d1a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565868, "uuid": "fbd38674-0ac0-4e10-8992-d654b0f41bbf", "value": "12c26af8392c86dc4fec416b9eab3162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f4b4cd-ed56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683518917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518917, "uuid": "1ec1d4c0-1bb2-4e3e-a225-0abd3ad52d64", "comment": "Malware payload (RedLineStealer)", "value": "55c469115eef57026c69978e62171202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518917, "uuid": "9692badc-65eb-4df8-88c7-b402ca00bd3a", "comment": "Malware payload (RedLineStealer)", "value": "64b5040a080b628c06eb5cf86e410cdf54b8000498d1765a309c7b3a7dcfce5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518917, "uuid": "8246c56e-0044-4673-8548-2c56853da35b", "comment": "Malware payload (RedLineStealer)", "value": "83eb81cc17a1ad83c5f3f65aee44eb641dd92603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518917, "uuid": "115f76cc-745d-44a2-a29d-064e2700a3f4", "comment": "Malware payload (RedLineStealer)", "value": "9478d60871021bec925685960d6b9cf3519212877cbcd13ae26baa3c3ea6744556003d2da358f9ba1ad63851423cd584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518917, "uuid": "8da255c9-19bb-42f5-807f-2aae5f44d8b6", "value": "T17B663342FE86D1F2C2624E330F06E6A9217D7D312B19DEB9F3984B76D834061E365726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518917, "uuid": "6eb62b0a-f9e2-4464-aee8-ce48bacba107", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518917, "uuid": "9429c77f-6076-4930-a8e9-59222c3753d3", "value": "98304:V5OtsekFIsLHKrY7k2vPaxaL4NtsTDdw7RXER6XS9x41yP3ydQOpY2wghgjj4r:VbbFIs7K8rLOtsPdw7Lu2cCdQ8WghgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683518917, "uuid": "c561db7d-d815-4bcd-a647-446f8a309353", "value": 6614435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683518917, "uuid": "ca24a4b0-9cfd-44f3-9edf-2a450c223451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518917, "uuid": "e00b50e9-d882-49a2-9c28-5ab222752a06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7590d886-ed9a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683548317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548317, "uuid": "cd192696-8b71-4e05-b26a-d4b5534ceb48", "comment": "Malware payload (RedLineStealer)", "value": "4088e3ecaf21d56dd304a1265fe9c2ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548317, "uuid": "55b7b103-f4f5-4126-8463-d7f9f8c0b8f8", "comment": "Malware payload (RedLineStealer)", "value": "651c9fb71952bd29c53b3bde439bc7f0538241608c1e6ed3a7f96fe063f41bbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548317, "uuid": "158df982-0f0f-4271-b5b3-b3077847b492", "comment": "Malware payload (RedLineStealer)", "value": "c89c1a7710265ec32f47df86c66fe874f35befaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548317, "uuid": "890cf8a8-ed77-4ef8-8303-a9cba5e9c2f7", "comment": "Malware payload (RedLineStealer)", "value": "01afb8d88a1ea7343bb453fa0cec877cfc2d5b7388fbf3eaf656fcc7b900a0d1f2114ee7874f7bfc59b854818f58c32c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548317, "uuid": "43e0cea8-4122-4056-975b-e36fe1a88992", "value": "T1F6A40242ABE88132E8F52B7004F906971B36BDE1CD3993BB3B5058595C732D4A8B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548317, "uuid": "cc4789d9-8055-44f6-a084-840ada669a23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548317, "uuid": "a546256d-7160-406c-a210-9fe41308c9c9", "value": "12288:SMr0y90m2i2xHRgy9rHeN0mDLHLg8sgJCzzLo:iyG7F9SN0CbsQCzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683548317, "uuid": "b166d0b6-f24e-4428-837f-ed8787d39f10", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683548317, "uuid": "2e7fe823-1edf-44ec-bb21-601ddeaa9fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548317, "uuid": "f2f9e3f9-c99f-4d38-a604-aecebef8988f", "value": "4088e3ecaf21d56dd304a1265fe9c2ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c6782d-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571589, "uuid": "732fb50d-2a3e-4179-92b4-2b795e7f1012", "comment": "Malware payload (Gafgyt)", "value": "ae6c921242204ed87e579e432376df0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571589, "uuid": "af5c0d00-5082-4637-84b0-604efa6a64b1", "comment": "Malware payload (Gafgyt)", "value": "659838bed2be65c437f228d3ce7e6aac413ab6b99762137162b43472052c69f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571589, "uuid": "2f5e1b62-a9b4-4fa4-b74f-32859fc71555", "comment": "Malware payload (Gafgyt)", "value": "12570e9feddd673b9b8ed4ffe9d7a7fa892da2c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571589, "uuid": "75818b75-a34c-4222-8771-f5125228c5cc", "comment": "Malware payload (Gafgyt)", "value": "0b73ad430c510039ac22011eef546bc89487d7c5dbdea6d5e04dae98386f15ade924ec56940d193fa2f382f27472742b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571589, "uuid": "8eec5fb1-b3d5-4425-ab25-5ad37fbb43be", "value": "T112B31B93F511D5B6F44AE73308D38B247270FAA14F53152263177BAAAE362D4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571589, "uuid": "eac8fa7d-575f-48b0-9ea9-84863417bcca", "value": "3072:1wQeqacWucW0JcWcBeNX2WfKIwMI278ORF/qnFp3mzmmHqzTQKHKtW:1wQeqacWucW0JcWcBYmVM978Oaf8mmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571589, "uuid": "6228caed-29e3-48e7-ab5f-7bdd2f8a460a", "value": 109567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571589, "uuid": "0cbeaf58-01c1-4b1e-8b2a-2b90659fd720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571589, "uuid": "ecc4a6b6-5382-4b16-afe7-90f1fbecf492", "value": "ae6c921242204ed87e579e432376df0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a97772a-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585557, "uuid": "bc513046-869c-42f9-9c1e-af54c116d0d5", "comment": "Malware payload (Mirai)", "value": "5f3cef44926c4ce4c5876c6067db4421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585557, "uuid": "c22a85fb-8183-47bc-af59-ccc1d31f34c3", "comment": "Malware payload (Mirai)", "value": "665dfb2324c8eb4962f6eea85a4ec48c299a6b5018256c2d9f3a0349fd1ba669", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585557, "uuid": "77509ba0-ed94-47e5-8bed-e9edff416757", "comment": "Malware payload (Mirai)", "value": "9507c04daea40890f201c1263dcd592d9698a892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585557, "uuid": "2774c8e5-91da-438f-b4ea-1a72c7b72dce", "comment": "Malware payload (Mirai)", "value": "34c5709ef6c48f30db69bed27865cf2cf42489e4e4949511d5b2b24fd07e3f5ebf76b3a9b894b008b74af394780a0005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585557, "uuid": "e37aa7ef-4734-4e08-aaef-b84fc502e335", "value": "T14AE2F257D372E443DE782AB2F96E85CB7BBD4BACD37670A3160416241A9A0535F3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585557, "uuid": "4c2d2393-30d5-4fec-9387-d886373b8784", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XBO59q3UEL5Ij:korm1vpALgUJcsLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585557, "uuid": "627db5ca-2517-44d4-bd5f-74e8c4d57cbe", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585557, "uuid": "dc5c9783-adc3-4228-8560-1fa3fd25fd67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585557, "uuid": "f40ad3b8-0613-4e3b-95c7-b1c94f7caf31", "value": "5f3cef44926c4ce4c5876c6067db4421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b4108f-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683552791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552791, "uuid": "7ad3d474-cfb6-4224-908f-f2f36f516eb0", "comment": "Malware payload (AgentTesla)", "value": "8da3982dd902e907997dee92edf8d17c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552791, "uuid": "f8ccb6bd-455b-4a9e-9bdc-ef538cfc1495", "comment": "Malware payload (AgentTesla)", "value": "66d310e8f9cdfda5bd0f690a822444429036236846daa4dde72739ff3ed079b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552791, "uuid": "47f5d621-2843-4890-aaa0-6a1bd22d8886", "comment": "Malware payload (AgentTesla)", "value": "4a6ccfbbc7a08610205f2e5c0c5f7ed88c8ef86b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552791, "uuid": "2ae3a073-49da-46bd-b322-04ccf1209054", "comment": "Malware payload (AgentTesla)", "value": "773028152ebf131a70fba281dc686c7439f2b3aa681557f515a3834fbd31527809b64e7b5a3e6f56d78b8e2894f14c47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552791, "uuid": "a0b076c8-64eb-4381-af94-35d5609260eb", "value": "T10EE4BF3D5C8527D3B4F211919BC3CE7DE6E79D19A3C841F9C2D0A1A726D84B38822D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552791, "uuid": "046b3633-1775-4ae5-b667-d9253f7bdfe5", "value": "12288:E38OXPzIkfMPuVE0QwBeJ8hfdlS9wMWGRWaGV+sUPj5qA8UVe4vhRNFF9TCUnS:i8a0kfMu5QJ8hfdaq+x6UEAhRNdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552791, "uuid": "ad95668b-9213-45b0-876e-f0992ed59a20", "value": 679320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552791, "uuid": "33e30fe0-575f-4ad2-ac27-8cab8402af4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552791, "uuid": "19ea9f32-e5c3-4ee7-b1fc-6e0b057d7f8b", "value": "Purchase Order _ HONOUR ELECTRONIC CO. LIMITED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b119c6-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565901, "uuid": "3457bd43-52d7-47f7-a1db-d5a2e7fc5555", "comment": "Malware payload (Mirai)", "value": "6b23ac7dd1f910cfec5ce1ae4ec35619", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565901, "uuid": "6ebc6df9-c820-4751-8e6d-4a01fea3571b", "comment": "Malware payload (Mirai)", "value": "67c14eee9f3c546f3b48b00e3b2f2ab0058b7b5f7edd55e6449baea5b1082111", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565901, "uuid": "76ccdf4b-16b9-4031-8bb4-ceb3936ce51f", "comment": "Malware payload (Mirai)", "value": "23c3bde9f6ad90b4a28347d897658fddc8ebb583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565901, "uuid": "5404c557-a11d-4b26-a1fc-2acb4121fb0c", "comment": "Malware payload (Mirai)", "value": "8e6532a6f8db9e3b10c8790c4490b31ac4f5c6d786736219b50bf07cb5fa68a7ee27c1a094e4a29a4b7328ebf723fd33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565901, "uuid": "3a6731e5-0fc4-4c9c-84df-d2ee8adf302d", "value": "T159438E26E41E9EA4C446423478548EF41F23F1C883632EB75FE282B25053DACB919FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565901, "uuid": "affaa057-f897-4860-b7be-68a4720376b8", "value": "768:RaboQe4eYgeg3eZtQLruoqUUfdat/RFM3VbhJrAhynzkQCQoFrjSvDC54w6V5:RaBm3gK9UfobFwJlkQEF/MDC5Z6V5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565901, "uuid": "43782bbf-bff5-4f17-bd6b-14e03fe9068d", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565901, "uuid": "d52f0271-293f-4a52-b988-f89dc83a587c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565901, "uuid": "5b778e9a-5426-49db-8139-5d7fbde2cf8f", "value": "6b23ac7dd1f910cfec5ce1ae4ec35619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98416d60-edd1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683571997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571997, "uuid": "e75df33b-70f8-46f0-969c-aaa043f64d61", "comment": "Malware payload (Formbook)", "value": "16b73908872a69102b5d782b946c1c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571997, "uuid": "6d07c11b-3453-4c35-83d8-0d2f65831e45", "comment": "Malware payload (Formbook)", "value": "69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571997, "uuid": "4e1b29ff-059d-4223-8cce-b235fc410198", "comment": "Malware payload (Formbook)", "value": "a446cc9879ae237478adabad394b0317cbb2679f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571997, "uuid": "b221ab1b-7f6e-4f24-bb4a-af60de981327", "comment": "Malware payload (Formbook)", "value": "54bfb77ac36fded507de78fe50f9a24bce280dfaa6b80a57d047d1cb52db83903873473fdf7454eaeede4cca46dcdeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571997, "uuid": "b9a10a50-5469-43a3-acf6-7c5145bfb216", "value": "T18405F1B700AA8391F03F8BF0B968BC2406EB75EBF8D69E35031965C54E19A523C5D58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571997, "uuid": "e48dd4a4-7259-4337-b346-1143b4bb5ba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571997, "uuid": "25fdf12f-024a-4a14-8ddc-99abd543dc6a", "value": "12288:jbkcdXHwni4IyS+GgvnMLQFVvfcwr5Xi0JUCnmozOQB/Xp3I5c0x:jbJNwLwQFZfZr9jfnmozOQB/Xe5Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571997, "uuid": "291e5ab5-72fd-4eab-9bc3-0d7c7b284bf6", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571997, "uuid": "15be305d-c19c-4ec7-a335-2be245920c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571997, "uuid": "7e421c6e-74a2-4b74-b472-9e7c522763d6", "value": "SHIPLOAD INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ccecc7-edb3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683558945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558945, "uuid": "d5da858a-55de-43f0-b95d-c79a7ee7e77c", "comment": "Malware payload (Formbook)", "value": "2ef885be5c86fcf9756dda5ccb8c5dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558945, "uuid": "4d0fb578-bb9a-410e-b9bc-0bc67728090e", "comment": "Malware payload (Formbook)", "value": "6982ab1d029213bfcfbc542eee0d955b770f5c0df083dc94463c441e2de35fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558945, "uuid": "a9d420f3-4c49-4ef6-b541-869ae679195c", "comment": "Malware payload (Formbook)", "value": "948a20b9670c53f52ccbe403d22e0819588a7ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683558945, "uuid": "bd617914-044a-4454-b89e-e01076ecc4a5", "comment": "Malware payload (Formbook)", "value": "5d1df0e56222717328c6557f113a9f48998c7d6f2000680b0ef6c1784860cd537757b058c30f0c38efb89bcdf7ed6edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558945, "uuid": "891786f9-2f66-44b0-a903-1fa55594a1aa", "value": "T1B8D4025471B98FB1E8B98BF01538B58103B274A759F0E65C0EE560CB2AFBF102691F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558945, "uuid": "937936df-9af9-479a-aff2-874402149893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558945, "uuid": "d6dfa033-a47f-4724-b392-6951d5826512", "value": "12288:g8IV8Rjz8dXwXClmNIHbvDgKe5Ul9eYxvE:d+an8dXwXCbA75g9eYxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683558945, "uuid": "8dd68216-3446-4af8-97e4-fb05b136a3db", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683558945, "uuid": "d5926c92-0e75-4fbb-86d2-f5e848bffd7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683558945, "uuid": "b9c22c1e-8fb8-4aad-be65-bede9bd0a5d8", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba08470-eda7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683553937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553937, "uuid": "8dee461e-9456-498c-928a-55e4107a5219", "comment": "Malware payload", "value": "36e1990576e2b14b5af2fd9893a35273", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553937, "uuid": "a7e6192b-37a2-40ae-8b1a-4e0f9bb2ebf5", "comment": "Malware payload", "value": "6a3bb094c3380fc88acc9aa77cfa269a28fd71b8725930bf178a8aed732ec2a0", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553937, "uuid": "b9c0c797-e6a5-45f9-86e9-dda665c3fe90", "comment": "Malware payload", "value": "520d328bd241dfee495c7221e7468ac1ccfafb0c", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553937, "uuid": "bccfa5d5-c87c-4587-8c78-345d7a39ddcf", "comment": "Malware payload", "value": "49fcf6772dfafeb8e164712964763a358984a1f918e355c88ca6716387775f96009739a461b4907c64aa0ae98d284c16", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553937, "uuid": "c4305217-6262-4a9d-a220-d5db7ce12a54", "value": "T183B423F2A5ADFCED390D21F91653066C598EE4898D4D72BE2A114CB9C63C939FF2410E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553937, "uuid": "2f36584d-feb6-4cb8-ba03-a9ab02c00005", "value": "12288:7lgI2fm8hZJxxs3yFAXT08nMRT6cYbk1UQr1vbAGoAxyV:752fT7KCAjHwmc31Xr1vVoAx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683553937, "uuid": "ef537e6a-aac3-426f-8b6e-774dc4b502b5", "value": 536543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683553937, "uuid": "1b01a923-52e0-4973-be78-5c549d191bfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553937, "uuid": "220d0e6f-465a-4645-b717-07c3ed10977c", "value": "M_949594-7156038.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3645f6c9-edc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566679, "uuid": "b8e4b2f1-28ba-49ec-ba1c-7487604b5b85", "comment": "Malware payload (Mirai)", "value": "69321fefa0dc88bce76fa855497a5a65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566679, "uuid": "83f702b6-c65a-4e92-bfba-4c48640c373e", "comment": "Malware payload (Mirai)", "value": "6ad801df54cc66f292e1d3606dedda58c438bfc8871543afba8ef38b8a58eb2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566679, "uuid": "a2c87418-118f-47fd-b137-876539ae9383", "comment": "Malware payload (Mirai)", "value": "45bb21d3a2d65b94431571adb596954f4ba8e22c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566679, "uuid": "bead280d-6afb-4ee8-90c3-c67147469745", "comment": "Malware payload (Mirai)", "value": "2221ac5d3a05d61c13e3351a37b8e43bd0f41f095acca1576cdb3c5041fd53a3ee1db1c2f2f0523ac59b1108bcbbefd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566679, "uuid": "4a5665c9-5eac-47a9-9d8c-54d3eee088f2", "value": "T126534A9AB802DD3CFE4BE6BA54160E09B96473C142C30F27A2A7FDE3AC731945D16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566679, "uuid": "f381ae77-70ac-458c-9508-631fd18677f5", "value": "768:WieiqxPpW4WRREIxju1H8SlWXLt97p8VpIUu/0V1xM7V6LeqX+d8JwGKV6C8:WiUJyjmchXJVQI9/0tM56iqXm8fKV6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566679, "uuid": "8e705364-0763-4244-b767-48ee3c1a799f", "value": 64792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566679, "uuid": "48a641bc-5a5a-481e-abd8-ff3df0e1f99e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566679, "uuid": "f48b2557-86fa-4526-b7f7-90438fe35a83", "value": "69321fefa0dc88bce76fa855497a5a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc4a1a4-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683534399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534399, "uuid": "3b8bd805-9f37-41c0-8dcc-c1f9b4448c81", "comment": "Malware payload (AgentTesla)", "value": "c640945237e71cf74b8131254b284ab5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534399, "uuid": "5399df0c-c495-40ed-b823-8527769809f8", "comment": "Malware payload (AgentTesla)", "value": "6aefe0bd42c68c1a2a4294c7923939ce5f68f892a21f1606772561b6c7037ce6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534399, "uuid": "d7203ee0-de2e-40e9-a7f9-8b9ad5b7630c", "comment": "Malware payload (AgentTesla)", "value": "ad3d20ac212d909de105ea598c182a0f887cddbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534399, "uuid": "ec186e9c-d33e-4b65-9011-532fe1033dc0", "comment": "Malware payload (AgentTesla)", "value": "2a96838e3d2606fec8af067ac962610e9127853a71eb161e914eb918a14f670f69f716e93ac1e99e447e08b50a55a407", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534399, "uuid": "c0c8607b-0dfb-4c1a-9c01-7011c619e950", "value": "T14413295AE78F02648F511376571B0E899ABCB63EF35154B238AC833433E9C3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534399, "uuid": "45f5f9ee-7227-45e9-9160-7321ad1a5ebd", "value": "768:qFx0XaIsnPRIa4fwJMrqCOVpaLZOhS1ELEEjE8EqUnh09mUtqT:qf0Xvx3EMG3yuLEEw84h09mUta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534399, "uuid": "71b33319-27d8-4020-821e-d3a5b4d8df48", "value": 44208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534399, "uuid": "ded209f2-bf12-4bcf-9d8e-a66c4063c6db", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534399, "uuid": "89eaf85b-87b4-4422-be94-9e6cd42a3800", "value": "00927202305001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f010f7b5-ed64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683525329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525329, "uuid": "32df9bb7-35a9-4161-be5b-1436a6eadb35", "comment": "Malware payload (Loki)", "value": "73ee75a3b189e365394f9eb0f3f14a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525329, "uuid": "71e77966-7a33-4861-aa2e-d92b04c302af", "comment": "Malware payload (Loki)", "value": "6d4b6902689bfea045b5dcb0ae5357cd840886cde981343be7d437696b369cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525329, "uuid": "59a295bb-b3d8-4e59-b12a-326b8e4d91e9", "comment": "Malware payload (Loki)", "value": "2898a83f0af8eaa0f6300aac11d4953ba0531b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525329, "uuid": "8edfa1ae-c87e-4b28-bbe3-b603c8ea0d88", "comment": "Malware payload (Loki)", "value": "25851786500930f2932bd8664a8d8852ff3f5c8860b730ca7c554061360b0754f4d14a92ad27ae37a031196e6b2b80c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525329, "uuid": "166d4a0b-b04b-48f4-9029-a103e9008ef9", "value": "T12DA412D471BA8AABE40E0CF4493CB54413B172A315D4E9D81FB719C95FDEF402E88A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525329, "uuid": "e45db66f-9898-4109-847c-cfc56a494e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525329, "uuid": "4f83044d-8ac1-46b6-8213-54f5e6462d50", "value": "12288:q0GgIoZBU0/yn0R4CydilKstt92FhUgMkY3Zcqi:qhg806n0R4Cydi9bAh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683525329, "uuid": "3339c1ee-c6f8-4f95-9e17-3be6e7e643bc", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683525329, "uuid": "65e8d8a9-d4d6-48d2-b102-250790f68617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525329, "uuid": "7079befa-6e56-48b1-9ad1-710588cf2afd", "value": "0371000451985042023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1705fea3-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571351, "uuid": "15eda1a0-b2da-4085-9756-a0d8ef0d5308", "comment": "Malware payload (Gafgyt)", "value": "3f3e75dd20623d1f4f212f627087c062", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571351, "uuid": "74117295-2c95-4d21-a195-f2794626bfcf", "comment": "Malware payload (Gafgyt)", "value": "6f1885f22875d7c7c487d3118f4df36bda833a71be2cdda113b44f65926807f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571351, "uuid": "d5fc0ded-bc02-45f0-8f8e-989bcfbcdbf2", "comment": "Malware payload (Gafgyt)", "value": "fdc1648c63403a3f72ba4faca2ba78b4389d490f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571351, "uuid": "8c095250-d3ee-435e-8c7c-186077afaaa2", "comment": "Malware payload (Gafgyt)", "value": "98218a4e8d2a890a96207e27f56278b9fb3c6859a5749d62c52b4d7f04cfe05c5b9493c118ae039fa0e164ced2f3ba29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571351, "uuid": "1dc5f1c5-6522-4a3b-9cf0-5d48493c1d39", "value": "T11E832A46D3A2C5B3C4831BF605E7D72B0231F9164B2A9F0AE36DAEF47B12584719A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571351, "uuid": "8783f6f3-32ed-4c6d-8369-5d5589a7498e", "value": "1536:L3oLN5TCzSVYERb1aGy8gwi5vAMbBZzp6+m5CsNFPVYLf0:D8N5Tv+U5aH8VkYMfp7mwsN1VYLf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571351, "uuid": "f9e9f592-78b5-45cb-8b89-cd97beb29636", "value": 87461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571351, "uuid": "9f23005c-8336-4f25-ae39-2b00aadf7b94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571351, "uuid": "0f0cd456-545d-4d2e-8c06-2dc011f6bf63", "value": "3f3e75dd20623d1f4f212f627087c062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b153372-ed64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683525026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525026, "uuid": "8f7e26db-6496-4e49-aa6a-4c4a63f9fab9", "comment": "Malware payload (Formbook)", "value": "b95d624d901e11221407c993dfa38616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525026, "uuid": "eedd27b7-e992-48d7-91eb-2d6d64ac3a19", "comment": "Malware payload (Formbook)", "value": "6f505344ed0b63ea1ca3b058da81bd53069385a4fec5b94f7e97ecd3e53bf57f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525026, "uuid": "1ff5465f-c7a1-4403-9513-0e7a9c090f8c", "comment": "Malware payload (Formbook)", "value": "b4b9df32b7e729c280d79566368a87a37a7d8945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683525026, "uuid": "85a22230-57ae-45fc-a8f7-3992a4b33c0d", "comment": "Malware payload (Formbook)", "value": "6a32f3fb9dd6d407d7af086c981bee6420a19b88ccb6bd044f4d3200d0cdbeb5719d755d32305ae0cac08abb21794566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525026, "uuid": "a209b9a6-ac8c-4f55-a6cd-debed685a314", "value": "T16105E02537B9BBA1FCF683F87608A4006FB46D5153BAE1E84CCBA0CD5558B08F650B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525026, "uuid": "5c1a8b51-5da5-49ff-8a68-6d6de9c956b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525026, "uuid": "3c197011-dba8-4de6-b803-dd173066a97e", "value": "12288:afbO11KEqoiLUMGHv/LlO1JhyDoAD2pqCSK6nUqixsbn8hqorfzKUqOWo:aaPKMislObk8A5tXAhqoHXqOWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683525026, "uuid": "f8d6fa23-4e4d-40e2-8908-2cd8a4c42814", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683525026, "uuid": "6814e9a4-9535-4228-a17d-f369a2c533de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683525026, "uuid": "92858722-c7f8-425b-a7ed-bf9b6d889dd8", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c452266-ed6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1683527658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527658, "uuid": "829752d7-405e-4492-9910-04cf750c8403", "comment": "Malware payload (TeamBot)", "value": "9ae5aa25e3cb36aeca24ea82aaad8562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527658, "uuid": "4d1c73f0-afb9-4012-9dd6-8043822ea053", "comment": "Malware payload (TeamBot)", "value": "707e3d259430cc3fa8668861a5bca43cab9af7dc4ac2604bcb3db876c75ab3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527658, "uuid": "83290cc5-b047-4caa-b0e9-b9a0495cf10f", "comment": "Malware payload (TeamBot)", "value": "82ff11e285d7014e6fc5fb9fc949fb5d93d699f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527658, "uuid": "9017bac4-a88d-473a-98ab-f5733a4fe8a1", "comment": "Malware payload (TeamBot)", "value": "6087c0ed35d5753559039d390ca17b390ce55b7ac3f283596eef78661f09bd0eabddc368e5b726d1d3591eeb27b23a23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527658, "uuid": "f450f705-9135-4380-b0d6-475869d9c7b4", "value": "T171547D1272E0AC75D5E64A328E1AC6F46A1EFC90DF1736DB3218BA1F3A701E1D532716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527658, "uuid": "9161df06-a939-4be3-b1f3-463bac36caf3", "value": "d5316530de8caf207058f054d9fc1dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527658, "uuid": "56e7136c-bd7c-4086-8a34-6472f000874d", "value": "3072:JU3k8XqCVQgiMnMbBIVFqVD+Je8fOedKbPAobMhdAo0zGOzxWmJSo/Hrq:fCVAOsB8G+/TdEIoghp0zGOzA2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527658, "uuid": "9bdf18fd-8841-4199-81b3-181fe45339ba", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527658, "uuid": "abe996b6-4d75-4942-ab8c-91336f83f7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527658, "uuid": "864064b9-4fd7-4595-92f1-7e203e349277", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3cb603-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683578020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578020, "uuid": "50c33d07-e411-4e00-a6c0-2fa9e9af9cd9", "comment": "Malware payload", "value": "bd4debd26af6536e5ebaff3a97065cae", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578020, "uuid": "3e7c5d94-c920-47da-ad31-dee6fbf8c23d", "comment": "Malware payload", "value": "70b7879f9b98ece1dea628f1389a1400c8444f1b98bcdfba57c3fa6ebce75dab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578020, "uuid": "fdd1e7f7-cb3b-4705-9260-3b76e863bf78", "comment": "Malware payload", "value": "7066006de482950432aa7404d8a3414bd893dfe9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578020, "uuid": "f142c005-19a0-4727-bb31-fd9f1a7dc20f", "comment": "Malware payload", "value": "78a957fd5b8b3deed9d5ba283d402fb16d970ff39023622778e13799e25462a46bd66ff12e466c22b1a2306828119aef", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578020, "uuid": "c7573387-8d1e-454c-965a-107dfbb6d873", "value": "T1D462A025513C25A3D38781A5ED37FD1942F1F1CBD7C62A471324E77088EA45D9378895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578020, "uuid": "5f636040-b4e7-445b-b8ff-5131860a5dc9", "value": "384:hQ/7WGKd0HiwH1NqtirZxJWbk04ffgGEjh4:2WGrvH1NqIdxv0nGyh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578020, "uuid": "e4b61935-a116-4808-aba5-843293829542", "value": 14614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578020, "uuid": "a927b280-e37c-405b-9f62-61d072afc103", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578020, "uuid": "9b24f5bb-f1f4-4810-85e9-52af83b362e5", "value": "doc_ despacho.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6d4825-ed6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529994, "uuid": "aecbb1de-4c2e-46ad-af26-14eeea623510", "comment": "Malware payload (AgentTesla)", "value": "dd6f8a432afd89e2816830023e0ad3d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529994, "uuid": "84842766-ca17-4cde-b62a-6e1d664f2b19", "comment": "Malware payload (AgentTesla)", "value": "70eddfd85da24eeaffddfdd6326c749326f098b597ce9c8eb79b3e69242a7801", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529994, "uuid": "397a3a20-c853-4b36-8046-ab95ee53e980", "comment": "Malware payload (AgentTesla)", "value": "a253f1242b9b82fc3313544e109fb59785b35c30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529994, "uuid": "05dc8347-af74-46ba-8db2-d67315fe3505", "comment": "Malware payload (AgentTesla)", "value": "bdeefca5f7f886f4ea2ae8198ee8f3ab6f433db04a7b7f9fc358284f1932b8f9436b08f0e8e7cbccc08f257150329785", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529994, "uuid": "90fe0926-23c5-47c2-9379-0510bf12318b", "value": "T10EC4128472F589ABE91D88F4653CF84013B2B1B79AC0E6E04F7769991EF7F001E0569B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529994, "uuid": "0a136c06-1f2a-463f-9142-b8b8592afffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529994, "uuid": "5cdc5159-fb05-4b3a-967a-cde1b67db32e", "value": "12288:71aZWEIluAH9T2iQfE7Sdktf/7vK2wcjOFkTpXPf3RTE1cIxp/5Dv:71EIjH9lYdktfD/wcjOg1NEmAph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529994, "uuid": "23eea5f9-4cd7-4b3c-85e7-616a255f23b4", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529994, "uuid": "23b89031-bc73-4cd4-9a84-4c41ddeb1d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529994, "uuid": "45cdc26b-ef0e-4168-b5b1-2cb41e8c2298", "value": "Halkbank_Ekstre_20230508_085144_348375,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050ed14c-ed7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683536102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536102, "uuid": "87f74c73-59ec-4e11-b205-c72e7d428755", "comment": "Malware payload", "value": "0672ddf05b406d1e9d100950651362d9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536102, "uuid": "73f7d1c9-b68c-4dd5-9232-ac7cc50c309b", "comment": "Malware payload", "value": "71e312895c934d6ee09573275ee3ed0f27a55d8dac9b051569cc08dadec76cbf", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536102, "uuid": "347ac7fa-ec50-4785-8004-b83c27113f19", "comment": "Malware payload", "value": "88273d5416895a090be1d9cc366223e508b4fad3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536102, "uuid": "b845e87b-7e28-4d97-85cf-8ad252df6b7a", "comment": "Malware payload", "value": "bf85297d8370ee8ac23be4b9f5e8de0c8ceda702cc2459c02460a4650cfd1f444472c7ba39576122ac1a0dcd03c9c75d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536102, "uuid": "53bd7255-604b-4757-8765-1508d7b1be53", "value": "T1924733D828293EECFF2984B3D18E4524A5BB24C5CB55BBE1410CFACF37C51C561D2A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536102, "uuid": "d080f476-f77d-4f83-a788-c2aceeb7576f", "value": "786432:X55Onq6lVD6BNT57kpxRjhiQLN56Cpi7C:mq6lQBNT57Ms05VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536102, "uuid": "d9b06a1d-adef-43a7-89ad-869689085d04", "value": 26820008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536102, "uuid": "0eb60c91-e7e4-4a0a-b991-87b366c72e0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536102, "uuid": "7cd09ad2-5c33-4171-9678-3f2ed9a8367f", "value": "Lunatic.V1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f1f071-ed9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550220, "uuid": "1d4a7d3d-0b83-489f-8c39-bb85608a9f3d", "comment": "Malware payload (SnakeKeylogger)", "value": "8f6b6a095f7763025e9491e76256cb1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550220, "uuid": "03a470ef-b0ba-4400-ade1-1e6e3cd2d958", "comment": "Malware payload (SnakeKeylogger)", "value": "726bc1cc141d4ad30a0a1622d3aa8ac21af76273180b0efd160d2cc12d4a7fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550220, "uuid": "31341cbf-13ee-4492-ab26-6aa346dc5ed6", "comment": "Malware payload (SnakeKeylogger)", "value": "5be9493ee645cb26c1aa1cd42d7159d407d78cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550220, "uuid": "885114ab-092e-4ba7-8762-a356ac8da5f4", "comment": "Malware payload (SnakeKeylogger)", "value": "a5e9d93ee05304b811415d6bad4939d1bb5d017f507a7c45dbed38e86a1c28e8f31286d8fd7ad109153d325920889976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550220, "uuid": "3657c33c-3d52-4d87-8164-66abcd3582b5", "value": "T1355512027AC254B3D1731E365A796B12A97DB9201FA98DDF93E4092DEF314C0D731BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550220, "uuid": "361502d8-6e2e-4a98-b9a5-2998148e8693", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550220, "uuid": "602758c5-be55-440f-9fb7-cf3b435dd3ad", "value": "24576:NTbBv5rUanU+D7WDKvMrBW4ey2Tygt90e+hoxk7OAY:HBjUOVvMr8Maygt+H7/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550220, "uuid": "6147ebe2-0f2f-417f-8669-15c4e46d423c", "value": 1367843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550220, "uuid": "223a8369-4fca-42a6-8dec-797e7846bd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550220, "uuid": "6cf2f893-2d74-42dd-b33c-afa5694cc3a2", "value": "2023-PEDIDO No. 42279.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3975eac-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528691, "uuid": "41dd51fd-117a-4725-a30c-0af929d126f5", "comment": "Malware payload (Mirai)", "value": "751a2ff92dfee036e104f6cf4b063417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528691, "uuid": "a63a5923-d73b-4bcb-91a0-5299a045efae", "comment": "Malware payload (Mirai)", "value": "72de38fa9ad08b0654b9fd51b5d5c81eca20579a64d658afa5fd83915a089653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528691, "uuid": "b9b4e037-8ce1-492d-b929-a4625b238f63", "comment": "Malware payload (Mirai)", "value": "254554b06a263b9915dfa7812ad1e74658696d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528691, "uuid": "7af11ead-59cc-4d7a-9f91-a80c5c4ff8f4", "comment": "Malware payload (Mirai)", "value": "53b7481c5f2bd47428deaa59dca723a57dc20b814d7749f5e12e1a2cc37abef730b3127789c99a3ea4061352586d0e24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528691, "uuid": "d986dd01-d676-4eac-bf61-d2e1ddc34dde", "value": "T1D9E32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528691, "uuid": "59666936-3d76-4847-acee-ffc8e0c1ca91", "value": "3072:CJLce3pC5mw7/abHbz4NpaIJ8VIJ1FxUXkkTM/9cHMY:CJLces/abHbz4NUIJxHxUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528691, "uuid": "8af3b325-7e9d-48fd-8215-0b494934d3e6", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528691, "uuid": "46b28259-87ce-40d4-81da-47624bd4d910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528691, "uuid": "1366a400-0d72-4ed1-a860-5a8c1b3edfef", "value": "751a2ff92dfee036e104f6cf4b063417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fdfa2c-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565950, "uuid": "3564b774-cacd-4ace-a4ea-06a33daf1f35", "comment": "Malware payload (Mirai)", "value": "b86612e49e8ab5904cd935225041d4e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565950, "uuid": "2e6f2169-ff2e-464e-ad79-61eb9a8639d9", "comment": "Malware payload (Mirai)", "value": "7310a4b36cb2c97139e7f948300be399400bbb5cca6ca0c6374d2b1edf0233cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565950, "uuid": "67fd94b6-5efd-42e1-a93c-1920a84f5f22", "comment": "Malware payload (Mirai)", "value": "66191d282de4eb53338a38a84fce9ba09d360179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565950, "uuid": "1ba8bae6-dd57-4c44-8409-da0d6e698472", "comment": "Malware payload (Mirai)", "value": "8244b61621bad3198c2393e1e3b7149781be0438de369434ad26175842efaa7d374c13ae5664b249cb4ff0d6d240f754", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565950, "uuid": "18ae988b-a499-4ca3-8aeb-b60978e7cee7", "value": "T10424C82B25272F22D4D15DBB01E2D338B4BED96D349A0FC3A98D5E5B2E355E035D02E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565950, "uuid": "bc7b6812-e4ba-483b-8888-a95a02cb28a6", "value": "3072:4kVIwfazoNPQVXF0uB17BNjZk/TZEaq8RtWG0:4kVHfDlu1tx1k/TZEaq8RtWG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565950, "uuid": "80b9c6a7-68d3-4bb5-b03f-e9adba4d416f", "value": 210939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565950, "uuid": "c82cea92-1438-43a1-a61e-48407fa93a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565950, "uuid": "2b7bc43c-2dd3-4176-becf-fd776aeac798", "value": "b86612e49e8ab5904cd935225041d4e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfa63d7-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683588542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588542, "uuid": "c9c7a937-a83e-427b-beaa-6bf0a8f4fb13", "comment": "Malware payload (Mirai)", "value": "872b56f8f62d313c5fb58a3881714045", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588542, "uuid": "9eb72813-4958-4d89-b8e6-8df936d1daa4", "comment": "Malware payload (Mirai)", "value": "7467344ab7d2419858a436a8960ad82f9ffe373875b4ade765fa164f93069e7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588542, "uuid": "3213041c-f22e-4b95-969a-c2b381e84270", "comment": "Malware payload (Mirai)", "value": "d8acdbeb80f82a9d3343f2897951efb7c2beb34b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588542, "uuid": "d578a435-c0af-489a-b035-692da66f589e", "comment": "Malware payload (Mirai)", "value": "bfa368154f8278f1a67718dfdb1f92ed9b062b011d7874abda3c66bdd708e8897dc16bf4a8bcf5f1dfc1739f30019aae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588542, "uuid": "fb4355ad-cbc1-4335-806b-47d78d93166d", "value": "T1CCF33B8CA4025E6CFA87A8FE94214F1ADD516351B1930B1F959FFEC37C2226F9E42D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588542, "uuid": "e167a2f5-7dc5-416b-8da8-d9646658c786", "value": "3072:lY5f4OlKgf1bPBsm4+C3Z40px6xQyJDpC:47Bsm4+q40px/yJtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588542, "uuid": "ee570554-5f2d-478c-b2ba-3cf81ce0bf3e", "value": 170316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588542, "uuid": "870c856d-b058-45dd-8360-684c5d1e9507", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588542, "uuid": "8a363547-afb8-4b70-8a25-6bee4cd353c6", "value": "872b56f8f62d313c5fb58a3881714045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f1d559-edbb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683562570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562570, "uuid": "c29ff470-d645-4a65-88ce-c8a57836dd72", "comment": "Malware payload (Formbook)", "value": "743a03da4bca80da5f49be2b77050225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562570, "uuid": "5a65cc8b-af92-474e-b4f1-8b9de7086880", "comment": "Malware payload (Formbook)", "value": "7517367b3b61170bb7637de6f89077069159c4a04f430c28102e2d7cf5a0343a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562570, "uuid": "5f6801e5-8828-48cd-ab8b-b7cbe42207b7", "comment": "Malware payload (Formbook)", "value": "49ccd55c30cb4e31be4d4bf48bac3bdcba1acec1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562570, "uuid": "9cd6573c-f992-486b-be96-94d6453e0590", "comment": "Malware payload (Formbook)", "value": "97e28d397845fc9b6bcd6d3abe49fab5426b23a13223b590d2d7b8020270e5f89bfec45571c3567d1e1c326213ce1b2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562570, "uuid": "d00f61f0-2af9-409c-b78b-c5d4aa0665d7", "value": "T1374412007378E457FCB79A312E399A736EE5D52134EAA34B1710AD207A72701D92DBF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562570, "uuid": "4ebb8447-7555-4e81-9af1-eaed4d3b050c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562570, "uuid": "cfc32b41-fab6-41a5-997b-88d53e1515ba", "value": "6144:PYa6r0uQT1S084gHhrbDPvT5wTMHxrjSL9q/Vk+shAeBGWr:PYRz0fgHhnDvHxPSJn+sSeBGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683562570, "uuid": "fe266789-fb1b-4f1f-ac7c-0bbf06dc342e", "value": 258459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683562570, "uuid": "d30fca8c-edaf-4519-80f0-236e0fa4fa7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562570, "uuid": "2f0fbcd3-b72c-48b5-a1b4-984f71fa068f", "value": "743a03da4bca80da5f49be2b77050225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f06c7b9-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565888, "uuid": "9133e140-8c4b-42cb-bd0b-1e9e4291e3c7", "comment": "Malware payload (Mirai)", "value": "2bad8f8537af64c19b6f4314c354edc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565888, "uuid": "14099bf2-9327-4c96-baff-d10c2c6b26e6", "comment": "Malware payload (Mirai)", "value": "75a88da8eb68a86955194ffd839ace87201ebad837cf6d9dfddbb2f6a1ef08aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565888, "uuid": "3f4e791c-28be-49b9-a070-6b7c73fbc93d", "comment": "Malware payload (Mirai)", "value": "7e49fd3174326b51fa988911dfc517c419710438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565888, "uuid": "ce52dc2d-7c22-472a-9afe-5a6f1d22f00c", "comment": "Malware payload (Mirai)", "value": "af0bf3ca3b8a44574220dee694e95061e25b3ea930ad80454eb34396c2a2ad1cdf53333d33523b7ab789439b203458ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565888, "uuid": "7e8d8a69-7758-4a88-ada4-3a1c22901ca8", "value": "T102C2F076F59DC3BEC4A0773C20085E5F8A0A9ED04F49D2883618666C5FEBA39593DC2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565888, "uuid": "4b0261ab-5fa4-48a5-9dca-541a0ad704ce", "value": "384:MUv66YgiokzDM366q1tl81r31ueV9suqK0eaNpVIEWW+ZaWz4lq3+v1RK:x66Y4hy8qi9sK0PINW9WzU9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565888, "uuid": "96de2838-0df1-4f32-b3fb-d9f3bbdd829c", "value": 27176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565888, "uuid": "b3995246-7685-4109-9b39-28e2221e44c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565888, "uuid": "1854e901-d11b-485c-b3d7-4e25b1d314c9", "value": "2bad8f8537af64c19b6f4314c354edc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faf746a-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585539, "uuid": "409c2799-60ff-4e85-87fa-80ab0f4ac163", "comment": "Malware payload (Mirai)", "value": "f8acf4cc1a2fc364cbb732802d74711d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585539, "uuid": "c71000ca-38a8-4395-ba19-a9a8b04bd761", "comment": "Malware payload (Mirai)", "value": "77ce3489b0df5c52bb8e3ca6add5a507ba8058c26d8a7235e19d093fafb8dbc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585539, "uuid": "248f6cb4-0397-4e22-8edb-115a211989e1", "comment": "Malware payload (Mirai)", "value": "083a596ce6f65e2c83f9194525fe4eae982279df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585539, "uuid": "40ba745c-9951-470d-bac9-9e39f7125a92", "comment": "Malware payload (Mirai)", "value": "0a66936192b5a80ebe775644d08a09e714758d9fec3bafbe203566b6a0dc1c610a599f843a71c6e043550d00fe25c7b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585539, "uuid": "0dc3d2af-2c02-4dfb-89aa-edf65776d569", "value": "T1C9C2E044F0819E05DFFB28F52D40DADBBBD43F1E9A628E8066A463D16A5C3674606DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585539, "uuid": "59b4486c-2b69-4c4c-9b94-692741e4a336", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7P5xcLK4uVcqgw09a:tam+AnKehPRa9aBl4u+qgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585539, "uuid": "3d227be1-f84c-418e-bd7b-cf9e230851fe", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585539, "uuid": "8651c039-c298-4048-9ba7-b7c88ac344e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585539, "uuid": "c09b7207-81a3-4d80-8603-94988db3bec5", "value": "f8acf4cc1a2fc364cbb732802d74711d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735db750-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528556, "uuid": "f098c194-1cfe-488a-8e49-25e0934175bd", "comment": "Malware payload (Mirai)", "value": "02e3d8095379bdfe3d3996e9cda32db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528556, "uuid": "1d9ba96b-17bf-4da0-be76-d0f9e188d678", "comment": "Malware payload (Mirai)", "value": "78420a33fc6d787832ce54801f9368909b190fd1e7adb55f1e791a73fd470930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528556, "uuid": "16e8e278-8481-4338-aeaa-6c52433cbd81", "comment": "Malware payload (Mirai)", "value": "e7196d11d860a0b179175e592d1cf39061a0e6f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528556, "uuid": "218e6797-1e2e-466b-9a35-400101d35279", "comment": "Malware payload (Mirai)", "value": "32b783fb4c213e6f315fe8316a288b722a1b9bf70657560065ec983b59f9c550e1b5564ff5555b25fe588af5dab1de0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528556, "uuid": "fb5eb543-296a-45a9-818f-a5dd3ef6cf11", "value": "T11D438D37E86E1E74C04641B074748EB56F23B5C893972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528556, "uuid": "7296afd7-c6cb-4164-9dfc-495229fac9e9", "value": "1536:Vaa0brW/Od9hlCR3KbgKYXwKEpPDCMC2+WG:Vv0brWGd9X5bnYypPDL+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528556, "uuid": "04d0aca4-cfb1-4f04-afc2-2240e9ac3a03", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528556, "uuid": "830c7a7f-3c69-494f-b2d4-808f30e9cac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528556, "uuid": "42aa5fa6-d8ba-4bc7-b003-49b40fd57880", "value": "02e3d8095379bdfe3d3996e9cda32db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5e87a8-ed5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683520792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520792, "uuid": "1ba9909e-ab2e-47d0-a254-f1e386e2c264", "comment": "Malware payload (RedLineStealer)", "value": "7e64b512eb71a77ac39b2d3755fa82e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520792, "uuid": "ed5133fa-db97-4aac-abd0-77b6a618ba84", "comment": "Malware payload (RedLineStealer)", "value": "78f7edca34bf0d7b0b58c46c4c6c8230a7c46d246e0d2723caa23ee1b4df4b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520792, "uuid": "9be7786e-0d48-4b84-8f9f-7ad887df1511", "comment": "Malware payload (RedLineStealer)", "value": "44f577b8ca567fc9dcd038ff1c50f7295174149c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520792, "uuid": "107b570b-2653-40cd-9f4d-4036d91d42c6", "comment": "Malware payload (RedLineStealer)", "value": "db70b25127f536071992973ab0b79e68d96438a283e01f4373623e71d2ba0422517ef6097316787f45ac5e49328f2182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520792, "uuid": "df0b9dd4-f355-418b-99aa-3a99d34cfdd4", "value": "T1D4446C2AFB08F2D1FE09523D29C764AF5DEE687906AF10516B05431B349AF703AE07B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520792, "uuid": "ffb9a16e-345d-4a01-8d3a-541e4d670fb0", "value": "154732c40368f0c0508c3e38805e9321", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520792, "uuid": "e745a6d2-bbb7-4f24-8fc0-e029798c827e", "value": "6144:530yOebuNGSPW1FpcScPaEz108gJu8MMQAXiK:53hOebupPWjuPB10EMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683520792, "uuid": "11c33176-6fd6-46db-9826-96e57ea5ae79", "value": 259680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683520792, "uuid": "5143fddc-46b2-4af1-af93-08370d9602e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520792, "uuid": "86cc8f0e-8e06-4fb6-9eab-c9542c1c0121", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760135df-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683550465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550465, "uuid": "727d8ec3-964e-41e6-9445-c6839feb748b", "comment": "Malware payload (AgentTesla)", "value": "201940518679da6ae22ae9aaba75ca74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550465, "uuid": "ce2f8d72-0c0c-4556-96c9-36c1e09b5f6a", "comment": "Malware payload (AgentTesla)", "value": "7a030c6ef58fc59c941cef4dadec7d5ce8f1b0057df06aa9eef9fa84aeefa586", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550465, "uuid": "c684c28d-f4b8-409b-813b-b389a31e8886", "comment": "Malware payload (AgentTesla)", "value": "a5682657d0667120b2ec8d8424cfb2d01f75a7bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550465, "uuid": "8ba76ba2-3a42-4e31-8177-acec88726c9a", "comment": "Malware payload (AgentTesla)", "value": "9e5a03c557b871e08ebffa45b548badfe5468fc3a56086ef2692145546adf4303b2c45c9ee0dd5c200d4ad00586604b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550465, "uuid": "2d0b3908-bfa2-4d4c-9a04-9bbad653b1c9", "value": "T126C4025432F98F91F5754BF02938B84507F275A399F4E66C0EE261CE6AE7F102A81B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550465, "uuid": "5c22990f-39a3-4c2c-9b87-6a56ecea7547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550465, "uuid": "12f00d4d-2800-4d88-a762-f51ffdf750b4", "value": "12288:JIWaAGUd08NTdeme0P1J7PkE4eqH22hGSbVmdmT5GCzu:FGG0wd9XQE4eQXY2msz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550465, "uuid": "b02eba47-6bf4-4bd6-89ce-ce000ec7ac70", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550465, "uuid": "303af468-8c13-418e-953b-0659478643ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550465, "uuid": "d1e06b54-d7f6-4773-a285-5f26001e134b", "value": "48493933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558d8318-edea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683582623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683582623, "uuid": "7f83151f-1184-4680-b508-7f96519512b1", "comment": "Malware payload (DCRat)", "value": "0c64d0ae05035b5b5b33eb58505ea1fe", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683582623, "uuid": "f950730b-fac8-4b8c-bf68-f777b89f7b19", "comment": "Malware payload (DCRat)", "value": "7a08a316d3f4dfe0320da290747f85ea1047329f8de03e95e02980a5dbf95648", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683582623, "uuid": "7e9eba2e-b7c8-4114-988e-fb3e688bc03c", "comment": "Malware payload (DCRat)", "value": "6edacba2ce273d0a1dccf8f6a632e8540e4b1159", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683582623, "uuid": "821697ae-33b0-4e00-bbf2-aad69b023603", "comment": "Malware payload (DCRat)", "value": "2f97a4a7dfd8c6132d1ba2b4ff65727ae7efec2efebaf1b8356cb14a8ea0dc64e21d692237080e8f421a6cee19946d20", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683582623, "uuid": "d75fdde7-9c86-45a4-acfd-ce4aacb1533b", "value": "T159D5BE023E448E52E0251272C2ABC5748775AD106FA5E32BB9F93E7FB9123937D085DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683582623, "uuid": "7f1bd71b-a44a-4c1d-bccf-0e7b31c72221", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683582623, "uuid": "48639da5-3db2-439f-b932-9b3c56d6df2d", "value": "49152:pbA3g/6d/SfUXZZW23Jz1Cn1q82THnjZhf9yBE6IbtYOk5eRI/aCXq2e3BZVZkKE:pbS/YQZNQn1B2Bqw0eRQk3hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683582623, "uuid": "c3eeffbf-9c48-4bc7-a910-f145bc61d90b", "value": 3002003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683582623, "uuid": "923d58f2-08b4-4a67-9259-f6b789e414a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683582623, "uuid": "e626238f-033e-46e8-8874-5b237f763cf4", "value": "0c64d0ae05035b5b5b33eb58505ea1fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8374f215-ed6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529442, "uuid": "ff2a0742-64fe-429a-88e3-d7255996125c", "comment": "Malware payload (AgentTesla)", "value": "001d448c6e953552f2d86205b5ed7bfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529442, "uuid": "4c8855e4-fb2f-4614-8cf8-3e66c1cf7d59", "comment": "Malware payload (AgentTesla)", "value": "7c7a54f513fa6f98b27c0bc0be8003f6f1caf5977fd98c75c8319d78f94cd3ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529442, "uuid": "05532383-e59c-4359-a54c-a141160dcc66", "comment": "Malware payload (AgentTesla)", "value": "c6a14de62ec0ca2ed75c15429697a03b77f7c288", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529442, "uuid": "7d167fc7-f997-4c2a-a980-676cb53825a2", "comment": "Malware payload (AgentTesla)", "value": "7a5b41823388c859adf894fe2ffc2e0bc5e9787d2eabf291de430a7a0ecb4f8369ee064edfec8579c4cecfe709556e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529442, "uuid": "9de12029-bb16-42fa-bdc5-15c3f23ffeb4", "value": "T1B7F4BF994E134243ED4CF93BC8A89CE053026E0B3B7C76BE7096C63D6255B7496E87D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529442, "uuid": "be88da51-c06a-41d9-b07f-4405a7f95173", "value": "12288:Xu/3Q6BF39ExbGn4VfA8K3k+GHo0iVdg5LrsQ:+vQ6tEtGn2AB3KoVAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529442, "uuid": "b3d2abc5-294b-4d6e-84f0-ed77eed445e9", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529442, "uuid": "71d4d4b5-6690-4882-9c96-fdad3c4d4254", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529442, "uuid": "2a612ee7-a323-4ff3-a50c-c06c64e66239", "value": "SUPPLIER RFQ 05-06 CODE ZO.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfca1b4-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683550666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550666, "uuid": "5187218a-d3ef-4f77-8bea-89280f1c7a26", "comment": "Malware payload (AgentTesla)", "value": "40e74c7303f2ee3c54dce5dd76d38c8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550666, "uuid": "62cbe75c-d708-4174-8d0e-82953013e801", "comment": "Malware payload (AgentTesla)", "value": "7cfb5ed8e9d16e9639b704b5991fedfb7abd82c1022fb00a83cf6bb5df31cf27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550666, "uuid": "f50cb01a-c9a7-498e-8d60-ac29da05068f", "comment": "Malware payload (AgentTesla)", "value": "ae749f82d2faf30eef39e6308d5337e5cf88f01d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550666, "uuid": "aaad7fdd-249b-4293-b825-f6f5cb63dd56", "comment": "Malware payload (AgentTesla)", "value": "afb03fe85e98595a733b7f10e3e18c26247872ef1af0d784a14835e25e2b5c99f68281b1fdf64e31b694f11019e72de6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550666, "uuid": "d3dcb190-d9d4-4597-bbd1-d34db47e69c4", "value": "T1D624C214F755D57BFA484B39AA9282971255BC73B91AC90721C3730F2B33FA19D32E22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550666, "uuid": "38ca19a1-d730-462e-b201-2001aa276701", "value": "6144:GZ+RwPONXoRjDhIcp0fDlavx+W26nAoV0o5Bd0:gGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550666, "uuid": "62cb21d9-ee03-4ed6-af17-22218bf378fb", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550666, "uuid": "82797e20-153e-46ec-b454-b27d74da9a20", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550666, "uuid": "3696ae1a-fcda-41e8-832a-55696d352c4c", "value": "Attached MV NADA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6e9eba-ed93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683545211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545211, "uuid": "828a2b61-c3f3-4414-bd39-3cc253f064c4", "comment": "Malware payload (Formbook)", "value": "c92ef05629e1ec8274d5488923a54263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545211, "uuid": "6628a654-3ed5-4fea-ac12-18e6853acdd0", "comment": "Malware payload (Formbook)", "value": "7d0fdf3abd56e00933c0fa8cf573b948a4c9d85248915249f1909e6775f75e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545211, "uuid": "35044f87-783d-444c-8737-200bf4276a47", "comment": "Malware payload (Formbook)", "value": "bb79eb75a01e337297fb70d9f27a9da6963aaab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545211, "uuid": "7cf8f510-8445-4535-b0f3-30d45f962d5f", "comment": "Malware payload (Formbook)", "value": "7cb23a748d135c1cef7af9433873d098189dce8fbe5942e2f9d1b630c2357853dad58e9efa2a1efa2bcffcb8bd8acd24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545211, "uuid": "52469821-bbb0-47af-9eb7-e2920773c11b", "value": "T18CC4128871F98AA7E90D06F89A68B250237171B7E8C1E7D90F365045DFE7F005F8869B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545211, "uuid": "421b9529-9165-4d89-8456-83b0d7de6130", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545211, "uuid": "8aab8d70-7658-4f0b-877c-24b84cf2aa6c", "value": "12288:2poUIvfbadR7/FqIUJFWRxUSb44RX94XkMkFcY8bPU:2e/HbadR/IKbzd9ukFcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683545211, "uuid": "5c4bcab6-45d3-4ec8-9f40-0c9193b0a73c", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683545211, "uuid": "eef65c87-7326-46aa-a1e5-d9caa1aabaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545211, "uuid": "63382330-9934-4906-8b1a-98a6161a3b9a", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6ae495-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683534401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534401, "uuid": "f0d6db7d-b659-4468-8b28-383e9edbb0ae", "comment": "Malware payload (Loki)", "value": "d6c9344a4390d2e384410894ec8fd616", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534401, "uuid": "28ef40c3-8fea-4c85-bd76-bc6a85fd1e0b", "comment": "Malware payload (Loki)", "value": "7d55ce79e1313fb083443096583b060cfb2efa13634416a921de4890bdc8ec0f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534401, "uuid": "2f8ff969-0f60-4ac2-88d6-fb7db5f343f7", "comment": "Malware payload (Loki)", "value": "2023181fd6ee3823ac442edf26df3aaedf969779", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534401, "uuid": "00edd3d2-077c-4420-bbce-b34146d48523", "comment": "Malware payload (Loki)", "value": "c8c35b92a883746c0b7149514295cf25c45985130f2daac871f4d10dfed43e42c30576f7f9b659f6d8be3dbbda6f590d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534401, "uuid": "35f4c840-9a5a-4243-b0d8-f47cde163ba1", "value": "T16F35F112E48CCD8DE582D7FAAA72784D470CBE2372CD70C20658B70AA535EF79797249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534401, "uuid": "603901e4-d3d3-4f1b-9a10-c8626b710681", "value": "24576:9LKcWQmmav30xnPWQmmav30xaH+MXUa+MXUhA35M3Ftib3m0xY:9LKxQmmQ30AQmmQ30s+MXB+MXvKs3m0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534401, "uuid": "fa65c447-0258-43d4-8132-e849a89d394e", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534401, "uuid": "0c341fe1-43fc-49b7-b9c6-29360ed29c64", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534401, "uuid": "f6c37e9d-7f51-4822-ba90-76c95f5e7416", "value": "urgent order PO2023508.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1eb48e1-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534245, "uuid": "6251fe8f-c474-465b-ad09-0c9ba47d70df", "comment": "Malware payload (SnakeKeylogger)", "value": "aae39bd618bae7bfb5a111c057cb7ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534245, "uuid": "3abcdfe6-73d9-4512-ac7c-2076c02f5046", "comment": "Malware payload (SnakeKeylogger)", "value": "7da17822c2ee73d1a947ae98cf77ec65a89b65d928123d95ef114438da2c5186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534245, "uuid": "2941de9b-afa4-4e2b-803a-453a42a1e545", "comment": "Malware payload (SnakeKeylogger)", "value": "c4ce9c3006374f86f730f247f13dd33d6c0afe40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534245, "uuid": "a64c40fb-3270-4681-95b9-09cc6146b6dc", "comment": "Malware payload (SnakeKeylogger)", "value": "d92b19dedaf8bd19cb3309d8462b4de64695270140f0350ec45fdd5d55368c71e7862a53a9509977260bc819b63c6023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534245, "uuid": "f61f65b7-73aa-475a-8cac-c397fbfbbb14", "value": "T1176512027AD290F2C4621E315E6AAB21AE7CBD201FA589CF63D47E6D9E315C0D7317E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534245, "uuid": "b46f424d-5a2d-4235-bb56-a75ca45ac07a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534245, "uuid": "ebd1b73a-04b0-49cf-bef1-de98906f3650", "value": "24576:DTbBv5rUDwcywQSvYhCeLjCTDKvMrBW4eNTygt90e+hoyaxlY:dB1cLQ59LjbvMr8jygt+0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534245, "uuid": "393e9c5d-5ef1-4fd8-85e4-71cc1602e4fc", "value": 1435676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534245, "uuid": "b15bd215-e83b-44d2-8609-8fea4cd6ebc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534245, "uuid": "67005e88-cf32-4c54-8c0f-819d77ae4fb6", "value": "Bank in Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1248be47-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683534406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534406, "uuid": "46b95558-720e-4d44-bb07-9f948a48553a", "comment": "Malware payload (Loki)", "value": "07d66d3ed55deb058d9277fa112bb3bf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534406, "uuid": "81eecec7-b785-4846-a0b4-be8573d4c9a2", "comment": "Malware payload (Loki)", "value": "7daa02bb02cb3b2f5a57638f6b959c164de98545643a142133fd4bdd2efeba4f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534406, "uuid": "eb9558ad-a54a-4c75-92a0-254affcbfd7b", "comment": "Malware payload (Loki)", "value": "3f9bd3e86289b59ad4d4a0144138b9c3a532bbdd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534406, "uuid": "7ee3f1a1-9b1f-4d6c-93b4-be07ce6c7d1d", "comment": "Malware payload (Loki)", "value": "e97489128bbb8d747c72fb7e3d5a95b51783b3622934d6187de88313c4b42ffc07d25e78c771820ffe6d441a076f1f32", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534406, "uuid": "0ea191e8-7a89-4449-b202-6835cdcf1285", "value": "T1EE45D01EF5888F4DD581CBB56A63B488421DBD6377CD24821284730EADF39E6A6C3DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534406, "uuid": "0e087d89-6f69-41a9-8960-f9a70da09225", "value": "24576:MLKfWQmmav30xtPWQmmav30xGn+MXUv+MXUKWW+aGsWnyXFkc1HVBb:MLKOQmmQ30GQmmQ30g+MX8+MXhWjswyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534406, "uuid": "1644dea4-c61c-45be-b7ed-d6e8100d8fd0", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534406, "uuid": "4c6ddd2c-8273-4af0-b365-2aad8590ca80", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534406, "uuid": "68ff7122-f4e1-4c52-8322-7bf7dcc78ee5", "value": "QT_9x4116-4510.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea38e56f-ed7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683536916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536916, "uuid": "1ef3ede6-12e8-466c-8438-132953a7450a", "comment": "Malware payload (Formbook)", "value": "eae4bfe9d3ded50dc5a860a68c874120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536916, "uuid": "d54334c0-fdac-468f-aadf-731f1a2216d0", "comment": "Malware payload (Formbook)", "value": "7dc1242cf01a3a2527ab8a7e03c370f556e3d62f4ad2567aa383000bb3448517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536916, "uuid": "86e978d7-fd68-4ec6-8c29-f41802a5c936", "comment": "Malware payload (Formbook)", "value": "f4e7e73842c43f49e1050d9554231ed8b282e531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536916, "uuid": "ba277741-4c37-447a-8f51-18703114a51d", "comment": "Malware payload (Formbook)", "value": "e4c047020bacd9d983fab618da59398619c04924d7f5bf94a1425154610092bb50a425f752e88b0e1500cc97f58a1045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536916, "uuid": "bf1e2dcb-adb5-40af-a185-597d869f73c0", "value": "T19915D0923BC42AB1F838C9379362EC1B4BFDAEE812F1C10E2CDB75D847B2A4446D6555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536916, "uuid": "95521c47-5983-4a28-ac66-a273fa223348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536916, "uuid": "a3306a2d-dd58-4b06-88b6-fac0de0bf847", "value": "12288:Tj8Paty5w0F1ttBTLpJcuwiHjHfsyJGo5LsmVWWdUwWDOmbgOxwr:TAPatmw0F1tDVDsy0o5wmnWDOmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536916, "uuid": "840cb3da-afbb-4e11-bd95-07a3ce92a17a", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536916, "uuid": "b0c94a3c-1c1d-45db-b2bd-91e1e9c15b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536916, "uuid": "3d2cecd6-3acc-4fc1-9832-f17f5af6f2b6", "value": "PO-20230017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34acdc1e-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585574, "uuid": "4527f996-92e6-43b7-8339-eec4543e8794", "comment": "Malware payload (Mirai)", "value": "b18389fd15ae8bd7b787bc17ae432ff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585574, "uuid": "eae92558-7603-4ac6-a7b9-34b0c1c5d862", "comment": "Malware payload (Mirai)", "value": "7e87b1212af041512ee9f594c84b9a65699b76249561dbb321dd2d126331920d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585574, "uuid": "67148142-9d07-405e-aaa7-7ec8ca38ccdb", "comment": "Malware payload (Mirai)", "value": "bcf751b3b7d1ac380b2cf22f02b1c25dc268cfff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585574, "uuid": "d310b1f0-76cf-4f2d-a05c-b69b43633afb", "comment": "Malware payload (Mirai)", "value": "d8189d1f84b3e6b5c649a485beb628adeb5327ee904ca33b2a72f412d235c3bf11eb9797bbf765a51cd78b476be6c713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585574, "uuid": "80a63c3e-e3ab-4558-80e2-4360dd108023", "value": "T178B2C0A49B906716C270B435D3BC8F936A3B55E4D6F63936272093BC864289633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585574, "uuid": "f3b0a374-f7c0-4ed1-a79c-6a854273476b", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BDpDlBLhymdGUop5hu7w:4GHKQFH0rs3zWoDDRsjt7LB9U+BFDlBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585574, "uuid": "508b3baf-0e35-4392-ae53-2f0e4e93b2e8", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585574, "uuid": "409a00e9-5258-4442-b7d9-204bfae06014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585574, "uuid": "6fb1e899-927c-4e06-9127-0b86c73f1218", "value": "b18389fd15ae8bd7b787bc17ae432ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaeb388-eda7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683553969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553969, "uuid": "395cb97e-9df7-4a8a-b53f-c49a08b0e8b4", "comment": "Malware payload", "value": "39ea62808e121e95ea4e267bfa4ccc56", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553969, "uuid": "26e32c17-73f6-457e-8252-c37ba692ac2d", "comment": "Malware payload", "value": "7f220b2ce522ccb9588869864bfb24fb774ee738dbb9de12204f417467fe601e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553969, "uuid": "e689dba4-e19f-4db5-b11e-e6d19748f907", "comment": "Malware payload", "value": "a2ac35feedfa83eb372501d226df012fc81f776b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553969, "uuid": "0ac40231-06c6-4e82-ae9b-7a89010f3c32", "comment": "Malware payload", "value": "8b33f13e0d262efc76af1689de79cfbd48e955f23a1b240e93a25001997c756688fb312c04e0376b494e966a4e05a817", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Geofenced", "colour": "#BCAA6B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553969, "uuid": "954f081a-c642-4bbb-a742-a02cbea1a18b", "value": "T1BE05AE1E739802E8E167D178C58A0A12F7B97847537256AF43B1479B2F2B6B05F3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553969, "uuid": "560dc7c3-bc02-463f-95e7-c11f89aaae1f", "value": "65d2a4768b2d3322c5409ac1e350769a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553969, "uuid": "ce633842-d860-48ca-9c37-4201053aa80d", "value": "24576:jZKG7l6XAWTjkejlmZnppyLUR1XrtFDqI:jEG7l6XAWTHgZeQRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683553969, "uuid": "7c8069a6-7d29-40af-9d72-e30c75f8a784", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683553969, "uuid": "d03f274f-e3a1-453b-865b-b0c8e49eeeed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553969, "uuid": "edecf17f-8232-4f0c-8904-32449f204a7f", "value": "V951581922690\u00acA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f8d6f-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683535086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535086, "uuid": "e991d5dc-4c4e-476a-8277-75d714c61548", "comment": "Malware payload (RemcosRAT)", "value": "1f2ae45ed64b04681408b3c1c954587b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535086, "uuid": "717b455a-3a81-4a50-a273-270c3af5d20e", "comment": "Malware payload (RemcosRAT)", "value": "7f930ad707464ff08068026c219b7d470da3adedf984f0b0897e1adb4126440d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535086, "uuid": "6558075b-d783-4890-a8af-9f7d39c81235", "comment": "Malware payload (RemcosRAT)", "value": "a3ff72985c4f14fdc40ada9c5b27af2ddf4f0fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535086, "uuid": "51b13bee-5bfd-4e36-9f2e-5b40b04f4a08", "comment": "Malware payload (RemcosRAT)", "value": "702ddc7a39db7577f409d77af440fea4aeaa656cd52844827c02c3a1cac4583c4aa8864f33c9fef3218467aac5c507b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535086, "uuid": "7b1821d4-7c56-4bcd-9335-edaf1811de7d", "value": "T13E152259B2F68EF3C60E89FA1438F9662372309755C1D7E04D39A5C85FEAF014E0866B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535086, "uuid": "6d20a204-d0a2-4c7f-94c8-4fa4568431ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535086, "uuid": "50947d42-80e2-4eda-95de-65563b9f880c", "value": "12288:Q02Jxssz34h6mrtC14jNdDKxAy5ZY9vDMX1N+l0wuD3iZ+Yvc3Z1hGtkWj3Z:Qm76MqCmx+v+N+lGUfkMiWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535086, "uuid": "65359aee-a1be-4550-902e-9594504caae2", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535086, "uuid": "14cb6725-3a6b-4ae1-83a2-dc12da3f65e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535086, "uuid": "3e218a6a-e4c9-4f4a-94e7-617e6056111e", "value": "1f2ae45ed64b04681408b3c1c954587b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7261310-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571593, "uuid": "7c8923c2-d514-424a-a193-f4cedc73fb08", "comment": "Malware payload (Gafgyt)", "value": "31342433639423cab25e5c9f7f974a4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571593, "uuid": "444925a9-c14d-47ab-a7f1-0e4bd6f0045a", "comment": "Malware payload (Gafgyt)", "value": "81f1431ad4d86e70e0be85a0c875c15f8716a40e33dffe03ec06b3f36515a0ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571593, "uuid": "1856ff3c-4742-42ea-9594-f71be538a22c", "comment": "Malware payload (Gafgyt)", "value": "b8d5f4659d71a261fa2acabc281537029c68d27f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571593, "uuid": "233e3c3b-f47f-49eb-a1a5-7bb8c8f7229d", "comment": "Malware payload (Gafgyt)", "value": "ff42660ed48d624208d94a1655c65eed453801ad03e6ca33d605d5518c2c3c78222853791778cda4bc116a19df71fabe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571593, "uuid": "3f012a29-fa9a-499d-9bd4-622245cec0fd", "value": "T19193398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571593, "uuid": "dd29996d-8582-4974-a551-121652d334bf", "value": "1536:TeDM+Vl/be0Ff5soS4yfafEdfmoDs2tSYVm+:Tj+Vl/b/DDfEdm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571593, "uuid": "ac3c2399-ef06-4103-8b60-379433828a85", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571593, "uuid": "804f0aa4-4896-42f9-a4dd-6eeda912e5d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571593, "uuid": "d6633f0a-9cf8-401c-b797-d363a6789533", "value": "31342433639423cab25e5c9f7f974a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5857e663-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550415, "uuid": "eff920dc-dacb-4e67-b36c-4d889fe80cc8", "comment": "Malware payload (SnakeKeylogger)", "value": "88dede204d97f45c817f563085bb5d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550415, "uuid": "5d2e5ed9-7c22-4ade-b066-2c6193a73106", "comment": "Malware payload (SnakeKeylogger)", "value": "823a206dcc8e78823dd154d935da7c7ba7029b9b51adfa1caaaca282fc7df829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550415, "uuid": "8f045862-8307-4e0a-b22a-936ff2f67193", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f12ebab1c2f5174f356f891aa61f7170820302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550415, "uuid": "dda75eb0-eb1e-4cbe-b59f-88eb1821ce55", "comment": "Malware payload (SnakeKeylogger)", "value": "9c44b0e38b0dfb31d07c0e6c9c665e42438978aca81b4824c02f91005219aff92694c932fe7bf787cb8e382383f4c505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550415, "uuid": "74ae15bb-7ba5-4806-b19c-d55c38e6c590", "value": "T1D4B4F11972F58F71F9768BF01938B84103F035A795F0E65C0EB522CA2AE2F151AD4B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550415, "uuid": "088f10c5-e55b-466b-81f9-bc040b45bc77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550415, "uuid": "3867591d-e2c7-4560-a6d8-95a804ea6070", "value": "12288:MElD5MW5v7jgO9c3KtBaxckAZt0WsYHXmbtmr3HgVnr:PFT23KtQSlZt0o3+mLgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550415, "uuid": "d5d446cc-3aa3-406b-9a7c-ad7154f42303", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550415, "uuid": "0bc888c7-81b9-45c0-ae23-0fc8868c4e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550415, "uuid": "3c7e7a48-7e6a-4285-9e9f-dbfe3838d985", "value": "Mq47X8OzV3E4Ab5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91421fe5-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683570267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570267, "uuid": "318909e4-5c49-4f38-9d84-fc2b002e2474", "comment": "Malware payload (SnakeKeylogger)", "value": "1302c34f2cab03f1a577568576f2b08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570267, "uuid": "c775d7f3-8ec5-42b9-96a5-256b219c4c56", "comment": "Malware payload (SnakeKeylogger)", "value": "82acd801b01b749f54598cea752c642b2b47f45dd63fafe53050ed4b06b342a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570267, "uuid": "1d3890df-ce3a-44f1-9cdc-c75ebf52f717", "comment": "Malware payload (SnakeKeylogger)", "value": "813c6c7e93191d5f4c492a6b0c38d9035a5334ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570267, "uuid": "bf2b759a-bd56-439d-bf7e-3463c0f4ec1f", "comment": "Malware payload (SnakeKeylogger)", "value": "caf5963263bb227276094b592ff2d6d42760dd79ae69d6e13d34db397cc41c08f2aed770c180a78986ea6edf95f0a17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570267, "uuid": "a7724121-67a0-46c0-b7ec-dea5f24cd98d", "value": "T15BC4F111B2E9BF52E53D4FF42468764007B13167A4F0F6AD8DA661D82AE6F800B41F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570267, "uuid": "f6c6d768-a89b-4264-a65b-ce0ceda7c472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570267, "uuid": "f739d305-0686-4d5c-8f85-d5805fd2ffa8", "value": "12288:6yrmCQ3aPIBzhkP7hhOmSG3OEO4N0zkliTf:6yrjQqk+jhk3KOEO40df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570267, "uuid": "2aa26392-b06a-48fc-9d36-1b587f604061", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570267, "uuid": "8668cfcc-5d0b-4786-baa6-da90672612ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570267, "uuid": "0d1f1551-b029-415b-9de3-6d80516743ed", "value": "Pedido urgente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4256c5e-ed56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1683519243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519243, "uuid": "493f3cc3-e254-4691-891c-1835f154fa41", "comment": "Malware payload (Fabookie)", "value": "34e5f4cc8913e0ecc3b2a20ab7df5191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519243, "uuid": "7e83a345-67b7-4aff-b51f-596d6e72be49", "comment": "Malware payload (Fabookie)", "value": "82e7dd71b5ff943bb1829fbba1f1903948a98e2ebd901ea6bf15054ec8d3bd47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519243, "uuid": "3e3de79e-62cf-455a-9f87-04b85fa0a284", "comment": "Malware payload (Fabookie)", "value": "64e89ce81d9e6f64e7455dd4918d2a5987fa2620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519243, "uuid": "56c57257-76dd-4eb2-8825-54bf88763da0", "comment": "Malware payload (Fabookie)", "value": "8c013bb207784d3a9bcc99ad655353d49eab46158772f0a991fae5c4f5b10c09b1d22950bf9c51fff7b1a5849fbbedd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519243, "uuid": "a616701c-f749-4665-89ab-232f7be7b46c", "value": "T1A1741981B3DA4028E072C679CEB18363EA767C155B3096DF07609E6A6F73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519243, "uuid": "fe2c3817-9747-4b03-bc55-9f9a33e0b7c9", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519243, "uuid": "3255168e-83f7-4e60-8850-c37062a519f4", "value": "6144:xFH8RIT6Fam4StJ3/DW49wY7SkDyPiaODgKYleQ4SGP:xWdRDzCUJMeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683519243, "uuid": "c40e5724-736c-4901-8163-61e67b708f67", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683519243, "uuid": "82695507-2bbc-45a8-9d4a-516722230bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519243, "uuid": "5d2d73c4-b09b-4b8b-be41-d2e3df1b4fb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b336052-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568808, "uuid": "415b252d-418b-49fd-80db-69d9c98e21f4", "comment": "Malware payload (Gafgyt)", "value": "ea76defaa17501397df224d7eb15ee71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568808, "uuid": "c4bf5be9-958e-4ad1-ae20-1bef0d98f8e8", "comment": "Malware payload (Gafgyt)", "value": "83ed801c4ce0552edb6b7a21a0e8a6d881ccfb39799fa25cf399a2104ac68bf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568808, "uuid": "2e2d0a97-fc96-46ba-817f-1c3e96c9b602", "comment": "Malware payload (Gafgyt)", "value": "a0a703f28ced63ab8265333894fbe507b19c423b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568808, "uuid": "9506df1c-42a7-4800-b898-7b2276d1288e", "comment": "Malware payload (Gafgyt)", "value": "398cebe3f0de53ec37aab737ccf579ecafae45c67c8ed1c10ed8e748d7e05f598a08c100784fdf878a2e15877b5ae4e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568808, "uuid": "43a997eb-b783-45d5-a351-be6a8797fcad", "value": "T1ABC30905F901875BC3E227BAE78E438C77355E6457DB33156A38BDB42BE1B982D29230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568808, "uuid": "3c579ee8-9b44-4a96-a3c6-8db22762e21b", "value": "3072:TGGhNnu3jGOEHgsRqo53bhISOMmyVUQuiXfQd6W:/ruxEAcqo53pmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568808, "uuid": "27c624c6-6415-4cae-9cea-2d510a93261d", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568808, "uuid": "7e48ccc4-5d1a-4bc6-9d48-41e48e8bea01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568808, "uuid": "7590d61b-403b-4b13-a4d2-de0d80d1e0cd", "value": "ea76defaa17501397df224d7eb15ee71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728af356-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565921, "uuid": "20e5f23b-ef6d-48c8-a1a3-f2f481861aaf", "comment": "Malware payload (Gafgyt)", "value": "580b6690e62436d274dea7db581284a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565921, "uuid": "3756d54c-6240-48fa-8ef2-b79a3c8289bd", "comment": "Malware payload (Gafgyt)", "value": "83f31acb3715d3b70b5714ce80c1f6f44208ea1bc1adc1e97e768c1147c2f6a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565921, "uuid": "668b5077-a341-46f0-b35a-85ac39fba8a7", "comment": "Malware payload (Gafgyt)", "value": "794e69e2ea80ebbee70199c63c93ace0ad28b9bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565921, "uuid": "68100a6a-54cf-4a7e-94b7-44adb13753a1", "comment": "Malware payload (Gafgyt)", "value": "8e52ebecd2149ff550cc803bd653f60cbdcf198538e564646d4aa7e0f748043cee3f7378799d526884ca406d8a639afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565921, "uuid": "5a226a91-275c-4d12-a85c-afc6b2f0f91d", "value": "T114C3F945F845475BC2D327BAE74E438C37355E6897D73311AA38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565921, "uuid": "7b881b10-df18-44a3-a109-b444f62bcc5d", "value": "3072:FDrS5Njub7G5Q3On0Ls3wZRmBoHQuQekQnYW:xSnu6Q+0Ls3KmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565921, "uuid": "a54a2f0d-065a-4e9d-aa95-2fcd6dec6da8", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565921, "uuid": "69727ace-557e-4f9f-a1eb-38ec98aba1c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565921, "uuid": "7c09d09a-6c41-41af-9252-50eb3d991312", "value": "580b6690e62436d274dea7db581284a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99032500-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683550524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550524, "uuid": "61eb5b2d-fa7d-4060-bf4f-5a15ae972f84", "comment": "Malware payload (RemcosRAT)", "value": "421b29969daff3c5a742f3d49a23854b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550524, "uuid": "2669ec53-7911-4539-813f-6ab7f90ccc64", "comment": "Malware payload (RemcosRAT)", "value": "8422180715a44f2f71122379534ff992fd48a484c98940c7cb5bc0013b08326b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550524, "uuid": "3236db35-3772-4fcb-94e1-78d3d0a2ebb6", "comment": "Malware payload (RemcosRAT)", "value": "4584baa6d7c8c943a442484978108410a81acb08", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550524, "uuid": "ada21731-3cb7-48b7-a8e1-57df5555bf55", "comment": "Malware payload (RemcosRAT)", "value": "7bd5388080a47660ba4a829994d6d6e2e4563e22bb2119a6950a8d32fa35ecfdb6f92e5c1e304f8204dc4754da997343", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550524, "uuid": "dbba44cc-cde5-45b4-b4d1-805d62c0cb41", "value": "T1A0E22A5AE79B02648F9103B3171B1E89A6BDB23EF3505572745C837433E9C3E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550524, "uuid": "835bcdab-e505-4074-944b-b40531441489", "value": "768:sFx0XaIsnPRIa4fwJMtUhcxamEQcK4aDz1BxuS:sf0Xvx3EMtYmEQc/KxuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550524, "uuid": "de87bd7c-9a7c-44c4-9ced-bad46619ff63", "value": 34000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550524, "uuid": "0d2d56fd-4904-40b2-83a4-7df75e74a79d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550524, "uuid": "9ad671e4-9edc-4f4b-9942-ab60f296fef9", "value": "INQORD45600.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda73e08-edbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683563121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563121, "uuid": "5f4e0127-9037-48cf-b4cd-6e388a4077f5", "comment": "Malware payload (CoinMiner)", "value": "9453b414b969dc9b52b9327e324dc1eb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563121, "uuid": "29e8801c-c84f-4b7a-b2f6-2bc1c807f696", "comment": "Malware payload (CoinMiner)", "value": "84c18f78f11b9bc3fd3e96925d2a7b76ab5ecfb927c377ad27456e191815b24a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563121, "uuid": "50677176-3d81-43cf-882a-78ca67c90a17", "comment": "Malware payload (CoinMiner)", "value": "342de51363d15f8fc6b5099ad0bf5f5191452b74", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563121, "uuid": "c5705204-70e0-4bdc-b129-85c974bf1433", "comment": "Malware payload (CoinMiner)", "value": "20d6f7a189b28352e03c72675d8135b8f22bb7f94559beaab84fa3b2c2a3d0aa18eb0adbc76e6407c3fce65f912e29a1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563121, "uuid": "72a7e8aa-b205-4979-a3ff-6fbd4eadbb1d", "value": "T1ABF512B32FC7FDFA93640A74B84216595E8028B74B2CF191B88CB5AB71A4564DE1DCF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563121, "uuid": "269a7b58-ee4a-4f0c-b97f-d68345b4a8ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563121, "uuid": "e917dae0-8ede-406e-bf2c-12541b8dc093", "value": "49152:WUGS9ZE245CHyDNPLno4A0pRxnNQpSKqemCcAfpX:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683563121, "uuid": "0abfd5b2-57ea-4866-8be7-b889080e0016", "value": 3490304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683563121, "uuid": "0936fcc6-34b4-44f6-84fd-43472ff5089e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563121, "uuid": "deaeee62-73da-4b8a-8323-a2087a72c85b", "value": "9453b414b969dc9b52b9327e324dc1eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c332b708-ed80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683537280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537280, "uuid": "7192617a-d273-4c68-be76-5108ef73a757", "comment": "Malware payload (Loki)", "value": "8cc158004c15e9dcae74414be7819658", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537280, "uuid": "79f92660-1b5e-4c51-be20-bffd3d569cca", "comment": "Malware payload (Loki)", "value": "850877e704f398dcf595d4e4f2f89d9e39f636ce49d35a0cb1696864b7f56e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537280, "uuid": "eda4ac93-3cf2-4bf0-92e3-46fab1986842", "comment": "Malware payload (Loki)", "value": "c3320a85c876cbd239b5f6e194ac6b4753a6240a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537280, "uuid": "0dfaeaf9-4233-4a1b-820c-c189868aee17", "comment": "Malware payload (Loki)", "value": "c0d22109c3caee9b5c3c0951a840354145e9983465eeb43c5a055f36ddf40544765f0d7e278d8fbfe29a36ab7ad7c6fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537280, "uuid": "be3f5cd4-c64b-4dc2-a9ab-32fd7b4cf443", "value": "T146A4026873B68AA7F40C49F85638B04123B172A7C9D0D3D85F322A499FE5F905F44A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537280, "uuid": "847f0af1-cb70-4d9d-a9b4-0ec4a5b8ca81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537280, "uuid": "5a18c11f-0c68-45da-875e-66fe1513c9b6", "value": "6144:YSv9CieGpDDZGcHBNka6IdPr7jqmYMSyv9tlM/uvuxvcj2s0lRe08GAYghODyTwq:31P9DhvlrD7j4Y1ta/mScFD08GAYgh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683537280, "uuid": "f15b92b3-695b-4ed2-8289-d116a1e60675", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683537280, "uuid": "9ea30946-00e1-469b-ae32-c3a969d84e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537280, "uuid": "47f9852f-75c5-44f5-b2c6-7287a815f5e4", "value": "8cc158004c15e9dcae74414be7819658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5c0021-eda6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683553398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553398, "uuid": "145c0bcc-e509-436a-bfa0-db650402fbec", "comment": "Malware payload (AgentTesla)", "value": "3e6850965fa13f40e05a1c416d8f2681", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553398, "uuid": "07cc7db2-c62f-42c3-a20a-f9ff137e96e4", "comment": "Malware payload (AgentTesla)", "value": "866e30140fc553f94493a28cae2b615924240cba323fd08f95ee0c716f28ee0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553398, "uuid": "265e283f-1395-402a-9197-9d67b8e609f2", "comment": "Malware payload (AgentTesla)", "value": "b2ab48d66b24f88d5cbc65b079f7d1ab3c0e9153", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553398, "uuid": "cb285929-1d44-4553-a1e1-2ed3b9c1c7d7", "comment": "Malware payload (AgentTesla)", "value": "0a0ebf64efbdbd67cca41f79344bd9c07fb34faef79cc5a48e46ed39bc65bf814d6709a2a44eabc986700d83791388d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553398, "uuid": "1958e7a3-5ad7-46ae-8d2b-ad2f233e710e", "value": "T1B5C4F15172B58FA1E5368BF01534F88103B230F358F4E65D0EF6A1CE6AE6F202A9575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553398, "uuid": "c58c7370-b158-48dc-9690-48d6ec97d60f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553398, "uuid": "c3ae7e12-3d75-4426-b456-e61d89d4ff67", "value": "12288:2VVGksHlEMtZsODNXW8FKpQ+qEg3N/X7:UKlKODxFrEqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683553398, "uuid": "fa53fad4-9599-4b42-89f9-70336ee7577b", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683553398, "uuid": "1d5ecfca-5b54-49b5-a8f9-4599acc0d521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553398, "uuid": "e9cea701-0c86-4b9f-bb66-bb208a49bddc", "value": "SIGNED ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e274622-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565914, "uuid": "829692ce-16c4-443d-a693-44a11dbfc73d", "comment": "Malware payload (Mirai)", "value": "110b9c4df6a774b547fe6261df6f7640", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565914, "uuid": "453d2fde-7579-4f53-b2ac-fe307742183d", "comment": "Malware payload (Mirai)", "value": "86d15c6595bf8318ce2e0ca46727a8dca0c604d3114e1bbc089b8eea67c046eb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565914, "uuid": "46b1fda1-2783-4bb0-b2fd-16dc3f990cf4", "comment": "Malware payload (Mirai)", "value": "0594b221c18a6e313d636276c5d026bd5cd0f3fa", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565914, "uuid": "2e9276c0-c7d0-4aef-bde7-b0323813f2d9", "comment": "Malware payload (Mirai)", "value": "9e6be950ee1c6425cf366491b2cb6e162c212497acb1ef1a531dfb003f8e0ed96408173e13b313b20a491b5701920c81", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565914, "uuid": "fe56c302-0ba8-4d39-a0b5-11de932d465d", "value": "T16ED2E17D978A0B0BD686C0F428375A2B986FFD92095F7DEB5F24A40206F74D0A56C425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565914, "uuid": "ee887efb-ca76-4be2-b7c6-7d4146c07bf8", "value": "768:LhAP7JIINnYOEzJgMoojL+xexp3e/e3RZ+dImO+o1sI:iNHNY30ouEhemhcdW1qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565914, "uuid": "da7db59f-003d-4026-9272-b9b11e001139", "value": 29248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565914, "uuid": "5d2b037d-09e3-4ae7-befa-e5ff87110cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565914, "uuid": "443769ff-6b5a-484b-ab7c-65ee362aeb79", "value": "110b9c4df6a774b547fe6261df6f7640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31f6cb5-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529119, "uuid": "99f5412f-f392-4fe7-913d-e2f35360cb7b", "comment": "Malware payload (AgentTesla)", "value": "1286c1c75ec4e5fe18eebbaeb2970d19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529119, "uuid": "360a2a2d-4e74-4b37-8407-ef527e56df31", "comment": "Malware payload (AgentTesla)", "value": "8743e0488e2396c788528f3febac8b7ced15f219750753231918a2b67a40ca8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529119, "uuid": "20dca3c6-d7c6-4ab3-aa9f-c86dc426cd02", "comment": "Malware payload (AgentTesla)", "value": "05b4345cf5d432614db5fdb35535723674ba1f93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529119, "uuid": "e02fff92-55dd-4436-9b47-c137a7a28d88", "comment": "Malware payload (AgentTesla)", "value": "c3814be30b8fcb3ff7e5be053d7bc126992bb75864ac3e35ab52586833fdc75f27a491ccb9963f81852f85032b84f9b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529119, "uuid": "951e5045-2f87-47b1-9810-d427f684ab5c", "value": "T1ED15933D24FC3612D1B5E6B2DB94E460FBD0859672358DDF2AD640861AEF90236CBC2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529119, "uuid": "39ec94c9-8747-4618-90bd-4c91644c5a79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529119, "uuid": "eb00c210-82c2-4dff-a07c-58bebb345a8c", "value": "6144:sQb6caGYmnEoRhUaN9B6Yjrlsj+jGhrM6Kmc67x/i8bb1ps4DM9H8BrJX9xXFgna:sCjlGhrZ9c61tDM9HQJjdvhHX2n4uWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529119, "uuid": "739d9309-aa21-4130-aae2-0cda0fda960d", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529119, "uuid": "675af217-12dc-48b9-8997-63356961ee22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529119, "uuid": "d1bfd35d-f5d8-4f79-be43-212251801d7e", "value": "Order 230325174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fc782e-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683504663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504663, "uuid": "6cddf027-e3a9-4d61-8944-8a903bc4dff5", "comment": "Malware payload (AgentTesla)", "value": "df314fcd1399753190aec99b8e01fb57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504663, "uuid": "272e71cc-6a77-4f69-863e-7e8d72410c6c", "comment": "Malware payload (AgentTesla)", "value": "87da8a3667cd660f0461d3f41f5465f9b3f21f4426e5f5ca3295e347e911a246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504663, "uuid": "623ccf03-0ffe-4406-a37a-fc982439128e", "comment": "Malware payload (AgentTesla)", "value": "5447a24f839e7ed094e38460cf06c4d6359b1555", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504663, "uuid": "b21a86ce-d6f9-4c27-9eb4-5606a9c75472", "comment": "Malware payload (AgentTesla)", "value": "2b17dcdb34e2efa2325e3e72eed4af8b553e98dbd2b069dcdf4e92ed7514dfa66bf47506024a831d8639d572fb10d3b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504663, "uuid": "3dc652f6-8b17-4db0-a3b0-fff1f5a74f37", "value": "T19E441204B8E0C1F7F87301712A7E1F9BBFBB9B531892AB0517305B09BD62964A90F765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504663, "uuid": "084fb2a1-3535-4346-a877-736f610b1c92", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504663, "uuid": "12d5febf-94ad-42c4-a631-9223325bb062", "value": "6144:PYa6hXNeahZ4wOPPj1KFZPm/ZYLBUekrOj/kyYGma5YqBocvOU:PYTXNp5OPk5kS/kFaumOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504663, "uuid": "d51f62e2-11a4-4b49-84c7-7ad294d41b73", "value": 275906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504663, "uuid": "97d09676-5ad3-46ad-930a-2971109f5752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504663, "uuid": "37de39ad-f34d-4ad7-a846-509f511a2edd", "value": "df314fcd1399753190aec99b8e01fb57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53d3a9e-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683534787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534787, "uuid": "9df0c321-cfe7-4ebc-8db5-8ce1003689ac", "comment": "Malware payload", "value": "e9effa3bfbdde3dc4df286bc28c61e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534787, "uuid": "fd1607e6-7366-446f-9fae-cb36adff7bc4", "comment": "Malware payload", "value": "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534787, "uuid": "b2a483d3-3907-4da8-8837-6df029d79a72", "comment": "Malware payload", "value": "3295f74dc43161fb2f98deb1732d278ea596b5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534787, "uuid": "bbd9d782-2b50-4b8f-bb66-44a09269f3e3", "comment": "Malware payload", "value": "725df199b5a90a51a731e785a24c9e35b7621857269b77198cdfe7ec8159cfeb59748f23ed1138629c6cfa6662032b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534787, "uuid": "88dc219d-7163-456c-abd4-1d6fad4abc5a", "value": "T1F8A52304ECA3C8D5D6F788C1A65ADE25B22CF2500D523E0E49F4498F75AF715A3E8A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534787, "uuid": "d2853e9f-e0e3-4e7a-a0f7-5ec7e68c26ba", "value": "49152:8xO6EyTNW+sbGWx2E4yP/CxTxyHgrvH7DG01fqL:8xOlsWWdEhop1fqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534787, "uuid": "07ebd76d-2d17-466c-8e72-493d966a8396", "value": 2214475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534787, "uuid": "ad1c4bf6-a5db-48e1-abde-22a29d94c132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534787, "uuid": "46f80d42-117f-49b2-9354-5768a58d8f2e", "value": "e9effa3bfbdde3dc4df286bc28c61e31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000fc257-edba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683561863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683561863, "uuid": "f7c75b6f-eca5-4ab4-b789-4665b36f938b", "comment": "Malware payload (AgentTesla)", "value": "76efcece384fca2dbf2840aaf0521e29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683561863, "uuid": "d21de64f-7646-47cf-8731-aa2a7b83bfde", "comment": "Malware payload (AgentTesla)", "value": "8838925ac19a77ed2817ed8e52b6b9db02d58987dd10774eac576f839df1c5f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683561863, "uuid": "45fac80a-40bc-4ed4-b73a-34f09519e1cc", "comment": "Malware payload (AgentTesla)", "value": "3d13557865e04d81d3f837a89bacc8455ae0d005", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683561863, "uuid": "92e5dbf9-47c2-4981-bafe-e490f96af6f6", "comment": "Malware payload (AgentTesla)", "value": "a97ccc0f7fc9927368464296e62f35d59b4b682a050e1411f21b02327bc0be835704e1f8cfa479ea41874e9806553982", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683561863, "uuid": "d9ba5508-09ac-45b1-96a0-08eba5dc1575", "value": "T1F9F43647335846D2FC658FF0C8297AEA32E7BC9668E0D65C0D95F0F51BB1ABE1940E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683561863, "uuid": "ba3b8c11-abb3-4e37-9376-4af74898af87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683561863, "uuid": "65319c1e-9c6b-4385-8e5c-02a44e06a59d", "value": "12288:zmdF3JQcpDvnC237A+EcTvu2C6AFDPBwncjf60Ye1urt:KX3JvnC237AjcTWMkLBXf60Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683561863, "uuid": "35b769df-3299-4c0f-83f1-af717b735918", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683561863, "uuid": "4f1a077d-f52b-48b3-9ac9-3b90e58b538a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683561863, "uuid": "1ea41db0-3a4a-410c-9f68-af6d41dd2add", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660fd85f-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550438, "uuid": "70010993-3e4a-4a02-a2e1-2b17de3ff22d", "comment": "Malware payload (SnakeKeylogger)", "value": "5e738510a2034921441427f5af1ed72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550438, "uuid": "dbe02beb-c68b-42aa-aeb0-736c2a4ba2a5", "comment": "Malware payload (SnakeKeylogger)", "value": "886e952321e1eae1a50c426ea8bff0e574d28a33ce33d85613f8cebfc45c7845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550438, "uuid": "6830e4cd-c5d9-442d-80cf-3567bf815b68", "comment": "Malware payload (SnakeKeylogger)", "value": "5bb185b7bd5036d9eafb28770a22d61fef17f3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550438, "uuid": "dded71bd-676c-47d7-b51b-2dc24172b93c", "comment": "Malware payload (SnakeKeylogger)", "value": "2131fd323454523f24e19b063b98673a135b11e5c9c6285f94d1cfd8c826b240b303109f8eb6d808868cf5356413b2eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550438, "uuid": "284ab5d4-3798-4de5-835d-4c46dafd752c", "value": "T15715124532FA8FA4E576CFF41A38788003F170E759F4EA580EE561C96BEAF4065A170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550438, "uuid": "cf974bbe-b8d7-4b3d-8a1d-2aa96622db58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550438, "uuid": "fcbaac05-f616-48af-95a9-bf1f41a207ac", "value": "24576:zIejKNDVB3bMgoucsKg6CH+MYuMW2tS5Sg4ulNKQ:nKNDVBoYcsKVRPtS5N4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550438, "uuid": "ca3a2bbc-ff96-4682-ba94-86fbbaf92732", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550438, "uuid": "01caa8ee-d17b-4dd8-abd7-ddc94be99906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550438, "uuid": "0395264e-848e-4d69-aa6a-c01b749285e4", "value": "SKM37891098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eea0498-ed68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683526804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526804, "uuid": "72bb601d-93f5-4879-bbdb-ca5ea43d4903", "comment": "Malware payload (Mirai)", "value": "634ad6ad5d1f0cc9cc83ef1ff2f03af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526804, "uuid": "7f31457d-e161-4515-8b01-5bc7275cdb56", "comment": "Malware payload (Mirai)", "value": "88d970947e4e0f008305a34e256871c93d156e17a0ed10571180d4f1f371fc34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526804, "uuid": "41c652bb-6def-4a28-8570-a3a6566c49a2", "comment": "Malware payload (Mirai)", "value": "e7c90f902a1810fc96e1e0a7d7b194c8763ded63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683526804, "uuid": "b049a438-ce59-4a7e-9b3b-54ee1964edf8", "comment": "Malware payload (Mirai)", "value": "411d22d67d47b14c74b99dbda56a3f77fafde827e1accc8e2591723c91a6a5d1f36390851ce76fec20f80bb469e24a58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526804, "uuid": "2eec96a8-55fa-4891-ac34-14bb62f69860", "value": "T15B436BC4F643D8F5EC8715702077FB379B72E1E922A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526804, "uuid": "8933bed6-953e-427c-8fb2-b69361814db9", "value": "1536:JeESt/basV2rcZhG6ySN7naHlSR9zWOIaEjrqM8s:JeESt/basVTgS7naHQRVtXESj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683526804, "uuid": "39167e3a-3a99-45e9-bfa1-072606b6663d", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683526804, "uuid": "17bd08ad-9204-48de-bc05-847c6140cf4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683526804, "uuid": "939834d5-baf4-48ca-bab4-814e8002d9bb", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e289ed-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683504700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504700, "uuid": "631d4766-c37a-4390-8591-da0cf9312404", "comment": "Malware payload (Mirai)", "value": "91ceb8174b86aadc39171bf2f14592ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504700, "uuid": "b83d7ceb-08d9-4ed3-87fe-d7fbc6c0213e", "comment": "Malware payload (Mirai)", "value": "8951b1796920db1e9ef30c074529da91e2f6fd058aefcc74b6373426c651d2d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504700, "uuid": "a9578420-8f13-4fa8-b58f-578256e8bd79", "comment": "Malware payload (Mirai)", "value": "fe805bdccd54988fb528596bec820aac1ed43ad5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504700, "uuid": "b8f52a0a-859c-4a07-8ff5-eb4bbbc84144", "comment": "Malware payload (Mirai)", "value": "f999dcb7f63603f87525ced20cada766d615974ad00330121b7c4104e4747860022d3ec05f1e404df8058d69d0d093de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504700, "uuid": "8d882f37-1d09-4c23-9402-7b6b10be3efa", "value": "T1C72319D6F4029E3CF95FE7BE84134908F621735160930B2B57ABFD936C321695E52E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504700, "uuid": "71a765b1-a4b8-432a-afb1-86b54f80ce17", "value": "768:YmPlGnKfJd0EkyJnf/UUL3rX7Y2KJMEQw9cK9/+S8RP:rkKxd0GJfVL3rLYrMEQwKKFJ8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504700, "uuid": "888edf83-4a85-4e04-adc7-36a12989ffd7", "value": 47256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504700, "uuid": "f830690e-993a-4737-9338-27fd3e9a5ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504700, "uuid": "e65e66dc-2f06-4e50-bcb9-fbe3f65ab29a", "value": "91ceb8174b86aadc39171bf2f14592ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e3baf6-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528580, "uuid": "13e5b2cd-20c2-4544-b7bf-595c3a74bb89", "comment": "Malware payload (Mirai)", "value": "a5b299c48dcc7d61eb464824482fbbb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528580, "uuid": "6571589e-15f6-4fa8-8f7c-b55f8bcc1d54", "comment": "Malware payload (Mirai)", "value": "89811478f714260d54062c115420ba21a174f4bd57565251abff5f984d8318c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528580, "uuid": "ce85df85-74ea-4e67-8a7f-8851da945da7", "comment": "Malware payload (Mirai)", "value": "9a5e00a55fd54be53b26a133ca24cac13f7de16d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528580, "uuid": "9c0f0d5a-7495-411d-8bf2-bf03905350d9", "comment": "Malware payload (Mirai)", "value": "abf882801b1f8920c23c9c82b92c5ddb1453f20c365292479563e445b0fc093de32ffab9f616354eac13d1bf35cbccf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528580, "uuid": "ff1186bb-a0cd-4f32-9b0d-666851d75634", "value": "T1F003F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528580, "uuid": "03e310cd-962c-48be-91cd-692b670fc52b", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTN/NMwWN:AfWb8G5fblUlfbgeaUv+fE+HWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528580, "uuid": "2762dfc2-d0a0-4ed2-8c5a-eb59b71455f9", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528580, "uuid": "35fa2e1f-a4e8-457a-a74f-983b7c639d97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528580, "uuid": "4ee25753-8549-43c7-9ce6-d89c9c42000d", "value": "a5b299c48dcc7d61eb464824482fbbb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9b580d-edbb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683562339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562339, "uuid": "fbe86ba6-a53a-419a-b6b6-5e963c234997", "comment": "Malware payload (AgentTesla)", "value": "127e72f18d103242d53c3f2f985afbc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562339, "uuid": "049de2af-3b06-4c2c-95fa-e5d52e35664a", "comment": "Malware payload (AgentTesla)", "value": "8ab970bd939d38f2d99d43e9d831a4871ad22edcb0d1287d3782a432050b30c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562339, "uuid": "0387004f-09d1-4969-878e-8fcfe874c061", "comment": "Malware payload (AgentTesla)", "value": "ac5afe586e2076e137d4e6590d7a342ae4ad1349", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562339, "uuid": "f3f2b4a8-5ef5-49c5-858e-7c700350f369", "comment": "Malware payload (AgentTesla)", "value": "4899d6971926b948a943c7f716b5af972d5792fbe0d2d9bb6faf6020a6ba9b324b0697c17e623e2883087833e0cdb56d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562339, "uuid": "3f377488-0f3a-4953-8703-54452a026dfe", "value": "T185E45C3A15689BBAF279C734866C4460B3FCA41FF341EE69BCDAD0E409C2D41A6D352D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562339, "uuid": "8dd6e86c-76c4-4878-b95e-e4ac6d3a82b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562339, "uuid": "d5bc2997-9a6f-4758-a440-2b3bf6d91e76", "value": "12288:tc77oMdswXyPuuBO9fRPOGyRR0BebpN9hHbBjktDB5UKlbWJppCBvU8u2KIQoYjK:gqOrOv0BeFN9zjUBhMuJmF59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683562339, "uuid": "edee962f-58fb-4441-aab7-851ff157f8f0", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683562339, "uuid": "7c90e668-be3b-4d33-a816-56d7fd403704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562339, "uuid": "bc2816b1-fefd-4d8e-8b37-8f67778def09", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0eba53-edc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566234, "uuid": "18bfcf92-6eff-40aa-9fa8-500af33d0c80", "comment": "Malware payload (Mirai)", "value": "b97aff5142a987840cf8a8b0fcbfba46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566234, "uuid": "b4525d33-379a-43cf-b098-1f2c936571dd", "comment": "Malware payload (Mirai)", "value": "8bc2c497e50eab58d318ed08d8a848edd4bc8e08b88080add4fe3b6541d809a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566234, "uuid": "3f8626c2-8ca4-4da8-a499-ff74b5db0c71", "comment": "Malware payload (Mirai)", "value": "cb5fee80394374b99b872b4273726a66da58e69f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566234, "uuid": "b4a300fb-3217-42d4-bc09-9a43d03a0c3e", "comment": "Malware payload (Mirai)", "value": "8fda1359669518c361db38742917f9dbc57186f6d93bb2c498dfc7503df2586fd5bbb8c8ba128d224ba6e604f94c64a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566234, "uuid": "531b5224-6862-49a6-9cd2-f39da48b1f0c", "value": "T176C2C0646DD7EDA2CAB10477E916C582E31706B4A2EE707AC5004B78A2C093778FFA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566234, "uuid": "b63682c4-bd02-4e93-97d1-9bf4ba1c8613", "value": "768:kxRlNoEPlkSHHo8pQVAx/An/0RTmCRNs3Uoza3o:k1oUXo8s0RTmCRQza3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566234, "uuid": "e91d3096-c3bc-4b89-bc8a-598c42a731dc", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566234, "uuid": "4749cb7a-fb34-4958-8a3f-53cd5ff59398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566234, "uuid": "f7231f66-0488-4897-852c-9a49e74d9866", "value": "b97aff5142a987840cf8a8b0fcbfba46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c0ef75-ed55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683518594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518594, "uuid": "180fae90-ead0-4658-9b8d-265d4c0e75f3", "comment": "Malware payload (GCleaner)", "value": "7cb4c270d1a781c5b87b9733f9e73ebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518594, "uuid": "a957c15e-fa72-4948-b222-174478d97d55", "comment": "Malware payload (GCleaner)", "value": "8c21b42779afd2a536ddd8520791c84e268ef29b8deb4c9979c00e52fee7fdca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518594, "uuid": "6525d314-a918-446d-acf3-d6d9c5166b46", "comment": "Malware payload (GCleaner)", "value": "0e1f7c46db3c7d919e7628fc0e25167393c46f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683518594, "uuid": "c58e55bf-05c7-4853-86b7-3cff3ee8926b", "comment": "Malware payload (GCleaner)", "value": "5664031128426d21003de6afbfbb6d45d6a2cec4982aff35fcac4701dbb37db8f293b46f7b322e3e4cb6b39d90b0f044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518594, "uuid": "31d4ca9e-158e-4830-8beb-454ae666e894", "value": "T14F9533878B9A823DD255FBF50D7AA5068FF8B950306C688476C98C6DBE3F4C71C1325A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518594, "uuid": "0ca8a8d9-85c7-4ef5-abae-2e8761b9bda4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518594, "uuid": "532ac6d0-e99b-4b8e-9cb3-6b291be0cf6e", "value": "49152:QhNrxZkxhQTQHM391f+eE/XR23bZuIscCs0pkQXcR+WAG5c/:QLxZmhEF9d+QiBskZWXc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683518594, "uuid": "ee1b2817-9030-482b-a7d0-4838a47da14f", "value": 2023654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683518594, "uuid": "1333a963-134b-4d3b-80b7-aa7a4540ba18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683518594, "uuid": "69da86c2-9126-4136-9458-d11e622a2bf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adf72d3-edad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683556298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556298, "uuid": "8ac07fb1-48d3-4d44-aa65-d5b89e2a4b62", "comment": "Malware payload (AgentTesla)", "value": "38e58f13850cc52dc3416b6020e93177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556298, "uuid": "95d69c40-0cc6-4fcf-ab0c-05d9b6b5fdb0", "comment": "Malware payload (AgentTesla)", "value": "8c307fced5146d81f7ec8c083337d3c7e8a92ff09a05ac20bc4b4efea7826821", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556298, "uuid": "d093b3fe-d104-4b28-9880-e4bb810ccbce", "comment": "Malware payload (AgentTesla)", "value": "3df1acd75d778378a46e25212d441380ed704083", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556298, "uuid": "841089ed-dc6c-4567-844a-0d939e99eaf1", "comment": "Malware payload (AgentTesla)", "value": "57a2b9ae0b84edb8d1552f701a286877fa57b3db1e9e8248d89a5262393c151ac9f521b1142170dc152d5cd26a399927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556298, "uuid": "f155c447-9d34-4a25-ac73-46c28993a201", "value": "T1ED74397C7348DF05D61C433682E22608A1714B9A5622E67F6DC73DD87A21BCB4F0DE9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556298, "uuid": "cd54b2dc-78c5-4938-987c-b1b8c6534682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556298, "uuid": "8d0acb4f-c42a-4b52-bd21-1f059d228114", "value": "6144:BlyoEbgxi/j+vgVzinY77o9TBaCViMNErE4ConoFkHjIlBFNeYTtrUIr4vheOZP:PyoEw4+oVziucTBJ4mE1Conw8jITLzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683556298, "uuid": "4208da0f-b002-4eec-899b-15e22840996b", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683556298, "uuid": "82b7c8e8-84ca-4820-a945-52064d34da19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556298, "uuid": "6ef15abe-776e-4cea-90d9-f5d0b7daf52a", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b4789e-ed5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683520826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520826, "uuid": "a9f224b7-8835-43e1-9d49-04d36a9bd4be", "comment": "Malware payload (RedLineStealer)", "value": "be86fbd42fce70e24db66728d0a1bf00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520826, "uuid": "60843b0c-1bc4-4571-95ac-cbf4ee4ddfd1", "comment": "Malware payload (RedLineStealer)", "value": "8ce111dc6707a72e8e6c27b21c23c5daf52056b149c71f3bd6ee10da957339ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520826, "uuid": "ac43db69-7bfd-4835-a691-f03242c9d22c", "comment": "Malware payload (RedLineStealer)", "value": "a45657424acc53aa2ce6c13cf7bed7e98711a401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520826, "uuid": "1f536b4c-139d-43fa-a81e-c9f99521b252", "comment": "Malware payload (RedLineStealer)", "value": "1f99ae90f2efc7f70f815c882f85baa47e23aa5e689cecc7891a31cfcf07335d63909094884c7aaac0117fd51ebffc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520826, "uuid": "45c3ebd2-1489-4335-bf38-2cb0fdf03b99", "value": "T1F5F3D568364B657EC96F883D9C600CD1777CAC622246A7439CCEF0E9393AB919F151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520826, "uuid": "c27a9fbc-bb01-4ed9-8d13-9c233511a273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520826, "uuid": "ff73e56d-0488-4797-b7cb-79eb8f54acae", "value": "1536:wMnuIYfFJ8EqlVZRGW+QOrpmTamjpv0ApyTGqVwbu0HlHGUyGnJ+83wYkg8e8hM:eZfYgfm9dVHqVAJmUyGnJ+W8e8hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683520826, "uuid": "7bb7949f-c301-4726-aa8a-1308c77fffa4", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683520826, "uuid": "899c943e-c591-442b-b48d-9f665c364ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520826, "uuid": "4392eb39-87c1-4347-8c3b-4472b22de63a", "value": "be86fbd42fce70e24db66728d0a1bf00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6065d073-ed46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683512203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512203, "uuid": "e64aa40e-7f59-4c0c-8bce-48f5cc6c7ff6", "comment": "Malware payload (DCRat)", "value": "657701c44753e8da1653e5855e5b9b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512203, "uuid": "36ae8f98-a97d-4158-aa89-2681ca97551c", "comment": "Malware payload (DCRat)", "value": "8ce939e78f764da1da27154cc2c2b9ead8c4fd9c3954958bde1f2afa423dd218", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512203, "uuid": "e169384e-2b6a-4977-b862-10eb4b870a6e", "comment": "Malware payload (DCRat)", "value": "2f1c085d14acd263fa319a24430f834a114ded6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512203, "uuid": "4369eda0-f1c0-46fa-819d-b3bdde0e95a8", "comment": "Malware payload (DCRat)", "value": "67140aa26333c689dc2d22217972eeb5477659782a8ec8472d8668ccf676ca5377319a82a18505c1cac34c00a50cfce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512203, "uuid": "35576d65-24af-4975-aacb-ba659da69b96", "value": "T1BF86BF7BB612CE68C0CAC670919797B15B20BC1404B6630776DE372E6E72B402E6D9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512203, "uuid": "6ab45378-fa84-4a85-8394-16f71304e62f", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512203, "uuid": "0a3be1d3-ecf0-4a68-b902-71ebcff1b970", "value": "196608:qvsE6DZiQlPjq/0zEwzxa8BWPLIbymyP3:qWDZiQhlXzxaKP6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683512203, "uuid": "69a50d61-a13d-4016-8d81-14440b473181", "value": 7849095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683512203, "uuid": "2ebbbf52-168f-40d8-b8e9-e29e431db833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512203, "uuid": "f5b19150-fd5a-4270-9622-addcd8c0fbe0", "value": "657701c44753e8da1653e5855e5b9b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc3a5a2-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530318, "uuid": "09ed5f53-4321-4b82-9c4b-e4102ac8c91b", "comment": "Malware payload (Mirai)", "value": "cfd22340e197fe2fbd932fad094c70fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530318, "uuid": "bb1839e5-5633-4e1d-9331-da8eb7b46f0c", "comment": "Malware payload (Mirai)", "value": "8ceeb5fbd124d8f80750c042e941c24d122a72f0620739ab4eeea38702116004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530318, "uuid": "f7c1dea6-dfb1-413e-95b6-6409caae3f21", "comment": "Malware payload (Mirai)", "value": "85598f8d4999beee84aab1103bce2b70083e83f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530318, "uuid": "c99f98e6-72d5-4965-855e-d207760e394d", "comment": "Malware payload (Mirai)", "value": "40659f25c998d8c46d63f388261d876b2688355c8083c037431cd82f72a29a2dc3e139b605f28c3d4c570dec1bd920b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530318, "uuid": "a504da5e-edf8-4ae7-9892-c4d8af931100", "value": "T1E0438D92CC3D2D00C05442B0A274CFF95363E455969B2FFA177AC6A6A443E9CB68F7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530318, "uuid": "895a221d-85ba-4603-a222-98da48f2a6d0", "value": "768:xoIU/5BB8YqnTRo7Lqno/bDDR4MU6vUXUohGndUcLvF1dqToXozQVeCKIbAS:AQYCCCo/bnhsXrhGndPt1ckXzVeCKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530318, "uuid": "f1fb8ca7-9aa8-46f3-920f-5c2d5c7a8f12", "value": 55300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530318, "uuid": "b33f4ddd-1034-46a0-b488-8ace7131f222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530318, "uuid": "5a961906-5f5b-448c-a489-c2383a64e620", "value": "Andoryu.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6865f1f4-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683534980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534980, "uuid": "8daff617-68a9-4fd0-bb16-6b6077be4426", "comment": "Malware payload (AgentTesla)", "value": "2f3c57f8633a56029c3b832863af0dba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534980, "uuid": "778cc506-2dcb-4af6-907f-d428179b99a9", "comment": "Malware payload (AgentTesla)", "value": "8d1e9f52f24cb93e8030726b63b48d43d90e18390b3571f52f9326964e5de23d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534980, "uuid": "7070b72f-bacb-4f00-a324-3816c9c98401", "comment": "Malware payload (AgentTesla)", "value": "af824920eb47ae93f81de88a3713c21ec58ee5f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534980, "uuid": "b1606b76-d90b-4f3f-8e16-cfc823e87d62", "comment": "Malware payload (AgentTesla)", "value": "5ed999d1b1dbb4b4fd97b359e39794bf403a7cba014f623fba84d6995e294ecb8032dcd0792e98a00c5e304b16688c63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534980, "uuid": "12626da5-fc47-42e2-a519-ce860cdf9eb3", "value": "T141C41254B5F94A67FC1A09F46428B95023B170A7C9C4C7D84FA6288CAFDBF406F446AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534980, "uuid": "cc778ff3-bc0d-4e8c-a8a1-3b070c59f5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534980, "uuid": "9fa86791-287b-45b6-8643-2233c9dc60b6", "value": "12288:gY+9UoBK/2OnzllnnZkcscWwGCWTVhGEpo5AN01+ahF:gjvfOzznZ+ceJsEC56ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534980, "uuid": "2232bcfb-0e7b-4f54-8e1a-eb8c2cf6cc95", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534980, "uuid": "6ad7a9a8-ca81-4cef-b9e2-ee3b373f4a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534980, "uuid": "a0787c1a-dffe-46da-a9ad-d088dfa2a0b9", "value": "2f3c57f8633a56029c3b832863af0dba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4fc98f-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683534530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534530, "uuid": "28ad2288-9e7a-4387-b2d5-94d53f43defb", "comment": "Malware payload (AgentTesla)", "value": "665c53f051582d4bd744f81c8ab3bf91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534530, "uuid": "f1d8d842-4fdc-401f-bbe4-4aca5e5954e8", "comment": "Malware payload (AgentTesla)", "value": "8d7cb3ea332af3f322d29710f6a59aca7be468a27082c341e20a0aae49359e23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534530, "uuid": "c1813ded-a560-45f6-8cd9-004cb66eac47", "comment": "Malware payload (AgentTesla)", "value": "f6bc137bc585f5807d747d09685f64f510f3379b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534530, "uuid": "7ece8348-ac90-4d05-8ff3-373b523e467e", "comment": "Malware payload (AgentTesla)", "value": "396db270acd597ae62c78f02de91db1d24b2c123376589129968da15faeaad90ca2822e369f2f5723277ce2f8b4b2779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534530, "uuid": "36eee416-0081-4a8f-a8e9-687b192d5981", "value": "T1F0A412A1D668DA65E2A5B33BCC9041A02FA26EE75DC54F243D54D11A381BFE01F20DBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534530, "uuid": "e44ce6a0-f0ae-42f8-ad64-302031d017a6", "value": "12288:coLdDObiL/1k9ZZd3UHYYMDZs1NWmNM+hklt48t3vA5VEo8:cKW9rm4YMe1Mllt48RvA5VEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534530, "uuid": "1d3b4223-4a20-48e0-8b91-0831b5484253", "value": 461704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534530, "uuid": "20ba42c0-332e-4eba-94c7-fa56e7cd1d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534530, "uuid": "a9f43569-a5a0-4797-b8e8-1199db9cc0ad", "value": "HSBC Bank_MT 103 Transfer Copy_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52bc919-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683550651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550651, "uuid": "35e04f92-de93-4ecb-bf0f-75d7dd392066", "comment": "Malware payload (AgentTesla)", "value": "5baf411e6e472abc3b60d13e36efe756", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550651, "uuid": "6be1289b-e5fb-4248-8769-e6914ee58f9a", "comment": "Malware payload (AgentTesla)", "value": "8d9ee26ff16ba2d8a4aadddf38b00e02d5b09b584fc7743609c594adbfdb68b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550651, "uuid": "7f82b5cd-4244-4eac-aa26-b7671b79b454", "comment": "Malware payload (AgentTesla)", "value": "13932b78baa8add3c2bf5f58cb615027f08252c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550651, "uuid": "1a521a53-c50e-418f-81ce-a1562627da61", "comment": "Malware payload (AgentTesla)", "value": "5d9b8dd1ec62233ed7ee42dd8cdd9bc25885961d73931195c76df2c1f7a0723dad5173e369b326f5aed073ee4d0be521", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550651, "uuid": "0f0a252b-ea83-44bf-a2e9-4111cf073af3", "value": "T1E934E04277C69212C55A2A32D0EB012903F7DB8726B3D74D7C8942B81EC2BDE5EDDB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550651, "uuid": "54f85574-a1fb-41c5-9c1e-c1d53c9a578f", "value": "6144:4Pc0K01SXzOG7rcqzp2ROobxKcYz36hqPIoiCF2WDJXzLn4:Yc0K01SiG/Pm1kGaIg2WDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550651, "uuid": "5ba35797-1518-468a-9e85-8e685a170d7a", "value": 249928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550651, "uuid": "bbcbe95d-64ca-4fa8-bcc8-ace15484d765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550651, "uuid": "59f6a010-57e0-4ff4-a9b6-4f20142f25d2", "value": "MT Bei Hai Feng Huang.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e65ab2-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550329, "uuid": "3726ee21-65ad-4f11-a8fd-dbd45b413158", "comment": "Malware payload (SnakeKeylogger)", "value": "065e91a89bedc9479f55254458440633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550329, "uuid": "817a9854-fd6a-4baa-8347-bc7443053847", "comment": "Malware payload (SnakeKeylogger)", "value": "8fb29a999e6c92b4511cff2615d6e518ebb42028ec49652ea76e1d8322166b17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550329, "uuid": "8da92a56-0c73-4651-b050-a523bde2cbac", "comment": "Malware payload (SnakeKeylogger)", "value": "2032dd29dd773899b804273d9cc156bbb380f5bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550329, "uuid": "7579fdcb-b2b2-4f8c-81d8-8b57f36a9837", "comment": "Malware payload (SnakeKeylogger)", "value": "d9a865752b41effdfacd3b0a524eb08486f4d1f5eeae6d1a429a8ced3073ea344862a816718534ebbdaec9466e7ab64a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550329, "uuid": "769dad87-a4ff-477f-9786-6fd2735100e4", "value": "T1CC053BD1F1508D9AE86B46F16D3AB43015A37E9D54E4C10C5AAEBB5B26F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550329, "uuid": "f86b1fb4-a156-4b2f-adab-8621d894256a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550329, "uuid": "cab5d7b7-314c-462d-ba1e-4c47f79fc565", "value": "12288:+0KBDpiFJ+c6kaov+KpCoQZyH5ibzNu5Cr:rWpqJ9BTSyAXmCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550329, "uuid": "f22471c4-e104-41de-a716-ae2469e5948d", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550329, "uuid": "29cce078-8858-4599-a557-f7068d6c9ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550329, "uuid": "df3cc9d6-35c1-406b-a53e-315483112228", "value": "T\u00dcM BELGELER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673d417c-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683570197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570197, "uuid": "05d63783-7579-48f0-9ad5-c4ff4c6408df", "comment": "Malware payload (SnakeKeylogger)", "value": "f8217bd63821efff73b3e0f55d6a1a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570197, "uuid": "c8f7c9b4-f20a-4b3b-b4f8-327b8bb6e677", "comment": "Malware payload (SnakeKeylogger)", "value": "92f0a55426e5040dc80133f908906acddaa338792783507fb0bb62d5b786c3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570197, "uuid": "c6eb0314-98fa-4e47-a4b9-4291514e34dc", "comment": "Malware payload (SnakeKeylogger)", "value": "5cbae2649da060bac1602e62ba641b1d85b24fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570197, "uuid": "126ddf5e-6249-443e-b963-a2a96a78b486", "comment": "Malware payload (SnakeKeylogger)", "value": "2d866fda5b6400788d8292e10efa1b29971b1cace00d60a377573fe5e24fb33cd6b9ec028786f77a0243ba21272fca84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570197, "uuid": "2b508d35-b3a3-4283-bed4-c3ebceb81252", "value": "T12EC4F04271E5BF51E42E4BF42864324507F2316B60F4F26C8EE761D96AEAF401B41EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570197, "uuid": "4f051949-d607-4f00-84bd-63617f81bb79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570197, "uuid": "d5f486ca-d2ca-4e11-80db-13b219d1e580", "value": "12288:+8ds7D6nFhjN9OB7Vkm3DpfVLkLfWzaWR3z:+8e4VN9bm3NKSh9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570197, "uuid": "c94d2061-f2ce-4803-b910-f35f98043e83", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570197, "uuid": "34df08ff-f177-4106-9c4e-fa9a39ce6a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570197, "uuid": "d6d155d1-16da-41eb-a2a5-c72d7b9bc242", "value": "Request for Quotation - CRPO-02 Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d975230-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565913, "uuid": "d895ca42-a522-4dcc-8eac-778008e6a0c0", "comment": "Malware payload (Gafgyt)", "value": "d0c6ef6e6418c6861283b5592aef4432", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565913, "uuid": "3859ff01-7dbb-4676-b95e-d36c11241f0d", "comment": "Malware payload (Gafgyt)", "value": "9466dbcc980cb8029e8d007ecb3d462def505d0487a004661bd7405895a3fd93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565913, "uuid": "0d4e8ecf-6fc3-41a2-ae75-7ce3b29c8f14", "comment": "Malware payload (Gafgyt)", "value": "68bf8b0b7bb120da900eea27cf8f3fed747fb0e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565913, "uuid": "1b0370ae-cfe7-414d-b7f3-35c9b5d0a43c", "comment": "Malware payload (Gafgyt)", "value": "dcb9c984cececad65f7876816d8463a57155ed5f6acd3014100ed9b67e2359c7224b9af120c98aea76ee1bea3a168185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565913, "uuid": "d5dbeb62-8583-4fef-92ed-eec2c16ffb31", "value": "T1D4E3962E3E21ABBEE16886310BF76F70C39529D636A19346E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565913, "uuid": "e9d503e5-ff7d-4bc9-93d7-42fa0fcf8e54", "value": "1536:mVNs7K397V+nT57Abf6l6T6B6v6N6/6AePe1ebeZe5/s18c2rKA49xXAQTI/e0hn:vMQhWTXAQT4NCFj/ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565913, "uuid": "b1750763-815c-4045-b3ce-1f2d9a09c335", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565913, "uuid": "3195f147-7c89-4705-bb9c-b737a68c3a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565913, "uuid": "d074a513-4ed8-4840-a447-8e7050505ff0", "value": "d0c6ef6e6418c6861283b5592aef4432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0f3616-ed43-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683511074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511074, "uuid": "0362784e-7809-4908-b422-7858296aef25", "comment": "Malware payload", "value": "7716369fd03f65e70b83a472f0c88258", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511074, "uuid": "0950813f-7366-4adb-88b9-8d498f7c6f62", "comment": "Malware payload", "value": "95aec4a1bcd8bc36a1d9fe6752da543cad0c498022426c54902a39db97618bc3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511074, "uuid": "007a665b-60ac-405a-a4db-a7f7131fe65f", "comment": "Malware payload", "value": "80afc35d7c881e70df784a143de4cfbc4a8971d8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683511074, "uuid": "bd3a198f-0e17-4300-a0d0-15732b511761", "comment": "Malware payload", "value": "465d7846f9b0b65f82d7676eae643c976c52b00fe1bc0e989c2a453683a11726f63360359174e57ffab50557b006b15c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511074, "uuid": "f1e8cf69-41a3-4abc-9e0c-a80a01797d4c", "value": "T1FBA28F565B8C4C61F26AF8BB865EE00E19BCF63634C255C4BC9CE2707B7D14E0B661B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511074, "uuid": "9b3cba54-2954-4f50-b10b-2407dc39d569", "value": "384:krX3r7kYl4k46Fm927RiWXqgEdny3oSXW6Uz5jtFvHUmW0w0ba2mExSj5DRTAv54:krn/kYl4k46YGiAqndnrLRtFvPW0N9mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683511074, "uuid": "272d2a6a-3460-4a14-8ed4-fc4d8d77ea5b", "value": 22858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683511074, "uuid": "be3482ca-7b51-47a2-8475-5825f33bc77c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683511074, "uuid": "9e133220-f5eb-48a8-adb6-45b5d9f01991", "value": "7716369fd03f65e70b83a472f0c88258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431e810a-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683527187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527187, "uuid": "79eb4020-667c-42c1-9ba3-bf2595bd08ef", "comment": "Malware payload (AgentTesla)", "value": "e368d0f3fdd028ec18ba9420f79e3245", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527187, "uuid": "743a32d1-6386-411c-ac06-81a54153bc7d", "comment": "Malware payload (AgentTesla)", "value": "96008298e97996892e74d426f7d5dab61e1730c8627f407e5fcff0d1ec21293a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527187, "uuid": "16de3fcd-fb36-4171-9590-f465f4cfa002", "comment": "Malware payload (AgentTesla)", "value": "eb2fc154c148c105fa6159d47b6215497f3fa199", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527187, "uuid": "d4072752-0823-48ca-8232-23d39f650536", "comment": "Malware payload (AgentTesla)", "value": "5f59af89ecc0627b8b5ee25b47f55858b1cb8ffb54a7347d8542af869c6ba162e2b7a7086b7cbcc97fa143ff7d699df7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527187, "uuid": "b5068008-b658-496f-8ffb-df4aab6adaa7", "value": "T129830246865812713C00C5781DCA10E9E72E4F5C62518ED3682C5EA18BE9EE8DFBBD77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527187, "uuid": "6c237dc7-8380-4a27-8c0f-079b21ea8239", "value": "1536:mDWd2NWlWrXp5wN29aqtfn5YKRamQ67y6Pja+6nGQJLNrRMkk5Cu:+DnXTwN29a4fn5YK9Q6e6Pja+6hnytR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527187, "uuid": "f57a8890-660b-4c00-ac03-6cbf7f7a99b3", "value": 83382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527187, "uuid": "ef3f1820-fc42-4dcf-a90c-fb78717374a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527187, "uuid": "69f59d5f-db5b-4552-bc94-bcf737cd37f1", "value": "1.bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e82af2c-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550882, "uuid": "bc6b53e3-bfff-41c5-9a3c-f976ecc0062c", "comment": "Malware payload (SnakeKeylogger)", "value": "614f125d17ec60cef5fc9020fb8df6f5", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550882, "uuid": "9c545176-b54d-47c3-b223-116a34a81c50", "comment": "Malware payload (SnakeKeylogger)", "value": "976480e208e2df3334c4e4cb6a0a16b74250612e9e068df1e26ab24db3e24b25", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550882, "uuid": "15dc0a17-3db7-4986-b823-5def4c077504", "comment": "Malware payload (SnakeKeylogger)", "value": "ee5b05433e05667feca587e9c64de9766031d5b2", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550882, "uuid": "118897c2-8aab-4536-826b-0a48169416c5", "comment": "Malware payload (SnakeKeylogger)", "value": "3802d52241f8ce2e8a6e013b397d60bd56e946550ef46d91f0734d16f514254aea0d2f031006547a3316d3a1cd433c00", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550882, "uuid": "aa0da40a-a092-4ef6-a979-4b0550bb7dc4", "value": "T1F2B4F15122FA8F61F9764BF01938B88103B130A755F4EA580EF561CE5AF6F102AD1F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550882, "uuid": "aaa775ff-ec57-41d8-96f0-5e3939a21a3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550882, "uuid": "b973565e-ed91-4d6c-a3ce-ff642471087a", "value": "12288:5fWCW+y6oDKiXfgCM4iQOa4rAsn1F72Iu0Tzi:VWCA6uzXfg4dgoItfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550882, "uuid": "f54f05ba-a5a5-4487-b1d7-520a387917fd", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550882, "uuid": "3bba6738-7431-4c4e-96bd-b6eded4203ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550882, "uuid": "35a14f2e-db2c-411c-b5ba-5c66e586bbde", "value": "Clientes BBVA Comprovativo de Transfer\u00eancia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fb702e-ed6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683529399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529399, "uuid": "35bff14a-05a2-4b29-9af7-c1c2a0452213", "comment": "Malware payload (zgRAT)", "value": "072fa2c24d833a4d1370c4830977ee5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529399, "uuid": "32c21a99-9276-45ad-a375-0f7126aedbc8", "comment": "Malware payload (zgRAT)", "value": "980d032454e0f471a820a594683ae833ac86d4c074fbf43cb47798ca774b35f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529399, "uuid": "934ee0b3-77bf-4241-8bee-2c01525c09b8", "comment": "Malware payload (zgRAT)", "value": "74b2abcae6491d617225b5b430bd3309ee212fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529399, "uuid": "7779e7ff-935e-4e5c-84d4-c311235fca4c", "comment": "Malware payload (zgRAT)", "value": "18239de5bbad8d0283cc198d572dd937bebc52d97c992d8c94928d8a893fd5d80d6cd4ba32b1619e0bd7fe3ea8ce7562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529399, "uuid": "e682cf3c-9658-4709-97ef-959bc81b715c", "value": "T180F4F14A3229BE9DC156AD76C1CB48065390BFEDA727D643344B3BD94F093A79F80386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529399, "uuid": "82842af8-d1df-42bd-98e2-d1633f501008", "value": "12288:AQHFUlKANJ2yE8qMg+dEOrCG0D7SKHBweeSXXYrzQ70W:AFk+EOrCG0DmgBwerHYo0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529399, "uuid": "94518f4d-f46f-41cc-ac44-b465579b6ae4", "value": 782408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529399, "uuid": "c4d82b90-3413-42d0-bf59-1ce7f22239fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529399, "uuid": "e3aca928-e6e4-4ef6-8102-f47636e834e8", "value": "NHHhHhab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c0fa46-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565925, "uuid": "27b3ad80-bb20-4420-8dd5-e71b5d9e345d", "comment": "Malware payload (Gafgyt)", "value": "d5911f5cac2aad79d4527b7cb7896882", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565925, "uuid": "dfba05b3-79cc-4dbf-896b-8253020bc0d2", "comment": "Malware payload (Gafgyt)", "value": "987e111a434a46dd0cf734a983b0e3f238166ebe800f25de15fe613516b75204", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565925, "uuid": "37278970-3731-4b1d-9ac5-070aa6fb8ca9", "comment": "Malware payload (Gafgyt)", "value": "6257aa2980078465f6fb2fb273530298b0aff295", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565925, "uuid": "7009aa13-d79f-45bc-b0fd-9b3bfda363da", "comment": "Malware payload (Gafgyt)", "value": "ac6a3a02a6ccd9dec327844cf08418f9417aa1bf968543591c1bd3fe2748f7638d926c185672138196a6c0f626e91082", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565925, "uuid": "7a98df5f-9378-4e78-90bc-51e619377236", "value": "T16BE39366BB619EB7D80FCE7309AA4501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565925, "uuid": "90472773-b231-4ef2-b220-5e24e947f70d", "value": "1536:LVeTVe4SsruJwYx0O9vPBysZgvsgxqAz/0ufMytVmpLfaMLAImlP+s4zWfOodW:LHYuJRBx+sK/PflsSImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565925, "uuid": "15cb2f3d-8d21-4a94-b64d-65c71a884679", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565925, "uuid": "5b8ad97a-7813-4f0e-bc4d-9251aa33c052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565925, "uuid": "1fcf9a1b-a6ac-417f-9f11-4339153d9a38", "value": "d5911f5cac2aad79d4527b7cb7896882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6e14db-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683552626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552626, "uuid": "61237b86-9510-400c-850f-16dcf8d103b7", "comment": "Malware payload", "value": "65be24d1cc538be41ba3c50b3da0d5b4", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552626, "uuid": "98e20bf4-36f7-47b2-a9ef-eed75d455f98", "comment": "Malware payload", "value": "98901396ffcee504432365d8f25b07d330e6d82b4e1d70ab50091bfc854ca0fd", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552626, "uuid": "382f900b-1d83-4269-9da1-2a67147b903e", "comment": "Malware payload", "value": "129ce2f7ace55b594db9a1348485688c19b097e0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552626, "uuid": "083975a2-a79f-47dc-9ac8-fe496d16af48", "comment": "Malware payload", "value": "ce2fa85ed22624c3aa3ddbedc9d53a0875d97d81243bd149c5e2b5aaa5dccda80f76bae176593cd645a5871900c278f8", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552626, "uuid": "37f77b6d-f55c-443c-9def-b07c299f646d", "value": "T163B423EED06AA321DF62590395B1B8F4537CB697962F7AB5CFFF02C04B9A49BC004245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552626, "uuid": "7b230e8e-e007-435f-831a-c7e99d8ae019", "value": "12288:ifb4mH4+TqzcZNB45bvGm3zkryzmPUoib/z:+b4NSqzcZebG4AeNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552626, "uuid": "689f0f45-28e2-41f6-bf4c-02379b3e3729", "value": 528748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552626, "uuid": "509df641-1bb9-4da9-8545-b2f4d305e348", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552626, "uuid": "021471c7-cfba-4ba7-a32b-bce290ea7665", "value": "DHLXINVX74683783-Pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b652774-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683534932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534932, "uuid": "e932bb38-230d-49ed-b437-66c2c55152e3", "comment": "Malware payload (RedLineStealer)", "value": "26cf6091d499fbbc2ed284226736c8f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534932, "uuid": "e52ff704-7b9a-4489-8b83-fd568ad487b0", "comment": "Malware payload (RedLineStealer)", "value": "998e92e03f9fdb7f792b182ae22d9edb689ca0cebb8a11bd42e032b858ee63ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534932, "uuid": "8d0765af-0e68-4cdd-9a53-8ee48770a35b", "comment": "Malware payload (RedLineStealer)", "value": "e07563deb47b39b5d443a95c4529050e2c4b0022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534932, "uuid": "6fe410b9-4304-42ad-8bba-8e88e2264064", "comment": "Malware payload (RedLineStealer)", "value": "bd266ab3731c681145e148a4d55b2d79b26b471f096f68c740bdeeaa1689200e9890d1dd519c282cce184ffecdb54e29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534932, "uuid": "89adf5c6-210a-407b-8a69-ddba0803bd2c", "value": "T127B41213A7C881B3CCB52B7018F703D30A31BD658E7887AB2751AD5E1C726D1A5B636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534932, "uuid": "2ef72708-b38c-42db-8dcc-de2d7ef7fcf0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534932, "uuid": "d8e0e65c-13a8-4030-a4f6-4106c95cadc0", "value": "12288:FMrKy90VUfS2AA7C5SFia+om7hmunbVko3tD6R:/yn301a+xVTnxkotu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534932, "uuid": "c97e98df-5157-4b27-ac38-0ee7a3eb8c86", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534932, "uuid": "2b381141-09a8-481c-9a3c-4114fe625f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534932, "uuid": "26e93a9e-aab2-4245-aafb-b23d1539f7f8", "value": "26cf6091d499fbbc2ed284226736c8f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f92fc46-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550374, "uuid": "ccec424a-8bd0-4c09-af52-828dceb23d2f", "comment": "Malware payload (SnakeKeylogger)", "value": "ba8e82ee343944e5f003998f14307d39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550374, "uuid": "2301f500-1a23-4086-b374-6c5a9861306c", "comment": "Malware payload (SnakeKeylogger)", "value": "99b2648789b255b806ad8ef3e1452db4ababbf42e2cb91c94cf1d34cab808292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550374, "uuid": "a8620d84-4f13-4918-80d0-a083043ca167", "comment": "Malware payload (SnakeKeylogger)", "value": "0c142d521a55cd52435f4b65742acf7974f29abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550374, "uuid": "342131fd-8095-46a9-8d62-f409407ed4f8", "comment": "Malware payload (SnakeKeylogger)", "value": "56cb6d33953b3d5860f9c8f53659b98ec563c425de4d03ebd350db8726f67cfd36e8c4529caaf315e3486d59499b2db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550374, "uuid": "71a601bd-5aa3-48c3-93d8-0e64efbabea6", "value": "T1E1B4015572FA8FA1E5798BF01934F54103B130A758F4E65C0EF621CE2AE7F502AD1A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550374, "uuid": "308a0fd6-833f-40c4-8826-41bb3529604c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550374, "uuid": "3257425c-1531-4085-afc9-371899027147", "value": "12288:N1z81PvJd8CMPUkWRTlMp9GUhb+oUezpjDi5:rzWJhegRTlKQUhbFUApj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550374, "uuid": "faeb343f-4b2d-4b9e-8a72-b7f0a6f2b517", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550374, "uuid": "850e2017-7632-4310-b6e5-8c5298d26606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550374, "uuid": "a0ef1641-f873-4d82-a23c-c3436dfc0a64", "value": "Invoice Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc68c2c-ed6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683529672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529672, "uuid": "dae4e58f-61a0-45ea-b73f-b343d6dc81e7", "comment": "Malware payload (RemcosRAT)", "value": "c0211365e36d4e254727f0098268ac6f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529672, "uuid": "aa0c9547-7844-4615-b6a9-c79e32b3cfed", "comment": "Malware payload (RemcosRAT)", "value": "99bdb65647f73b54fb38e721ff475792457a3f05652ef417c1a219ccbacd2191", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529672, "uuid": "90b1e75b-a2e0-4f90-8bb2-bfcb66a8c6c1", "comment": "Malware payload (RemcosRAT)", "value": "8c01d305c97a98dcd6da1415e98a391575c312e4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529672, "uuid": "c460eab9-8962-48b7-841a-6bfbe5816ec0", "comment": "Malware payload (RemcosRAT)", "value": "cfa46bfbc8478ff11d1d0bf99bbe2633550e93a1d90238094f18fbeb68dbf225bd9373de987457e40b04e6a1f8c848f2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529672, "uuid": "f9d1d57d-ea37-4b50-8eb1-81a3225709a3", "value": "T1B3E4334932FC103F015B7D4ADBB1BF62BCE6836EBF8341C27059E5B82849D9B255984B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529672, "uuid": "3d1f7914-2d5b-4a5c-be61-7247c02defc2", "value": "12288:4oQxZvaeN6ZDThYu6Y81c1VPL0zRoTLF06vJ9iWBQWihbZpuOXvQB:jQFszh81c1VPL0doTRBQWA9pub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529672, "uuid": "d5db6661-632b-4702-a786-e14119072cb0", "value": 688538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529672, "uuid": "17faa9b7-3a90-4ee0-9f30-4a03d90d8582", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529672, "uuid": "baee8c0f-ec63-4386-a925-6377be0aef4c", "value": "PO 331385674200010.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8947555-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529209, "uuid": "f08c6704-567f-4842-94ca-0bd7d5a38535", "comment": "Malware payload (AgentTesla)", "value": "aa01f6ff13bc86bf5142c3a3ad1b7f72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529209, "uuid": "751642cb-670d-42e0-96e8-2295040c1475", "comment": "Malware payload (AgentTesla)", "value": "99d862b5be1bb682eccce4c68821ba60ac79396333fd6a535787acea60bda9a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529209, "uuid": "49d07134-aa63-4ef3-9381-925b17259540", "comment": "Malware payload (AgentTesla)", "value": "071de9e2dbf497f92eb2406d16f442085c3c49d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529209, "uuid": "93ffc38d-d47b-45af-ad48-5e7d58442d48", "comment": "Malware payload (AgentTesla)", "value": "24b80c9f270a274bf3af102349f79abe40f2dc633eacd86a9fb4f17296f60110cf323bd891f2cc46457d92e2a80e0643", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529209, "uuid": "ddee3e4e-d8f5-4a4f-9d5f-a3865fc30070", "value": "T10445AE4DC278C464E907A770847EDAB73B4D6F72D24B832971AC62D347508D0A3E6B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529209, "uuid": "bbb85080-e5d2-46ea-b09c-6c9fed2a4847", "value": "12288:TFMVoWEvx5xlotYpoL0DLVLWDLVLrXDLVLYDLVL5ap5VrW1U4cZKB:TFMPI/otEaR40LKRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529209, "uuid": "9c04cce6-69da-4ab5-83e0-bbdaaa2d7d58", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529209, "uuid": "318b3c6c-f2d5-44a0-9c43-271f7649f1ac", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529209, "uuid": "8aa7166a-0f98-4257-91e1-1638e38cf009", "value": "10108831-401AV03LF.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525cc31c-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683534943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534943, "uuid": "0274e5a2-2b9f-4257-ae4d-0ca8cd8d7353", "comment": "Malware payload (Rhadamanthys)", "value": "655c4f5755999df41d5d006a0768bf78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534943, "uuid": "d98ce9be-60e6-4b0c-b160-9e20739f4b58", "comment": "Malware payload (Rhadamanthys)", "value": "99db3c3d444e7d3130fa3e1404a7e53fe255a53bfb0b356a779da524c9e5c11d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534943, "uuid": "540fc48c-2c0d-44ca-9115-0ede9bcbe864", "comment": "Malware payload (Rhadamanthys)", "value": "d67a90395b59a917c54a835251b254add14bd97c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534943, "uuid": "cca62a80-ce38-4f7c-a30a-8852fa7dbc4a", "comment": "Malware payload (Rhadamanthys)", "value": "e7c7671bf5615ff24a16de30ed7f5bf0d86fd750e40e0eabb088b95e07129fcffa0b0a035569a6431f60678a5fbca227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534943, "uuid": "43535999-b0ea-4a30-8704-86b477d959e8", "value": "T107849E1272F0E871E5364A728E1AC2F4A61EFD91DF55A7DB324FBA1F0A301E1C562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534943, "uuid": "6df0057b-b6d2-4eb1-8c82-f93f09a81963", "value": "d5316530de8caf207058f054d9fc1dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534943, "uuid": "38cac35c-3a3b-44b9-831b-63546b93f9d2", "value": "6144:yc9n5ioyAjykXPqHN5GRMs67Imv0zxbH3WQ46V7AwN:yqn5ioyAek/qH7GRMs6+zcR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534943, "uuid": "58fe3e72-2487-4e2a-9dbc-8f2618f89536", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534943, "uuid": "94c7c89c-7881-45ac-914f-7cde6f276ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534943, "uuid": "a19d03bc-6ae1-4bb1-89b1-36a77b2a2551", "value": "655c4f5755999df41d5d006a0768bf78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2e50d9-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683534934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534934, "uuid": "b56ae1d4-7614-4ad4-a9d2-84d98e694485", "comment": "Malware payload", "value": "8ed78a10482f348ad4c1502c54820a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534934, "uuid": "a8fed9db-ff6d-425d-afc2-3122fec0af97", "comment": "Malware payload", "value": "99ddaa801c589e1f2af3e72380517c1221a1d3a91c6753e2024e39f1981104e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534934, "uuid": "6dd2f5bd-36ca-4254-ba33-1bae91c64e01", "comment": "Malware payload", "value": "7aca6c239b822a0c5f9d5b8c9058b1f61b748dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534934, "uuid": "dac16be4-5bd5-47b4-aaf8-8d487d050622", "comment": "Malware payload", "value": "895ca25c8d91f1ce70e8f5d534f2946e23fcca86d0c303e5e04c47e5327a3e14dcd2d8b108b9eb25ff0f62b78ea84ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534934, "uuid": "bec42f6b-1988-4940-be91-8fe7b06383d1", "value": "T199663394A7500CE1FC2A033968828511FD237D2A1764FE9B426071692E7F7E3AD79F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534934, "uuid": "ad61183b-5361-4058-bddc-c861ff62c38d", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534934, "uuid": "1475da54-1e03-4b2e-a4db-b961c873bd5b", "value": "196608:rvjDRIdDUvQd9Z7FTLXfIz3wb7bAiUtIwQaUYrTafjf:D4sQ/tFO3w7snlQah4jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534934, "uuid": "62c91174-0c8b-4944-a879-9f1f9474654e", "value": 6966416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534934, "uuid": "0bd0a254-1ff5-44ba-823e-e124225199dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534934, "uuid": "62d6c064-053f-44f8-99b3-f6a19ff22835", "value": "8ed78a10482f348ad4c1502c54820a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa57530-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683551098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551098, "uuid": "7167d5f4-cd66-43fb-915e-a9ed717f5d8a", "comment": "Malware payload (Rhadamanthys)", "value": "664b543fd8b49e8ef490a381027822a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551098, "uuid": "8e674b3a-5c2e-4bac-97f1-1ed75003a55f", "comment": "Malware payload (Rhadamanthys)", "value": "9a1ed7d76de14600ab79f7d60e45dc18d857c1ce0d2383df629d0fbe91e6ea0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551098, "uuid": "bd7f9322-25e9-443f-b125-19ff411ca8e2", "comment": "Malware payload (Rhadamanthys)", "value": "97eefcb03d378e46e929351a23b890ea0dc70536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551098, "uuid": "0afa64c1-6c52-49af-a64d-393a0ac3c66e", "comment": "Malware payload (Rhadamanthys)", "value": "90c5fbc4aa8c7108ae4928665d9a41f5b5f0c36d08dcb80524aa6454fc6ba169ba2db250a2a6a703eae051d66e6a5f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551098, "uuid": "a6e69fa3-dda7-456e-8647-7379cc5f6523", "value": "T16084AF1272E0E871E5564A728E2AC6F4BA1EFC91DF2576EB320C7B1F0A701E1D572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551098, "uuid": "42fa1a57-811e-4811-8653-32a6564a568e", "value": "51ff29d4db4362644e59273b02a12d87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551098, "uuid": "dee67abf-2817-437c-b6c4-68a71484fdc8", "value": "6144:gBWjAGbF0D3dLJ8WuwnzPpyGJNuHyzMdTrSMEri2HzA:ggjAGbF0lJ8izBzySzMdHSMGi+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551098, "uuid": "aeeb9d7d-f3eb-4a00-9d62-bd4b2518fcce", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551098, "uuid": "d7c75e98-43c5-4f6e-a6bf-a43f9e08eb82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551098, "uuid": "1618d36b-aa94-467d-a207-0d7840184a0e", "value": "664b543fd8b49e8ef490a381027822a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8901b931-ed6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528163, "uuid": "7519e4ad-a5a2-40d1-af8b-6c72a4059e27", "comment": "Malware payload (Mirai)", "value": "36153549c864da465e295f03a9c262fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528163, "uuid": "b48850e8-35c7-439d-a7ba-57f638deb040", "comment": "Malware payload (Mirai)", "value": "9aa2ea75d1447378d3f0eb265d5b2ecb6fa50a29308caf9e5fd5302e0e85f73d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528163, "uuid": "40646ef1-29d9-4b26-956c-fadb927c852f", "comment": "Malware payload (Mirai)", "value": "f2edd845483e4eb37436dc8d4fe7e618513bbe2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528163, "uuid": "c406f958-05a9-4c0a-90c2-32b3c39fa1bf", "comment": "Malware payload (Mirai)", "value": "7c89e2bc5a8fa7ad1b283d21ac0c7ac9dd647fcfc3607cd8ce8b3c5d58f4e2267c6123b33fcccb6a12c7db68194b2992", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528163, "uuid": "4644c715-893d-4468-9b25-d255cfa8bd8a", "value": "T1E283A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528163, "uuid": "c6a451dc-85a6-4bf1-9aa4-aaf3ac78b660", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTS7ZDYovZ73x/nL8y8Qx:Rakdn2Eo3ePu5GTSRYo99Be037We/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528163, "uuid": "2f5fab6c-1dde-4c06-8653-cc59f92bf53f", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528163, "uuid": "a121c969-61ed-42e4-883d-441e031cd02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528163, "uuid": "7e015973-2588-4972-8ee5-23a54cb9eae5", "value": "36153549c864da465e295f03a9c262fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f5dea0-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571616, "uuid": "e366db75-9ecd-469d-86b8-c2cb7fccfdb8", "comment": "Malware payload (Gafgyt)", "value": "360ab64ae527c3d95b8ddaa5aaf27313", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571616, "uuid": "71a31c22-3bc9-4172-88f4-9aa348d01e71", "comment": "Malware payload (Gafgyt)", "value": "9ae7dce519a0e200014fc623d5af91dd106820f104d7b6ff9a7fe599a6701e46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571616, "uuid": "57143174-e1d8-4391-8ba1-4c0bf1d49013", "comment": "Malware payload (Gafgyt)", "value": "a9d49dc45c359f359d6f17db5b17d12f203fc459", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571616, "uuid": "6b0326af-4a9b-44a7-a74b-93fee665bdae", "comment": "Malware payload (Gafgyt)", "value": "c09ed490066f226e1cb907a8b6c433334937450f33a5e29699e9953896e6422447b77e651ef6cfd7152646564cea9054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571616, "uuid": "23eb4af0-1098-45e8-90be-d8807f5a7290", "value": "T1D0B30741D6548627C2D32B7BAB9F438D3336AA54A7E733195528BFF03BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571616, "uuid": "2c6cdb2a-4d37-4e43-aa8d-4aa99086f8ed", "value": "3072:HgvBxOcKFN+B9Jy8D3XvpIhfXm4CHz9cm7QnKQXaeW:H6EKXy8rvOFXm4CZcm7QnKGaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571616, "uuid": "4d1c8129-137d-4a0c-b5b6-6c62abba8ef5", "value": 111561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571616, "uuid": "9547a203-ade3-48ae-8ce5-b9f0c4832abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571616, "uuid": "2a2340cc-82b9-4fd9-93e7-95f253107db5", "value": "360ab64ae527c3d95b8ddaa5aaf27313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f5378d-ede0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683578416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578416, "uuid": "39130b6f-b52b-4ec2-8236-795d519cd006", "comment": "Malware payload (Loki)", "value": "005bcf051418d05c2750b593278c9fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578416, "uuid": "17a8e18a-35fe-4463-86c4-5324cf603f98", "comment": "Malware payload (Loki)", "value": "9b6573b930e72d319ef4efa0975ff1b59673f96633a03d5e338bc8d7418418f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578416, "uuid": "570bd46e-f156-407d-b0b1-76d507bc9953", "comment": "Malware payload (Loki)", "value": "3425e499c953eefad59edde4f83e1c04687799c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578416, "uuid": "2546ff52-20b7-4f6c-893d-68d9000b996f", "comment": "Malware payload (Loki)", "value": "d4a05aa42cf62af62143da8cc5ba6fbec5063e1e5992cf7948348f2b640aec9e31a28d26627974b006ba457734190549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578416, "uuid": "4d469e03-21c6-49c2-8496-0f226f3f60f8", "value": "T11FC1C60AB7D49636D4BE4B3404B3831062BEF6429E679F0E1CE402DEBF26774C956AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578416, "uuid": "88b39d60-9326-47fe-8e7b-9597b584cde0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578416, "uuid": "73b98838-284f-4699-ad70-64192974a08d", "value": "96:MEOIQNVjrXcWD7RtwkYv1X5Yp7svNzNt:MFIojrsWHnwkYv1XyIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578416, "uuid": "fd0f817c-25f1-47a4-a851-1f250deb4bac", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578416, "uuid": "af8cbdf5-a7bf-4ef5-bc37-11f53a2c3ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578416, "uuid": "78cf862d-77f6-4671-b4f1-d162b1e2cfe1", "value": "005bcf051418d05c2750b593278c9fc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4db384-ed6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529482, "uuid": "5c2b38c2-9455-46d9-9f60-8da407b94170", "comment": "Malware payload (AgentTesla)", "value": "5a75638222c19f0346d285308f4221aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529482, "uuid": "259109db-2ccc-4644-bb33-aa4b44832a0c", "comment": "Malware payload (AgentTesla)", "value": "9c4b6802871fbcdb02dd050c63b78fd90563823a9f354e668eab955add424b90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529482, "uuid": "c642c112-340c-4f66-befb-9c7007db70c0", "comment": "Malware payload (AgentTesla)", "value": "06c9bb1f59a172305420b81e10d70f859a883f4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529482, "uuid": "a354aa02-f5ea-4ccf-b573-8e274f7d3e65", "comment": "Malware payload (AgentTesla)", "value": "0a8993bb5510e349e76d2e67227b49afbfc795c5b02ba1227065a4f2018a09d4817e34eb6e3d71d69ac01ecb72c03661", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529482, "uuid": "e1f235d0-134e-4c00-8c9b-f6f2380636c3", "value": "T1A445BF994E134243ED4CF93BC9A89CE0A3016E0B3B7C76BF7096C63D6154B7496E86D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529482, "uuid": "c7b4cc20-db81-4899-a303-1faa6b861913", "value": "12288:1u/3Q6BF39ExbGn4VfA8K3k+GHo0iVdg5LrsQ:kvQ6tEtGn2AB3KoVAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529482, "uuid": "81d58411-a51d-4b63-9591-d2880f85bdc6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529482, "uuid": "6d576ff0-7836-419b-b56c-434ff2481ca9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529482, "uuid": "ba6d9a19-5505-498d-9a1d-dfb7a26c4641", "value": "LM2670SX-ADJ NOPB.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463cf5f6-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GandCrab)", "timestamp": 1683516454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516454, "uuid": "6a21fa4a-b375-4707-a435-429b43ddb071", "comment": "Malware payload (GandCrab)", "value": "19cb63c0f3d3f3b1db098e4078178eec", "object_relation": "md5", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516454, "uuid": "143992c4-2516-40ac-b1c5-c5d777f7340a", "comment": "Malware payload (GandCrab)", "value": "9c85397c39f7799687df61ffe6ea85231d6c7e02da9f8bb768d8d2681eec6d59", "object_relation": "sha256", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516454, "uuid": "a4fa7934-06d1-46ef-955f-d108ed67bd76", "comment": "Malware payload (GandCrab)", "value": "0ea869941041b0f2cbb5ee3e35359409f441fdbf", "object_relation": "sha1", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516454, "uuid": "756c8694-94e5-4c1b-ae60-ceb3c90590b0", "comment": "Malware payload (GandCrab)", "value": "64f132566b315d7ffd81b02215e592c30abd18658a3d39f768c924de8f83969e7a16e9a49ae977a4c659e42bc5c04b08", "object_relation": "sha3-384", "Tag": [ { "name": "Gandcrab", "colour": "#BA1E7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516454, "uuid": "97278286-7ab3-4c71-80e2-98b0bde7dcbe", "value": "T1A7946C14F1D37461E0BD4B394EABBB490519FC941B60B8FF61A826FA18F9093592C7B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516454, "uuid": "68c54d02-eaf3-4189-851f-ad400efc5c63", "value": "6144:lcytwbH1yTS+xqqDL6HKXS+0r5Y6+m3ZTlxRk4Scp45weczU:CyiH1Rqn6qXS7rd+2ZTlvkfwrzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516454, "uuid": "9ee68ba4-2133-43b5-8e10-65f43b74e4b3", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516454, "uuid": "ee8f6f86-cc3b-4dd5-bb83-bee020a5a4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516454, "uuid": "676c1e6e-f5e9-489b-88ab-8db61ed02592", "value": "2023-05-07_19cb63c0f3d3f3b1db098e4078178eec_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f53fed4-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585565, "uuid": "a649954a-f545-47e6-9294-a0d9b4ad12af", "comment": "Malware payload (Mirai)", "value": "8b8e9314241e2f62931ec3223113429f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585565, "uuid": "b91cd09d-4dcc-42fb-a8ed-e670da8798ef", "comment": "Malware payload (Mirai)", "value": "9db1d4a59bc577efa4769790fe711344745bb9c6c433dd4d500c03f226610063", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585565, "uuid": "b3550dfe-4f5b-4b3b-a509-458fa95a187d", "comment": "Malware payload (Mirai)", "value": "8ba8f44f994c5352cc86ebda7817584e7c510cc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585565, "uuid": "7f777ebb-5601-498b-8eb5-820e7a2d46c0", "comment": "Malware payload (Mirai)", "value": "146fdc3881332a86b930be8f3796d468960b0ae3195abfea36e7a19010282a9dff978e0462a599cc921a7fb544efd1ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585565, "uuid": "9b64c9cc-04c6-41d3-9797-e5ec6c4f0f2d", "value": "T178D2D02CD95D7909C69D3EB950DE56F92D8C74C0A36DE6CE17228408F627B8BAC070A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585565, "uuid": "bdd4ef85-a2c6-4574-8e87-1d00ea22276a", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN/5OJbiWUG:1bDs06t4BEub4sU/MbUQmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585565, "uuid": "ded623a7-fc28-45bf-9048-79fe571aa1ed", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585565, "uuid": "d02e1dca-7841-4909-8c00-3f5b93ca3900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585565, "uuid": "99f16895-08a8-47a6-836b-d90e77338457", "value": "8b8e9314241e2f62931ec3223113429f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c88e04-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683534982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534982, "uuid": "bd511b1b-2877-41c7-a2a9-e5fa6acce939", "comment": "Malware payload (Rhadamanthys)", "value": "0558faf9b3fe5a9f6c097f1978794615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534982, "uuid": "6692fabf-b2ac-4966-9960-ec8517421f5a", "comment": "Malware payload (Rhadamanthys)", "value": "9dbcf39905c23fd99583b0605b14218f0bcad230ef0d29dcf5e805b63bb07628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534982, "uuid": "52739e95-6a33-4981-87c8-4464aadeaf91", "comment": "Malware payload (Rhadamanthys)", "value": "27f40940543257751e318c92ed7a42839b03c252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534982, "uuid": "89698d29-bf79-427d-a7fd-079535f51f00", "comment": "Malware payload (Rhadamanthys)", "value": "48cd8c717991846567aa9327cd4b437a16051a0ea541f631cf05f6860e750879d7b738de08ea51af874b63c96aaf520a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534982, "uuid": "7575a29e-0679-4cc6-add2-d2e5518902eb", "value": "T1D1843B4392E1BDC4EA268B728E1FC7EC769EF2508F59776A12189A1F44B01F2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534982, "uuid": "17ab0d5a-389f-400a-93f7-059ef64548da", "value": "774eae4c41c92ea810347ae7a14e6cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534982, "uuid": "5c4c1fb1-3c8f-4b3b-abc8-959babbeddaf", "value": "6144:UGoSNLQDx07PqgK3YSlIBvBCrGP7E9HYpOBHUdvrWJY:UG3ux07Pqgm/YMrugHY2U94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534982, "uuid": "255db2fa-534e-4625-bccd-37d0a88d431c", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534982, "uuid": "97cb3b8d-9672-45fa-b3ea-c552a487fee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534982, "uuid": "123e7565-a4b1-4ba8-92c4-89b6ba29ffe1", "value": "0558faf9b3fe5a9f6c097f1978794615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceda8b52-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528710, "uuid": "fe3f28ff-3e03-4776-84bb-a904a57556f5", "comment": "Malware payload (Mirai)", "value": "bb0599b0ccaae68de6c2fc8bd6d9e2a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528710, "uuid": "8b2cf9a3-3578-4938-b70b-6dfe29626cc3", "comment": "Malware payload (Mirai)", "value": "9e0310e5fbab5136e312ac781691519af7ea3285475f793b298076743a2d9a10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528710, "uuid": "e616eca3-f9b6-469f-8842-9918c7a3cec1", "comment": "Malware payload (Mirai)", "value": "c4e6e57d849c1c552c53813df15d9111d97cdc8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528710, "uuid": "78373109-1823-46a3-8675-0f2ebebb79e8", "comment": "Malware payload (Mirai)", "value": "60b45198f823a6ba27d3fa2e05c3a22e4c9b01e155e16fd8ea93324fd43d66b00c0d3c52340c0dea225ab5c83c2d904b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528710, "uuid": "e72175fd-9ea0-44ae-a4d9-8236a33adfd7", "value": "T116637EC9E283D8F6FC1715702036E73BAE71E0AA211CE686C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528710, "uuid": "cc174ed9-f0c5-4c6a-854b-b1dfc7e86746", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAqrxZx97qJ7RvsuIr5bhI8t:pnUQJ7RlUXTQpwOaOA6xZn72+uWFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528710, "uuid": "06d4ff61-098e-4fca-b56e-eda1d05220b4", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528710, "uuid": "697e90fa-fabe-42dc-94cb-439b73b04c18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528710, "uuid": "76f67ae2-fe11-4d31-bb4e-c5272bb0aa33", "value": "bb0599b0ccaae68de6c2fc8bd6d9e2a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16167877-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683588529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588529, "uuid": "99706863-d3a9-40b0-9841-eecdcbd3e7d7", "comment": "Malware payload (Mirai)", "value": "a692a0fc0b58221f7adee7e525b97bab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588529, "uuid": "32522c76-4df8-41f9-89a2-73738e049044", "comment": "Malware payload (Mirai)", "value": "9ee6b06d3e7f2b565f51efde93cb3cb64e7d7ce2effa98f337e3c311ffe5fa58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588529, "uuid": "a06853ca-9db4-4f65-9e3e-e4a10ed133cc", "comment": "Malware payload (Mirai)", "value": "d3267a4bdca76f56e8251ff7c4f4948992ca7cf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588529, "uuid": "58c5650a-b9a6-4c7c-b307-92f4b8f873df", "comment": "Malware payload (Mirai)", "value": "40bf36d6102f4978772cace466f184ee97f3f0606841284b219c3cc942c92af60affc65b676b70dfce27fc39079452aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588529, "uuid": "c99dd8a2-6ca8-4499-a83a-1a55fa2fa58f", "value": "T1AE041B0335244F1BD9D212B4142E57E883BEE9E438F57689595F8B730B34F2A588AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588529, "uuid": "1fdeb2ef-d647-4e1e-95ba-82de9df40e6b", "value": "3072:m/AztG+oWgOKNIM9Rxh05T4x7k7QbEIXUd:KwtG+vSxOaAaEaUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588529, "uuid": "2223e3dd-4c9f-4a95-b3d9-f76b7d01df32", "value": 173148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588529, "uuid": "d4da67d0-659d-4d91-b636-ca46fbab897b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588529, "uuid": "fdf2f89b-ac5e-4799-8f1f-1fece3a0f54f", "value": "a692a0fc0b58221f7adee7e525b97bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cd0d54-ed3d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683508449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508449, "uuid": "87143503-5396-4659-af1a-97ea33659026", "comment": "Malware payload (CoinMiner)", "value": "e2631ced981a70bc47c46067b5d6ad89", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508449, "uuid": "cd71dd69-6e1c-45ad-a754-dfcdf1c5d8bf", "comment": "Malware payload (CoinMiner)", "value": "9fb25aed6150c2de093fb589439d59536a98f3925ad599679a255bf183014e3a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508449, "uuid": "3c48d71e-83b3-49e8-9800-f70201a775b0", "comment": "Malware payload (CoinMiner)", "value": "5e18023d70a3e97633ac064555587b3292099337", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683508449, "uuid": "cc28b4fe-e634-423c-9e2c-a99153ea17e4", "comment": "Malware payload (CoinMiner)", "value": "ad5f620ca4041ed9703b70b4907c7834d3b51a0815f941fc91af718b0ba9d05093599363ba0f4625df1b5557e30c368a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508449, "uuid": "d05d9594-4712-47d2-9bdf-37f70a8d36c1", "value": "T15AA6D036F0A34AA896CD517EC6C99EAB610A79BE3F01FDD4B88D14CC4451EC95F2182F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508449, "uuid": "187a2f3e-dbf9-4ca1-b2f6-e317ed3a0242", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508449, "uuid": "da72a5fd-781d-4849-bea3-aed43b61518a", "value": "196608:2FqPNhGHV0Ongouvqv2OrgFhtPEw9UfIaW2QzXvguRMThoFd:2IVpv5CgFhtPEw9UfIaDQz/guRMThk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683508449, "uuid": "6e354275-f411-4c94-b612-e177e2dd0f52", "value": 10277144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683508449, "uuid": "f3f16460-b780-4b41-98aa-f89727ac9864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683508449, "uuid": "527ea739-ddc9-4863-90d8-54b769655c13", "value": "e2631ced981a70bc47c46067b5d6ad89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2993d280-edc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566658, "uuid": "2664739e-adb5-4e63-9a43-0a0c8866a5ac", "comment": "Malware payload (Mirai)", "value": "4230f05f1e1c6b6198a272206b3109fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566658, "uuid": "d2a1033e-8b1c-4e42-bb49-a62398a653e7", "comment": "Malware payload (Mirai)", "value": "a012e1d0844e22305ca573285d481d07781a0ea17f679887efeb5783e039f4af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566658, "uuid": "e25e38ff-5a61-4df0-9f63-dcf446554bc8", "comment": "Malware payload (Mirai)", "value": "767fbe2935bd7d9b14432e10225a48a96ef0f9bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566658, "uuid": "47e99a5c-2faa-48e0-b71a-98695685faa8", "comment": "Malware payload (Mirai)", "value": "dee8728a2bbd167de45241e459366bc3eb0386caa423fdc730ed907f8f8c6cad6b51434c10aee7017be5a4e3128ce6af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566658, "uuid": "ed01ab6a-1061-4865-a111-768d458388e9", "value": "T1AFC2DF3A231F5AA1C5A040384D29C706623B9178E5F57D3E2F396B6CAECE5AB0CF4417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566658, "uuid": "95bb742c-8573-4e92-90e9-8f1f521d243d", "value": "768:3KwvJ3vXQny0kxQTLWsw7GeA08cs3Uozy:DpAnyQTLdMWzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566658, "uuid": "53d3cef1-07a6-4b49-87b1-370eb182f82c", "value": 27272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566658, "uuid": "729ee925-30fc-45e1-b77e-9699844e1c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566658, "uuid": "23ff8264-ae1c-44b0-8103-dad1f293ad0e", "value": "4230f05f1e1c6b6198a272206b3109fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4379c251-edcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683570996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570996, "uuid": "ca60f54a-9027-463a-9fad-7552e974b651", "comment": "Malware payload (Formbook)", "value": "a7b354291ed6973453aafe52e7d50754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570996, "uuid": "eb21d83b-c8d3-4680-953c-c1e3026ee396", "comment": "Malware payload (Formbook)", "value": "a0944a8143c9b1520e9d4c27ba2a6699eafc3352c7fecee0039ab0f410b047ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570996, "uuid": "94c30f6b-83ec-4177-9a3d-06ca1d71e42f", "comment": "Malware payload (Formbook)", "value": "b209fbab2c40928789c00f7fb4145a27c3f6857b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570996, "uuid": "cc7138a2-beba-46c1-a923-f672a457e4bd", "comment": "Malware payload (Formbook)", "value": "65db949d35b704726f92caa22ea312d6d5ef0c0cb68279049ae32fecfa79cb643fc95c059d18c69cbc258ddaf844b115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570996, "uuid": "0fec598f-98a1-4a4e-9d41-d0f95a0e2854", "value": "T1ADD4024432FA8FA2E9764BF40938B44207F134E759F5EA5C0EE561CA1AA7F001AD1F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570996, "uuid": "21efd058-e70b-4457-a7ed-266c66c6b91b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570996, "uuid": "e864225d-35df-4a06-b0f5-9741e9d97210", "value": "12288:tRWbq9SZsqbAxSCXqsfvKGzx8D9OJWuUlB:OuL373xV8ZOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570996, "uuid": "c5bbb495-df70-4575-ae5b-5be9d9009caa", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570996, "uuid": "f0fc5bd3-ccf3-4dc7-aad6-b156da76b780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570996, "uuid": "dcfae54f-227a-472b-9ea5-a59d46c92631", "value": "purchase order doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a12ddd0-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585744, "uuid": "437ef635-5dd4-47c1-90ff-e0081d8fc8f3", "comment": "Malware payload (Mirai)", "value": "ac7a21facfc176de40710e966cb61475", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585744, "uuid": "647dd1e8-6fb6-47d5-946c-6ab8645d1557", "comment": "Malware payload (Mirai)", "value": "a278ce757f096097b7c1b5a3c5e24aab628eb07e63f85a03622d703367c005e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585744, "uuid": "25eb01b5-7304-4c1d-9b07-4b90e3429d02", "comment": "Malware payload (Mirai)", "value": "b6b7312d9ad58f12317912e310a19985687f854e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585744, "uuid": "907937ee-ada5-4898-99ce-9c27d1ff1f7e", "comment": "Malware payload (Mirai)", "value": "af2b55e7788c15fc5dabde9c03130f27722a9a1f3a673ae07547a2d8284c909d80e78850158350728cddcf02fd029a2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585744, "uuid": "1acdcbec-6470-43cd-ab0c-78dda613f219", "value": "T17333026367AD29E251B09733FC33EC1AA69C16F89C7730962CF05A1973C58024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585744, "uuid": "a1377039-9a58-453a-b0a3-a238c56240e0", "value": "1536:d9O/ZMAXIxNUk0KjeqLcPqF1aBexo4opKZbT:d9O/ZNKy2jeqLGqFUF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585744, "uuid": "19ee79be-9625-4030-9a2f-89b1aa27acb4", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585744, "uuid": "189ffe4d-eabf-4e9a-b733-27a03d3bbe95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585744, "uuid": "003ee9db-9e2c-4a62-a970-1e715035f4b5", "value": "ac7a21facfc176de40710e966cb61475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f5862b-ed57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683519548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519548, "uuid": "2974c317-ddc3-4581-bd0e-e2ace5a212c4", "comment": "Malware payload (Amadey)", "value": "29eddec0dea4ac48b2998cdc2b0bb3b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519548, "uuid": "cac111ca-f34a-4258-83a7-30a121b87c3d", "comment": "Malware payload (Amadey)", "value": "a2b3d06d9dc9c1ed4dd58bd8c867c1c27e877e07d199f8977f7bca46e6561c19", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519548, "uuid": "05644d65-e00c-4f53-a35a-a656c82abf24", "comment": "Malware payload (Amadey)", "value": "3f5a9e3e9ca22f77ece0773f352eaaa0b3663792", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683519548, "uuid": "9344ea10-29af-47b4-bc1c-349a16385213", "comment": "Malware payload (Amadey)", "value": "0c2bd284b754515b2cda6b7aa8d3c29ec8b8d22480f55d874fb0ed2aafedac5c3908d7119141098e41a594fc8c2a78dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519548, "uuid": "39334138-f55e-41d4-869c-cf5736190e1f", "value": "T1CAA40243F7E840B3D5B12B704CFB07831F357DB0A938526F2799992A1CB2694A67136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519548, "uuid": "1e91f4dc-57fa-4c5b-87e2-a529edd5ec8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519548, "uuid": "45167238-583e-4ab2-ad96-51c725db16a1", "value": "12288:EMrVy90EJHX1dTskx0I5c1u31ETc+ku2aIXtmfiSY:JypldQaX+Tvku25JSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683519548, "uuid": "9f37018b-99cd-41f6-a3ae-c1f94ad7eff7", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683519548, "uuid": "d466472c-2769-4c2b-8e41-7e596f016857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683519548, "uuid": "901df674-ba07-495f-af49-8a7f52f2ea6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96aaf577-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1683535058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535058, "uuid": "67207ece-f683-4a22-b27e-6ccb5bdf3b3b", "comment": "Malware payload (Fabookie)", "value": "3c9f6f1ea556899610bbb25b15011d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535058, "uuid": "934c42ec-eae1-4af6-b9f9-f4d0e04886f1", "comment": "Malware payload (Fabookie)", "value": "a32677191be14234346cefd2bc582bfca49f3315c82ebb9f6aea5efac6fc5cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535058, "uuid": "4788bbed-b17f-4949-b2cc-809601924185", "comment": "Malware payload (Fabookie)", "value": "49babee7a0e5a3423fab51897f6f4d1685d3c7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535058, "uuid": "2f933210-c50f-46b6-8029-9cd5ef463abe", "comment": "Malware payload (Fabookie)", "value": "d10098afd06f76d23da8c90207942c88eb0e7e80adb647a2225c436afe3c81b0140c6ce8c05eb913438d9eb0dbcf5073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535058, "uuid": "c2cc033c-e70c-4bc9-856a-3dd859f13326", "value": "T1CE741981B3DA4028E072C679CEB18363EA767C155B3096DF07609E6A6F73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535058, "uuid": "425e3efc-d59a-4693-91a3-c4d3c7534c7c", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535058, "uuid": "60c75bbe-bd80-40ce-aa25-bf21c46f6a0b", "value": "6144:xFH8RIT6Fam4StJ3/DW49wY7SkDyPiaODgKYleQ4SGP:xWdRDzCUJMeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535058, "uuid": "347041f9-31da-492e-92be-e3829c1c70c2", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535058, "uuid": "7c062cb3-da91-4814-bc6e-82d687c589ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535058, "uuid": "c05b2a44-7f21-43c0-a450-c7b263378fd1", "value": "3c9f6f1ea556899610bbb25b15011d0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe88330-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683588807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588807, "uuid": "d7b2b8ad-fcde-4d03-a059-c32fc0fc21f2", "comment": "Malware payload (Mirai)", "value": "febb467eb501ed207128d037d445a4e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588807, "uuid": "351d49db-b925-433a-b794-4d140aa305fb", "comment": "Malware payload (Mirai)", "value": "a3269778324af8b8de5c549dcad105b0f91f1ea5319d4362b08105f18f502d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588807, "uuid": "94de18ee-a558-4d98-8a79-2fb97ff027bc", "comment": "Malware payload (Mirai)", "value": "5114071e381b320ea3ca9ab5f47af891d7b96788", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588807, "uuid": "01758ca3-6608-4780-ab1b-dd0839f8684a", "comment": "Malware payload (Mirai)", "value": "7f43860f2c77f4cca7f8d5e2fb729072a38068ec5adea02b820c18a419f5e7b1a1932b6bd23b90b2a6ea9f76553664a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588807, "uuid": "2449269c-1275-40a9-bdae-8ac46026a52c", "value": "T10114F68168819A26C6E423BAF57E50CE332477E9D1CFB16B8C211F1177C985F0C67B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588807, "uuid": "6f014557-735e-4277-b6e5-0e1f88f85135", "value": "3072:l7vP6BmaZdfvm8ae+p9amsICUEd3jEqeKAyS3wNc72:l7vP6waZtvm8B6cEqe5yCJ72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588807, "uuid": "7c321878-d843-45a7-8dab-2880153dc43e", "value": 197628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588807, "uuid": "aed399b0-d9e5-4637-b9af-a9535738339e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588807, "uuid": "04a36b7c-2cf9-4f38-ad13-31a03a1168a0", "value": "febb467eb501ed207128d037d445a4e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c3bf11-ed5c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1683521561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521561, "uuid": "b4a40003-bb95-49e2-8f18-51c02036c416", "comment": "Malware payload (LgoogLoader)", "value": "c864a8b4c6400222f95b9fdd69332ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521561, "uuid": "1ebb92e2-e540-4f33-8e72-f66f1a543cb5", "comment": "Malware payload (LgoogLoader)", "value": "a38ee725e23f1acc01722da5a54cbf1cd76937271509f08a9c795fc3a0301f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521561, "uuid": "71088307-9431-4136-94e0-12dcea13a5b0", "comment": "Malware payload (LgoogLoader)", "value": "d1ca7284cb51bcbe3ed6d894c8aa3a2f96fe6084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683521561, "uuid": "acf3f763-8eab-4177-adbe-e9cdb434a30f", "comment": "Malware payload (LgoogLoader)", "value": "2386335ae20455afcbf367200faeb439da539c822b9d2cbb51b8cc68b5e6d804ac26260b94f1ffea580d0e5a83db655e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521561, "uuid": "b3f2ecc0-ec0c-475f-be00-50e4dcabd661", "value": "T131B4CD581EC07E93F856E1F953C022CC15B17099ACD3B23D26688AA16DDE15FC713ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521561, "uuid": "65d5e9ca-168f-48c2-bd6c-d9957471329a", "value": "12288:8NJJcqazonAu+O2q0RscrV4Krj/hUguwUJTmzEz4K:cJJc4Au+bqN1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683521561, "uuid": "6db6f5a4-9e5a-4539-ae7a-54aa2c55a16a", "value": 502656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683521561, "uuid": "aca26277-068a-4d52-9277-7affac2f8ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683521561, "uuid": "3c87b446-d890-4c6b-bf9d-3d3b84641a2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f763d453-eda5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683553259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553259, "uuid": "8525c265-5860-409c-90eb-99bb61f80854", "comment": "Malware payload (AgentTesla)", "value": "8b97b1a70e233a34a42dc72971545f07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553259, "uuid": "d440e0ea-b7ce-4d51-b821-c0aee25b354a", "comment": "Malware payload (AgentTesla)", "value": "a3928afcfa8b3e1825c9796ea9099e59e1e7ae2306fbfcc20dc3aae7c6065121", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553259, "uuid": "4b014153-2142-440f-8f84-202e528d49ea", "comment": "Malware payload (AgentTesla)", "value": "17cdf8a99b83975664698b963c568ec299a6251c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553259, "uuid": "147cfc41-5e1b-411f-a5f8-5ab7af0ebfbc", "comment": "Malware payload (AgentTesla)", "value": "938fa6340b5a0585d9e31d3ca63f5e8dcf8a1ee6506fc459236e474e61cd6623955926bf8a2b30c68036dbe77b61c397", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553259, "uuid": "bc5b4154-9189-4530-9435-5cbeec1a66c4", "value": "T11E15A33825B83922C2B5E5B2DBC4E521FBD089923536CDDF1AD244861AEF60376CBD1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553259, "uuid": "6417d709-d679-42b5-a838-ad72e053c265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553259, "uuid": "c2cec646-2568-45fa-815e-5e34b63a51bb", "value": "6144:yGJK4njQgky2InEoRhUaN9B6YjrlfplKGjXWnl/bQmkLKS0fCvYafA3Zrkkn/LqY:S4nJCnGLS2nQaINkULq7nO/Ga9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683553259, "uuid": "391db1bb-6ef4-49ec-bd9f-f44c5f9e2143", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683553259, "uuid": "89206419-7527-478b-8d43-4b199fe54145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553259, "uuid": "a327be7d-2a06-42ab-af80-cefaa2711869", "value": "Invoice No.23DF-46775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefbdb84-ed58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683520174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520174, "uuid": "5540811f-6695-4ffd-a79b-ec87800a140c", "comment": "Malware payload (Amadey)", "value": "782498be0b08adacfd05c53a0a8abe92", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520174, "uuid": "0f040ba8-30cb-4f6e-af0b-4e7f31804ae8", "comment": "Malware payload (Amadey)", "value": "a5abac1f66c4216dfeed1b5de73dc8ed397545a162510d63c3fea512b00d46dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520174, "uuid": "a0b1ef15-dbe3-4055-8633-c528ba5ff7a8", "comment": "Malware payload (Amadey)", "value": "31b0b6aa6e6b6210f7a3a017ff9da073e87e1dfb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683520174, "uuid": "f2eb3108-19e7-4304-bbde-6df35fe5811f", "comment": "Malware payload (Amadey)", "value": "6d10ea31fe3b9481223281ca33897fb6ef342d68101cbe5637e43d23d6eed692ee7104010a8d2b6204ea7192325b223f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520174, "uuid": "a6663d19-2fda-4e88-9988-3c8b5287171a", "value": "T143641A1392E1FCC5EA264B729E2FC6EC769EF2508F5977691218DA1F44B00B2C27B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520174, "uuid": "7252751e-2300-475c-ad46-bad0a4753ddb", "value": "09ad811c7b24c560499d47bd7c66a41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520174, "uuid": "737d2d2a-efef-437c-b80b-40abd8e21509", "value": "3072:spXTfWsauo0LLJZqaGi+yc2v4Ko+41pz4ZepSzScm7ga5Mp3PBHlqqTzQ:cTfxauvLLHqaH+12+31S8gu05JHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683520174, "uuid": "ce84b7c3-bd9b-4e6a-8c9c-dab702aa84f0", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683520174, "uuid": "ccdcf215-172c-42cc-b5e8-49f2f96411cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683520174, "uuid": "d584beb6-20ad-4abf-83bd-a6ffa16c0699", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98024a9-edc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkComet)", "timestamp": 1683566980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566980, "uuid": "5402a7dc-bf82-46eb-a352-1ce6f746f89f", "comment": "Malware payload (DarkComet)", "value": "b6100fa1252d02c13d5e601b77efa9e3", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566980, "uuid": "d2a2ed40-7b3c-4427-8279-db43226a1610", "comment": "Malware payload (DarkComet)", "value": "a5fb447c2992f48abd863452bcd6934032cf29bef1f0907bd9344a31a41e0edb", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566980, "uuid": "a0237eac-0c8b-4d01-b064-43c8ff30fb1f", "comment": "Malware payload (DarkComet)", "value": "f80c9e5aecfb6591751cc4f3298dabab96d07a80", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566980, "uuid": "7dca0c6a-df1c-4b37-96f3-de44ff7edd23", "comment": "Malware payload (DarkComet)", "value": "48e07ab6f8900e55099ec1c6be500a37897f265aa769c03b9714e4d54cb8bd77d18707b2ca37427036941de3ea5b3440", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566980, "uuid": "6431b536-4b03-4f47-820b-c9608f0c4428", "value": "T1F6551221B2E9FF55D9394BF82098B24007B27167A1F8F23D4CD294E9A5D6F814B40E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566980, "uuid": "4e9a2ef0-a61b-4b52-811a-010fbf5847c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566980, "uuid": "294fb27a-9671-4d64-bfd2-ced1ff064ca9", "value": "24576:4JsLC3guniZmuIPmKf/MpV2XfSquCtSFBfJ8X3ao4boGfxDlk6ddcy:4Js4g7KJiV2P7l6BfJ8X3aRbfxmKGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566980, "uuid": "ac80a86e-453c-4cd0-a80b-1936eaa7e6b8", "value": 1362944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566980, "uuid": "4f57831b-c80a-4e66-aeca-ed389cb43d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566980, "uuid": "25b9aac5-373c-4ff8-8f23-dbd4d8009a98", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27858.28647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329b3883-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550352, "uuid": "c5400bec-b753-436c-9f49-96cd3d7c6df4", "comment": "Malware payload (SnakeKeylogger)", "value": "f67a725f72be214874fdca85957bff04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550352, "uuid": "6dbdbd74-0bdb-4b13-aeca-b8860f9d841f", "comment": "Malware payload (SnakeKeylogger)", "value": "a66fe6a02551d6fe4813f4d7d9d7b5afe13d9ed94983009132535ade72bdbabc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550352, "uuid": "2d05970a-0116-4e92-ad1f-87d9c6655f03", "comment": "Malware payload (SnakeKeylogger)", "value": "da028d2214a47f37f93834417da1543bde475dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550352, "uuid": "e5dfd5df-491c-46e0-a18e-63f2e5221a19", "comment": "Malware payload (SnakeKeylogger)", "value": "46fd908ec5dac8bfa1356e665c2bf39287e083376c0e8c90f0a2185494a13bd7363169fbeebb07297bd2c9bfed0feb26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550352, "uuid": "a922e36f-3318-476e-bf6f-701b2336952d", "value": "T126052BD1B19089D6E96B0AF16D2AB43015E37E9D54E4C10C5AADBB5B36F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550352, "uuid": "43435595-1bba-4d1b-8d27-bfca7c9dae2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550352, "uuid": "89cefca6-3898-4e8f-b805-8529e41f36d2", "value": "12288:bRPRNImtLXA35XStmjhTQRiutpCKBk7VtA:bDGmW35itmt7KBk7VtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550352, "uuid": "8f2e37a5-b602-4842-9276-acbec5ec1ac8", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550352, "uuid": "4c672f77-e4e1-4458-8514-5857d6e4e6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550352, "uuid": "38788cba-72a8-4deb-9113-db81fa71bf9a", "value": "\u00d6denen Faturalar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d00003-edcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571302, "uuid": "e6f70345-f0c4-46a9-8f5e-5bba50910343", "comment": "Malware payload (Gafgyt)", "value": "d837ef4e1631c0dd6e53220b9ff1b477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571302, "uuid": "5a54aaa9-d34c-4dae-b8b2-643343d9360d", "comment": "Malware payload (Gafgyt)", "value": "a6701b03f2c3bbf423336ce8baf6504da9a1760801a89a3449ee2d6ee7196e02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571302, "uuid": "97683c52-5a02-4cda-9696-066d1ec82da8", "comment": "Malware payload (Gafgyt)", "value": "7a4a4a3e122cf294174ed17d43b239b6442175d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571302, "uuid": "51be7389-ceb7-4efe-be8a-664018d5ef5d", "comment": "Malware payload (Gafgyt)", "value": "b69817b507c9fd8cacb0de9c2f7183d53775b9b6c4f7cedafb590bc1b9c84e408cfc84f4f88835eabf61ef03749be756", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571302, "uuid": "c7abf322-f1ed-475e-9623-56f1650d7300", "value": "T1ADE34905D7408B57C1E2277AFADB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571302, "uuid": "d02260fe-f938-483a-9b59-a81655bc2f84", "value": "3072:Nt8iFDKEfFN+Fa+1sW3h7rz0JH/WbUMbmQwfCMQiGW:P8iFDLf/+FaNSh7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571302, "uuid": "e76777e3-68c0-4703-8791-9f1e9a7908de", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571302, "uuid": "ee3fbe2c-e21b-4004-b29f-d8d7f1070993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571302, "uuid": "8aa3a3cc-4f83-485c-85d1-308f2bd751c9", "value": "d837ef4e1631c0dd6e53220b9ff1b477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7361d-ed3f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683509429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683509429, "uuid": "9f601dd1-7137-4fbd-a569-d22d09914133", "comment": "Malware payload (RedLineStealer)", "value": "b216163efd02d6edbbd91d8e5b9943c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683509429, "uuid": "7e7a8c38-1827-465e-9e81-1669c1b229e6", "comment": "Malware payload (RedLineStealer)", "value": "a6beb3c7e961d37e78ee422813dcfcc4af225152882c1e4f9a999cfae5f4cd6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683509429, "uuid": "a166f340-28fa-4e12-9077-684893fb24a5", "comment": "Malware payload (RedLineStealer)", "value": "a34fa017a1221bf9dc837f9f28d2dd832144b723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683509429, "uuid": "c0016029-e4f3-40d4-a0d2-872c69daf153", "comment": "Malware payload (RedLineStealer)", "value": "37e40f70f9a7141b3672eb51078379fcbf24b1b0287533fbc5ee52db86c0633229c97e9572efed72120eda15ddc96f0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683509429, "uuid": "2e9c1753-5105-4fa7-9a86-3408da4e91c5", "value": "T12594BE0272F56C70E72656328E2BC6E4AA1EF951BF2937DB13156A2F0970DF1C672342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683509429, "uuid": "f7edb73b-9f0c-45a1-8062-dcc3efba048e", "value": "5e64b31f8e5697ceea07ff3f5dcea4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683509429, "uuid": "48daaae4-1b9f-4757-8753-6b4fad53bc62", "value": "6144:E5D8LBpWO1Mhl4i9nDBmk+MWq4tyqIJZbhwI44rXJqO8AlhnY7yo:E5AtpW/hxDBmEWq48q8vPFN8AlhnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683509429, "uuid": "d3448026-59ed-4eff-a08a-f6b637d1e482", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683509429, "uuid": "fcd50000-c70d-45b1-8fe6-81cb3768d63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683509429, "uuid": "7869ab2e-e0f7-48ae-9e6c-d5e7cd3ad6d7", "value": "b216163efd02d6edbbd91d8e5b9943c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a69bc4c-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683550794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550794, "uuid": "6f7fe8c0-d3eb-4c40-b5ad-b407f629ec9d", "comment": "Malware payload (AsyncRAT)", "value": "2a634644d7c354641e8669dc224efa6e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550794, "uuid": "9567c647-9c92-4b8b-9900-743031651435", "comment": "Malware payload (AsyncRAT)", "value": "a779a194e7901ef59d91eef611fb4973560b399dfe4df6b6e64f07fd254d271a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550794, "uuid": "323f7b95-4ef5-445b-ad76-cc8edf3ae68b", "comment": "Malware payload (AsyncRAT)", "value": "f3846d63fcf5dfbaaa61351c23fa352f44a07ac6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550794, "uuid": "2e860f19-c8ef-4276-95c8-4bbf13e599f3", "comment": "Malware payload (AsyncRAT)", "value": "dd9b309806e737961f352cdf6ca396f40fa07bb6f150d9dd842a198fba270b7233e7ac9043376871700c382eb1223bad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550794, "uuid": "7f59ca33-5989-4252-8fef-89471ccb7492", "value": "T1D2E27F1279EB2EC3CD580C626B77443EDC39262F9CA290BD9D4B12D1689714E3FE54B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550794, "uuid": "d97a8acc-3108-4f65-ae14-c8cad1579fd2", "value": "768:sggggggggggg8ggggggggggg5GgggggggggggygggggggggggzDgggggggggggkb:sggggggggggg8gggggggggggoggggggk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550794, "uuid": "abb7efc8-9fb1-469e-a656-71e309fecb78", "value": 31757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550794, "uuid": "84d22b90-2da3-41eb-b197-386bef956ab6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550794, "uuid": "88077d79-1d79-427c-851a-bccd25347d51", "value": "Information About Current Social Security Benefits Your Statement Benefit ID#260_XXX_A0008731.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e733cf-edbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1683563088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563088, "uuid": "79de0bc9-e4d1-4eaa-8165-438f7f82d091", "comment": "Malware payload (RecordBreaker)", "value": "2aeac863392c9a2a31058c6d5eeb4cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563088, "uuid": "340a2b6b-7ff7-4a86-bae2-f553c2758ec3", "comment": "Malware payload (RecordBreaker)", "value": "a7b25c3995f6bc79c2075efbb0bbdbcc0a3cc7fccb920b6c760981cd866ed89a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563088, "uuid": "13cabed2-76db-4d73-8109-8e7dc8caef97", "comment": "Malware payload (RecordBreaker)", "value": "a45b2e4905117c4dae0a3666a4590f538b69fdcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563088, "uuid": "1ebc2a08-2d3a-44df-8c6e-6ff7266088e9", "comment": "Malware payload (RecordBreaker)", "value": "08b04d90fd11c25618393237c29896c8d5a342a7d40f34a7a98e2dad3d37de071ea4757711528b3599eb9859e6cea5f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563088, "uuid": "0a3db55c-4224-48ca-a3a7-62668f7d9d4d", "value": "T16AB4015472B68F60D53A8FF52938B80103F634A758E0DA5D0EE661CE2BE7F101B94B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563088, "uuid": "3eaf96dc-534a-4a12-9f1e-de3c5ff2f2de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563088, "uuid": "3eaaa1ac-79cd-469f-8ddf-53ca82ae9cbd", "value": "12288:hnNXliRo0L376ujZIBalmrh0Jzw2NXegPTHrHlRwzYLSmhrWE:pfwo0LWujZIzrhQw2FegrHhRwzYLSwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683563088, "uuid": "5d51ce72-64d0-4ea9-856d-4900f0ea5ab9", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683563088, "uuid": "45061007-2c96-4710-8d53-8391a080ed33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563088, "uuid": "3585fb9b-07a9-4e05-b1f2-f3c5cbcdd260", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fccdf87-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683534993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534993, "uuid": "8f8482ea-b8fc-41ac-9243-aa6c0c32fd7d", "comment": "Malware payload (Rhadamanthys)", "value": "4b99ecf31523b1a5c53b270b40597770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534993, "uuid": "97b804d3-db4e-40c3-a026-ed837df2dcfd", "comment": "Malware payload (Rhadamanthys)", "value": "a81817d4fbe3876c3816816bdcf8c4f9a62e1fee006a74932bed350afa7f59f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534993, "uuid": "dbe474b0-e87e-401e-ade0-7961417e37a7", "comment": "Malware payload (Rhadamanthys)", "value": "05b02d7484eb29944dbc53cbe07d4fe77cb01205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534993, "uuid": "cbf285b6-4ee5-4f7f-bff9-ba7b9ac1113f", "comment": "Malware payload (Rhadamanthys)", "value": "5b0fdc6ede03a65d2afa787530e3f1808d20302a5a9ac5f5621905572e9045af77c9672e81b2a575535809c9f8942418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534993, "uuid": "51b0d019-86d5-41f8-b61b-1283d3666787", "value": "T1D9843B0392E13D54FB268B729F2FC6E8765EF2648F597B7922189A1F04B01B2C173725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534993, "uuid": "a04a3270-1509-40f9-85e5-2fc040e3cbfb", "value": "3db40e466a7c8f1c688be69648a0607f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534993, "uuid": "d380beae-f3e9-4174-9def-9d5d2d732f75", "value": "6144:UN6nlSL7hRTEKzd0fb/nnM9UyTBxcGf9x+k+:UN6o5RPzd0fTnnrUjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534993, "uuid": "96aab7ad-6e16-465e-b068-74326f425ef6", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534993, "uuid": "f155df18-faaa-4029-9733-e4e2777ed6c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534993, "uuid": "e693f611-dae4-48b7-b934-a568f48cfc13", "value": "4b99ecf31523b1a5c53b270b40597770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a51567-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683534784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534784, "uuid": "927431f1-02c5-489c-8ed3-fd71f459e841", "comment": "Malware payload", "value": "f4a0d6e5cc3bd7af5ef91be48748b237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534784, "uuid": "735ae4dc-4aea-445a-905a-ca0e613f4bd6", "comment": "Malware payload", "value": "a8572124651997c309a4a88a83dca8c7b12e2424df8f729779041e5848d9924d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534784, "uuid": "08cc7d88-1598-48c7-9cb7-1f96c8fcbfc3", "comment": "Malware payload", "value": "6d8158651881adec90c4149a98b80d898a149bd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534784, "uuid": "17ec39bd-5a48-4c77-a393-948cc1fe9a2c", "comment": "Malware payload", "value": "e236f9bd291bc4a2c9c5aa8b506c2971630bfe66711bdee8801955305ab3aadd7dea229d9a2bba9ff1ea2658d38c8b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534784, "uuid": "d9aa000c-9e9a-4e8c-9889-023cf120a0b6", "value": "T12C4633CFE4D5A1BBD60A95704DA9C0121E4FB89BF078651E31F0C9AC9FB7636A5B0123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534784, "uuid": "e3212e30-ff9b-4345-840d-331570f8d205", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534784, "uuid": "78b5daf0-c8df-4de4-b52c-b09d54fb58be", "value": "98304:3W13mLni/5bhO58kstEdxyL+JLiJf8ictNAxfxkLJsrwolpUt0m/U:YssNO8VyL32fGLJUwo3USl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534784, "uuid": "6d579c00-c5b5-4c5e-a5e1-17e1d034c953", "value": 5489600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534784, "uuid": "d36fbc9e-9f81-4113-bcb6-cec99e6add16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534784, "uuid": "af2284c9-cba4-4b34-9462-1fe7cc03daa6", "value": "f4a0d6e5cc3bd7af5ef91be48748b237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a637a0-ed6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683529869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529869, "uuid": "3214cd90-53af-429c-9ee9-0638e661c44c", "comment": "Malware payload (BluStealer)", "value": "50815feaceafebb93a883fd6790af856", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529869, "uuid": "945dda6d-df28-44f4-bb9b-7464741341c8", "comment": "Malware payload (BluStealer)", "value": "a894ab5bc1a3a77398b7c8b154acc165d9dc5e4e183e573daa8dda6c969d58f3", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529869, "uuid": "02766c53-d282-40d5-8e0b-6b4a2b38f4bc", "comment": "Malware payload (BluStealer)", "value": "9eee055af8be7bc6de2b6a3b869b553758ca741f", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529869, "uuid": "eff7e534-ef40-4f9e-8a8a-6772e70c01c8", "comment": "Malware payload (BluStealer)", "value": "b91e76d35371d203e6630b24078853d51867ae1002fc0f3a4d2ee6733a98b6b32bcc48d9d88912478d6c8013a548b6b7", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529869, "uuid": "a65ef692-b6fd-4898-a2c2-f799485c102d", "value": "T1597512542279B792DCF783F8B204E401AFA56D00B3BAE3E84ECAF0D95255718F611B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529869, "uuid": "3308fb67-3879-4b1a-becd-f59aa957a127", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529869, "uuid": "b19c88c9-3f71-43a5-820f-abd88df3b88b", "value": "24576:EMQt9u/6kEu3h2ZuJPsbIf0O9AXpTHH6yTuEBEel9DWtJ/qBcME7W+DUn+GOaHjR:Wt9u/6kzwu7sjFpBEeritJ4QB0ZljJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529869, "uuid": "bc6d2720-a315-47cb-a043-2e8543c24588", "value": 1607680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529869, "uuid": "7af9143a-018c-4d7c-854b-951ed9be28ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529869, "uuid": "f5cd65b0-b51f-4b85-840b-49c62646fa14", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0d9035-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683578097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578097, "uuid": "befed7e1-f58d-4e6e-8ced-f23b9795151c", "comment": "Malware payload", "value": "13435bccd4eb33b15dc2771034c0008e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578097, "uuid": "d73b8a9f-0a21-480a-afc3-a80175ff1680", "comment": "Malware payload", "value": "aa69f5bb20fe1168f9d41f0bfd4081bdb6971ed5d46b7c4a41b5d8357ab6ef65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578097, "uuid": "f4bb5904-33bf-4d1d-8e22-2eba2c2fb430", "comment": "Malware payload", "value": "1505b457a00e2bfd2a9a07f4f87137044018e05f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578097, "uuid": "aae2b30c-d45c-4003-a000-4b10802d0c32", "comment": "Malware payload", "value": "60e7f0b93f4c9bbb04c11a98e52abe81a88d3537f46d033757bb74f9955cb6336d61a699bdb4e2b666af4147cb67a58e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578097, "uuid": "438deee6-c584-4d7f-8e73-44d6360402cc", "value": "T17516CF314283FCDE37FA1D85C418A4441D4DB4279B58916DBAAC16FBB3EB418EE6E870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578097, "uuid": "41d6f9de-c4fb-4888-80eb-6a9adf9d94fc", "value": "49152:Fo54qL0paCoK848perT+gPy3mi1FQXm+VLRIKNA7b/:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578097, "uuid": "35a6b984-d742-4ac2-ba00-476478896e66", "value": 4164268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578097, "uuid": "725d49f5-621e-4a6e-b4dd-4eadcc862528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578097, "uuid": "a5ab4e03-4aad-4910-8e86-d5d2482496c5", "value": "new_rump_vb.net.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6cf3f9-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683504650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504650, "uuid": "4a05e0e4-00d0-42ab-b1de-456cc4218c20", "comment": "Malware payload (Mirai)", "value": "25fd07368d70f33599995871f72a0764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504650, "uuid": "0f799634-3df6-46c2-9bf9-044c4bd36afd", "comment": "Malware payload (Mirai)", "value": "aa8a402b12477230a54efd3cece297d12c5c8d6202a9a537c911cd45b68a3b60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504650, "uuid": "ca166bac-415c-4fd1-a26f-13e48a9cb329", "comment": "Malware payload (Mirai)", "value": "8938f7f295305bb6df8268c06a2ea6c2cfc98480", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504650, "uuid": "9ffbdaf3-a8a6-4797-833f-51a32f553c77", "comment": "Malware payload (Mirai)", "value": "2a54cdec8798843511d586fcce760f37623284524db5945498dcdfe814083bf8277d82c731ec45f58decd631f2f81fc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504650, "uuid": "d0ae4765-ef6d-4bb4-a57c-346679fcf499", "value": "T1EB2318417881AA13C6E4137AFA6E01CD332523A8E1DF72179D222F5477CA92F0DBB656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504650, "uuid": "c3e887cf-b7c4-450e-9dff-f3832375f8ab", "value": "768:rEg39rSAbUjh9Q+Rfq6q5mqoWT6lBFWKFNQ96Hvi6wVoVMscG37OSj7Af0PN+aa9:J3tSAIjhDWTyBFpNQ96Hvig3LO0DB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504650, "uuid": "9e1387a6-2af6-4c05-a968-b26b92edf242", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504650, "uuid": "1d6ad5fb-0e3c-4c19-acf1-43399c366db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504650, "uuid": "951a25a4-4d18-438d-8047-12641612761e", "value": "25fd07368d70f33599995871f72a0764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbabd1d9-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683578123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578123, "uuid": "e5b3fa5b-58da-49ca-b1f2-0d375037f699", "comment": "Malware payload", "value": "25254a789403a6fc5da9e4eb8cfc9f33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578123, "uuid": "c63218a4-03e9-437f-8408-c30f0a9ee6b3", "comment": "Malware payload", "value": "ac461923f315c985621f33a60d135715272d8b191bc2dfb5b94642233bd1b1f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578123, "uuid": "09345833-5233-45b1-a0ef-9bcb5ece2f1d", "comment": "Malware payload", "value": "c21b6e90687fa175143ef4e550a32315173a093f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578123, "uuid": "3b47abdd-c56b-47f9-92f9-c9cded92d1ce", "comment": "Malware payload", "value": "ce7248460e76f2d09408e7cf4a94d96bbe2fdb2496602121c1ea30e7a85b599630402df2fa1019782754712385ce037e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578123, "uuid": "2c73bc51-2eb6-4022-87fd-88e694f28fa0", "value": "T1A216BE7262C7FEDD277B0DC890083B819C1C75278718919CFA88167363DAA55EE2ECB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578123, "uuid": "46ee1caf-dbe3-4615-a85a-bcbcb1e09224", "value": "24576:3SLshSQBnI9lwihoPcLUcddmfkmyieAsjSx9senTCq1gcli2Kf0Ngu8MPdzySzyc:z0j33HWfiEifcJcoAbyCmUyNJOHziRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578123, "uuid": "f9a3fe2d-bff4-43a3-92ef-4a624c015753", "value": 4162904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578123, "uuid": "1de7526d-83dc-4766-be1a-44399a750d59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578123, "uuid": "38c34282-c42d-4b12-a60b-6b9bf321bd05", "value": "rump_vb.net.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c873335-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565938, "uuid": "8d09ed4d-2a9a-44f9-9b08-d9ece6f8014b", "comment": "Malware payload (Mirai)", "value": "7289e2779d277b2bf623d3879598d525", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565938, "uuid": "acf606ba-66a0-4011-a881-6684c774b597", "comment": "Malware payload (Mirai)", "value": "aca1bdfa6c84f89a79cee73dbf8dcdf55b8fd0342c90793d624f062328670286", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565938, "uuid": "09cba8e8-900d-40e4-b33c-1776ba0ccc14", "comment": "Malware payload (Mirai)", "value": "bb7a9aa3c28511afa9f9f17ef576a374c2b333db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565938, "uuid": "7e78c911-e5f6-4264-bd0f-0eb944ccc4f0", "comment": "Malware payload (Mirai)", "value": "99c3f1fcde295ce15b4f1131bd994571035368c4cf037cce27b683fc0ffc573c746b48debeee460ba583a64fb267ca44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565938, "uuid": "77940746-ed34-437f-a204-a25990e94f32", "value": "T1A114C844AC64572FCBE3ABFBF75471CE727646841F83330AD72859B013C16EA991A293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565938, "uuid": "6224211e-9dc2-4818-8da1-14e7c6e4ff5b", "value": "3072:r6V49BWfUNrnf5RtRAeNo4EH/gLv/O9zn21anZLq86MOF7S0hRooF6UssaNiD7Ed:rkyovfRlty8m3tzoFbQ9ggv1uq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565938, "uuid": "d18ddaba-6bbc-44b9-a80c-5abc5c957ca9", "value": 201319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565938, "uuid": "7f5ea15f-a665-4275-8d1d-8d8239251dc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565938, "uuid": "79659330-0ed5-4f26-b16e-8796dab25b72", "value": "7289e2779d277b2bf623d3879598d525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d00a44-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LockBit)", "timestamp": 1683516460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516460, "uuid": "91e9d9aa-bada-489a-9b4a-d9d9fbc04d62", "comment": "Malware payload (LockBit)", "value": "5a70683b081a768bff0281f40ebbec89", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516460, "uuid": "6076988d-a2bc-4aaa-91cc-540351c142bf", "comment": "Malware payload (LockBit)", "value": "acfe3f344edfbd4f62f2e28ff96bb3c62b589ab895990ee2498a33280442c0b3", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516460, "uuid": "33a383d8-d813-4628-8ffe-a2a851480c59", "comment": "Malware payload (LockBit)", "value": "1d8fe9c1220ffb524c3e2162ce3b7d150c3f5c1c", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516460, "uuid": "cf1ff431-7c4b-412e-a722-5358d5daea81", "comment": "Malware payload (LockBit)", "value": "eadecbed24144a2a2fa5e444f7789d2637629971cf8130a2bb1f11a03d710e3c57f243b8cdab5a785d1b93d11d0941e0", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516460, "uuid": "48657330-5f3b-4032-9a8b-a80a6f2f756d", "value": "T168E36D21F212D0B3C87718F13736B572B39E4D2C19A96947EAE80F5DBCA48232F15997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516460, "uuid": "b18bb337-15cd-49c6-aed8-02f85d9deb39", "value": "acd3b654f3f639b4748149cb649c3de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516460, "uuid": "4e5be3ab-2031-4bec-858c-d44085743633", "value": "3072:Z6glyuxE4GsUPnliByocWepGuWNBDXa1qp3f/C:Z6gDBGpvEByocWeczeqFf/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516460, "uuid": "661a7909-d543-4559-87e4-81493a7b03f6", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516460, "uuid": "cb10c898-bbcb-4bc8-a8da-ff4296b47011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516460, "uuid": "0cfd17a0-307d-4995-bb97-0d002efde5ea", "value": "2023-05-07_5a70683b081a768bff0281f40ebbec89_darkside", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca4a2cb-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528706, "uuid": "de351009-0728-4b4a-8caa-2349d1971c26", "comment": "Malware payload (Mirai)", "value": "b1da75e7aa98fed0645d81ddd8e08a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528706, "uuid": "d96fdeb3-82ad-418e-921a-eff0af21ddca", "comment": "Malware payload (Mirai)", "value": "acffb1390fa3001a975cdf932be37b2cb57f5dfab827a8c94a2b9651bf83c7ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528706, "uuid": "5b519fca-d12a-41a1-9eef-fa988af42409", "comment": "Malware payload (Mirai)", "value": "334ccc1212eb1f2c443304dd26ff0647d878fa73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528706, "uuid": "d5a2aeef-d5d4-46f7-8944-e71e9d3bbbb7", "comment": "Malware payload (Mirai)", "value": "ad121aade71041a6eca9f394bf3413ef277f9e9a2b8c0a5c96e867147535ed0444c3f08800296c09fac668f2fcd59d92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528706, "uuid": "ff04520e-8207-4cec-a1a2-3a757885847a", "value": "T1EE632BDAF801DD7DF81BD77A4453090AB630B3D512831B3B639BB9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528706, "uuid": "510bda79-af94-48dc-8c7e-05ca61b71543", "value": "1536:vAgV/sxE+CWDY7Dm8VJyyE1sxQWbxdJ3rWNzE+VQCy:vAQ/sO+FE7DiyE1GQSx/B+V7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528706, "uuid": "950ab60c-4221-4bfb-9ef7-2b8330066088", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528706, "uuid": "572f1675-f4cf-49e2-a226-d3b0994d5470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528706, "uuid": "bb06591e-ee6d-4c6a-b1a6-f9cf6ab0e9e1", "value": "b1da75e7aa98fed0645d81ddd8e08a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e663519d-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529179, "uuid": "83595c82-0531-4fe2-9daf-4507d14d21cd", "comment": "Malware payload (AgentTesla)", "value": "d3b70289b36b1d189e70ba283a68b617", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529179, "uuid": "c74135fc-d19c-442a-ba9a-82d1d8db8ccc", "comment": "Malware payload (AgentTesla)", "value": "ad7d0cc457d1c3143cbf3e7d9c02cc61ca1a38aa2161168be3905d9948a8c72c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529179, "uuid": "be885d09-c16c-4919-9e73-2b1611cf5745", "comment": "Malware payload (AgentTesla)", "value": "3b4ca9bd2d37dc37cc4651bbf62ad0347f369b36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529179, "uuid": "cae8fb8f-c6ba-4641-be41-855662b21a26", "comment": "Malware payload (AgentTesla)", "value": "7e613224cc86fc1a72df5cbc665c7ddb9f153d75fea6f18c2ea4df404f8f5aaabb2823632facf28be816d5b17e668241", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529179, "uuid": "f17e7d8a-1ce5-4612-8421-af295c5c54a5", "value": "T19CE4CF4DC278C464A907A770947ECAB73B4D6F72D34B832961AC62D347508D0A3E7B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529179, "uuid": "bc5eb50a-cce2-43cd-bc52-8ecbadbf3f42", "value": "12288:nFMVoWEvx5xlotYpoL0DLVLWDLVLrXDLVLYDLVL5ap5VrW1U4cZKBx:nFMPI/otEaR40LKRcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529179, "uuid": "164393bd-5358-4eb2-b54b-66c9a19b51fb", "value": 678808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529179, "uuid": "080951cb-4389-4ebb-b2fa-2c88fa5f550e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529179, "uuid": "1806d4af-196c-49f0-889c-cd9df2c97062", "value": "Weekly stock list 0805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e89aa84-eda6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683553539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553539, "uuid": "3885cb92-0f7c-40bd-b5a4-62bbf95c5029", "comment": "Malware payload (AgentTesla)", "value": "4972f681e5b3b1f784495145a4275098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553539, "uuid": "a1573afe-ed0b-4811-8c48-f8bd4a0715fe", "comment": "Malware payload (AgentTesla)", "value": "adf7ac344717cc3b2f0a8aad0f0d9aafbe719abfbabbf6e4f82d13352d73dce9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553539, "uuid": "6493a594-1a84-412e-8cdb-74a0e5c86d0b", "comment": "Malware payload (AgentTesla)", "value": "d1d44a38487773ebd85a95bd36734e77d3d9415d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683553539, "uuid": "ea62193a-4dbf-4fc6-a013-d670abb1e613", "comment": "Malware payload (AgentTesla)", "value": "bf500b034fc944f65a8266b8ca017d4261672e6219214e965e7c49398ae95455ea18bd6cdbb7b2bb7747db2c0ba703e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553539, "uuid": "0db4f15b-9f9b-4a26-93a0-29690d4bead4", "value": "T1A815A43829BC3523D2B5E9B2DBC4E521FBD089923531CDDE1AD240861AEF60676CBD1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553539, "uuid": "c15dd479-6280-470c-9011-6435cb6c64a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553539, "uuid": "39b9152e-dba6-4ea9-b276-f41ed23f464f", "value": "12288:ilv8WRCxst6EQZxGN43KwC32hYkemGEtBfUmB3RRZy4:qReFs2hYzgA23rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683553539, "uuid": "27a53cbe-4a1e-4063-af75-fdff39af55ad", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683553539, "uuid": "594e1cd1-a531-479e-a312-39fe34177328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683553539, "uuid": "59a6c02e-c9e4-48bb-b35d-7fee7e4f33a6", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85adb3cb-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530305, "uuid": "e30e7e9f-5d09-46ac-8df3-513fe52067fe", "comment": "Malware payload (Mirai)", "value": "b81ba2b4a26b5a725b437b67a4efa3b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530305, "uuid": "bc292822-7306-4a96-92e8-c19caf3d1541", "comment": "Malware payload (Mirai)", "value": "aef1da71f6cc330c00b3ef4a289c227d074c0c05f7c542341c2be63d0847ddc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530305, "uuid": "7088a77e-7f8f-40d5-a1d0-5209d7f05385", "comment": "Malware payload (Mirai)", "value": "43d4b4bdb67dfc335af8de2fcfbc1f28c6321840", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530305, "uuid": "99a8b139-be81-4348-a232-f5f07bfdf7fe", "comment": "Malware payload (Mirai)", "value": "8dec0674cf7a1211a9f118cf73c5b2b1091e72cec6c4232129c50d7c3cab4ed25269cc1567e13bcd1951bfb98635bf47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530305, "uuid": "27e9157a-97f1-4619-9482-e4ab4aed5803", "value": "T1D373A41AAB500FBBDC6ADD3B08BD0B0639CC594721E83FB57C35C528B51A64F59C39A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530305, "uuid": "c0ed806e-bdfe-440f-a1e7-762b5e9b654b", "value": "1536:sRqSYhx2MqUHUSMRA0U62kk++Zk1/uKC:sezrUSj++qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530305, "uuid": "1b6069ed-f8d4-4fb7-9955-afb8292345bc", "value": 76380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530305, "uuid": "86905a14-ab5a-43f5-98dd-1a07cdc2cd2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530305, "uuid": "f0a761f2-9da6-4e38-a2b5-7918c811b59a", "value": "Andoryu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a02cc93-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683550767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550767, "uuid": "22de8827-3c12-485a-b2a6-688b0cf7ba8c", "comment": "Malware payload (AgentTesla)", "value": "c523be3cb62c2cd33444502139cbe931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550767, "uuid": "d5d39deb-0f4a-417a-96d2-7bfc15203d40", "comment": "Malware payload (AgentTesla)", "value": "afabd885f80a72d339be30cfe7dc52e6cae848fe7cd1e371361b7d6ae2c726f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550767, "uuid": "dca05ab9-e495-4a6f-a1e9-4a9586c60789", "comment": "Malware payload (AgentTesla)", "value": "5ba4eb8cce2fc6ae7b334fb63c971043ff0a3d86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550767, "uuid": "2bb4ffa6-c1b7-49fc-88ee-095d445b7868", "comment": "Malware payload (AgentTesla)", "value": "6211a785dac744ed92985e86f2c7b371719bc320b69f8e06da4ff153a315ec33a9508dab7fef63f3493eddabfd3d3e5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550767, "uuid": "20aa38bd-bf71-43aa-8e29-7ba6cd0b7222", "value": "T1F034E04577829711D9489A76C4D7103403FBF3833AB3C7853D8883BA1F827DA9A9979E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550767, "uuid": "87708363-8f9f-40aa-997a-d85bd2022b1e", "value": "6144:vuNs8XMlT1nG0i+aTNSha8bNBhs7Vw+ayuMR7AVn4:GNVXMlTBi+uShLs7VwlyuC7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550767, "uuid": "ebf33ad9-9310-4d67-9a0d-8fd14028b532", "value": 248904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550767, "uuid": "42a7551b-eec4-4da7-8efc-d7e4dbea9412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550767, "uuid": "ceb03eb9-f860-4388-8ff9-a19c4bf214c2", "value": "ZiraatBankasiSwiftMesaji-08052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f63b458-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565889, "uuid": "af74bcbd-6f68-4348-8c2e-e343036fdd72", "comment": "Malware payload (Gafgyt)", "value": "fe5701a6011fc6567db1a141e2e2e99e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565889, "uuid": "b06e36c8-8438-4d6f-803e-4a9e9c979689", "comment": "Malware payload (Gafgyt)", "value": "afc6fe19fb874b3a322266e3ff1c5c1f1a44298ceb499cb2735e5638b63f3b49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565889, "uuid": "559c012b-d85e-4b2c-b94c-1e7b2c0a7891", "comment": "Malware payload (Gafgyt)", "value": "4b4f66782ce6d9d035bd3a029e7088c5d8b06f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565889, "uuid": "13d8bb23-b410-4a2a-a8f5-f301c3d420cf", "comment": "Malware payload (Gafgyt)", "value": "ad114ae87add4d7c051898d82b4875b2ac94fc34b02de7814f96234276c6dcd59b2897ac6097efbe27560d80537eb998", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565889, "uuid": "6cebd574-d345-436a-8055-760022015575", "value": "T172933A56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565889, "uuid": "b25b3096-f9f9-4da9-bda7-e6265cc8617e", "value": "1536:mmqmWTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emTGMUNLe5um7WAgcVjmZIcBI:mms2UVUtBUI8GwPfHkk8rVeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565889, "uuid": "694cf60c-c27a-477f-8834-6b9979f41f8e", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565889, "uuid": "40642718-db6b-4f21-84d9-12d21bb4efb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565889, "uuid": "1d2d81b1-72d5-4535-9a07-4eb662c407fe", "value": "fe5701a6011fc6567db1a141e2e2e99e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfbe494-ed9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683548757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548757, "uuid": "4944c091-2a83-4ada-a12d-95477533b10b", "comment": "Malware payload (RedLineStealer)", "value": "5336a40e1d43205df5cb1d37013f8136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548757, "uuid": "04cab8c7-1140-4e8e-97db-59f3849f73d5", "comment": "Malware payload (RedLineStealer)", "value": "b00f54f3033c071fa5844a8afad3623a2ad086a0a8fb4efa51dc65f6bc0818ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548757, "uuid": "220eae99-fe64-4164-ae0d-95475105e5d9", "comment": "Malware payload (RedLineStealer)", "value": "7581b650fad4c5f2823ee45f10bb0ae4e0f7030e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548757, "uuid": "8e22bd2a-604b-47e9-9390-fe0b8b51cdba", "comment": "Malware payload (RedLineStealer)", "value": "b48349a5600d49e305e0baed94092a4df9989cd1796944bef4e88aa73a1a2f2827b43f472ee851bbc8aafafe4fc3243c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548757, "uuid": "57236848-aabf-4c52-afad-96e1e4c0c5a0", "value": "T173A41242B2E84472D8B62BF454F712D30B36BCE1DDB8427A2705985B4CB3688F97572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548757, "uuid": "1d577203-c86b-4ac0-b64a-752a419d8120", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548757, "uuid": "a31e1bde-6fcc-4a80-9dae-bd98d50b8e80", "value": "12288:OMrey90FzNd78jYV4/y7O1BQz0iwf+f3cCD:EyozAjYaRBQz09+fMCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683548757, "uuid": "21bf8c15-94b3-408e-a9d5-de11e498bcf9", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683548757, "uuid": "1c414c4c-80a8-4295-9f67-daedf1d2364d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548757, "uuid": "0e30cf74-ef0b-48f3-a11a-e5018b9f1c9c", "value": "5336a40e1d43205df5cb1d37013f8136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7bc8da-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550394, "uuid": "3f2a7222-c886-4467-baff-51996f814e5f", "comment": "Malware payload (SnakeKeylogger)", "value": "642c03d1224483f2ba16da4a691100f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550394, "uuid": "adb4ba22-bd0c-41c0-bf8c-766fcda495b4", "comment": "Malware payload (SnakeKeylogger)", "value": "b050f56ceec41d0c409065b66cf598cbaf75a565afab1b47552624e085a3a9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550394, "uuid": "ccbd5e42-5297-4f3d-97c6-c9474f5ff5f5", "comment": "Malware payload (SnakeKeylogger)", "value": "9b13434cb7918cd7189b79b1db5c06e83d1b6336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550394, "uuid": "cb3ad043-36b7-43ef-bf7f-722a9f2839a3", "comment": "Malware payload (SnakeKeylogger)", "value": "5a164c99475c01725abdad95070315c514bf7eca9411351ba5214ac1026fb2a4c35b9c38318913052b634435e2c9a701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550394, "uuid": "0b103713-d9c3-4a8a-a072-e19be1f3cd70", "value": "T13DB4F14572FA8FA1E9358BF41938B84003B270E79DF4D65D0EE551CE2AE6F2017C4A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550394, "uuid": "83008a82-fe1b-4d0d-b709-ddb9ba4ede6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550394, "uuid": "b4682b1e-ffe9-4ea2-a58a-a8a2e39da7aa", "value": "6144:7WhOS6fwOVienfQoWBzXvJLnpPiQYOi0VyJnHVf1b2ce9KjgkjePrkWCG7bSmah3:BLfWF/BB+1f1ukj6AIa+nudUjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550394, "uuid": "9149087a-2260-4c80-be87-470f8bc662ff", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550394, "uuid": "fa9beabc-9ba7-4a42-9acf-8587efd82f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550394, "uuid": "2347b5ce-cb53-444b-9a93-bc177d410d37", "value": "Purchase Order No.89006993.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda8a5e8-ed78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683533942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533942, "uuid": "31cde20c-de0e-4072-a372-c05e574672a8", "comment": "Malware payload (Formbook)", "value": "64db587135351a24a1854980c3a0de20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533942, "uuid": "e45b631c-d8a4-4c16-80aa-0539359600fc", "comment": "Malware payload (Formbook)", "value": "b07bf739cd3a803bcf0d57fcbf8d5a628005457db39fd045324e08bd92e6537a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533942, "uuid": "70511002-0042-4c87-88d6-40cc883bb8c0", "comment": "Malware payload (Formbook)", "value": "b10cf48c2bae6567362ca1ca18e4cdb86c856f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533942, "uuid": "9ca9e0ca-259f-4470-aab3-970eb9e76be2", "comment": "Malware payload (Formbook)", "value": "bfc75d0f9617ac1883c2443876cb56f166c5ddbb061fb15021671b9217a735f3dbe8163875b5900c583a2d89c05ee5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533942, "uuid": "bcae2adc-76c1-440a-8f91-6be891659b99", "value": "T1DC05E13527B9BB91ECB683F82608A001AFB47D5163B6D5E84CCAE0CD5159F09FB10B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533942, "uuid": "bb14d958-73f1-45f3-9a4f-6a9003e0e23b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533942, "uuid": "918aeb7f-a1c7-4a42-af8e-3d593000d0b8", "value": "12288:8D11KTIOnGgXWMbT1xl42vnsXu4ZdPY+sQN45fmd:8PKTIBgXx1T42UpP+QK5fmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683533942, "uuid": "85965eec-7c74-440d-9e8b-0c6f36cb2e4c", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683533942, "uuid": "84ce1fb9-b1c4-4ba3-9f3e-1dea07053a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533942, "uuid": "fa823cc0-df50-4a4a-bab1-945c191e592c", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a42977c-ed72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683531037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531037, "uuid": "74f09444-203d-434a-ad8f-4e5ea0125a92", "comment": "Malware payload (BluStealer)", "value": "1e83c4305573d2474cff4b83f5f5566e", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531037, "uuid": "03e209d7-8cbe-42de-926e-89a85eb789ce", "comment": "Malware payload (BluStealer)", "value": "b092e2388c1f790870d97b73440930d4e0c134610c17091e8987622745a0cc48", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531037, "uuid": "829ef1f2-2560-4b28-8a88-f0bba5505030", "comment": "Malware payload (BluStealer)", "value": "4ae7e03082ec4660fe2787c0b512d21dc5367998", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531037, "uuid": "66708b48-5af3-4f38-9219-416bad9a635f", "comment": "Malware payload (BluStealer)", "value": "7717900f8e06161982f3cd34273ec5946f7a5ceac21d867d9fe1e16405daa0222d8e7509c6d2b9715583e36fd335c64f", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531037, "uuid": "66f97201-f998-452d-bb8f-efc267a99012", "value": "T1A72502126059FB22E7B847FD92484D0407FC2521BEB7E7682CCE50C9EDB6B505712EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531037, "uuid": "aad6d483-eb45-482f-9dd3-dd494556da93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531037, "uuid": "0201026a-82f0-4760-b633-b8c84e9fadb5", "value": "12288:/cgBnwlSWJwXmZbMRaVb1tQUlhJGEy24XrmTVBHZowtet8zzQRDmwsEiHXl6mhuw:di9gRchxl3Z34XrmJGqOFi3MmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683531037, "uuid": "738beb18-88d4-4a68-9e19-619e672de27a", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683531037, "uuid": "5985a9fa-530c-4d71-bcd5-f8756e7cf462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531037, "uuid": "a1520e93-a3c2-4f6f-bd75-40ace16ce68d", "value": "POHT320ML-230000026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af27f360-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683570318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570318, "uuid": "55735d12-4928-47ff-845e-fc30105ea626", "comment": "Malware payload", "value": "24c99a73330918cfc924656bd23907a8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570318, "uuid": "5c5b8f20-18b7-4b12-8090-34763b7687e3", "comment": "Malware payload", "value": "b0b6f157d6b952826b3f20ace4d1da4c28d4e1fb5a29bfdeb641f8bc3651504d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570318, "uuid": "fab5c11d-be0b-445d-acf9-6bfa2b84be9e", "comment": "Malware payload", "value": "568864dfda3dadf64cee58b9f6ef130e08fe9fe3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570318, "uuid": "650cee23-5ec8-4282-ab3d-ffabea92c532", "comment": "Malware payload", "value": "7512efcfd8acc0bb66d3addfbf0cf31535ccebe10ae46b482d6d87f5c2306fde7f9c2f8765199384776a0e40ec8b28f5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570318, "uuid": "aa886696-c3cb-457b-850e-69df57dec42b", "value": "T1EB54E0137A09CE83E142D7F17FC79E8A170BBF059A8234D72145779F6B34A9128C6A2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570318, "uuid": "51252e88-3a30-4b9c-9aa4-fffbd2d51e62", "value": "6144:PqaFJkKXiDU7w5LY5+c2SxhRBjd6jVM4kdGIr/HgU7VVXCua:PqaFiKXKaHzLRRd6jVM4HY/AIna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570318, "uuid": "1d428c83-bb9c-4a38-af92-969c0dafe18b", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570318, "uuid": "50aff3ad-0f60-4d91-a8e9-a1906550257c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570318, "uuid": "ebc14edd-6b0e-43ef-b9b9-5205d49a8197", "value": "APPROVE FI without value.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a85b2e-ed7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683536658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536658, "uuid": "e38e2249-8b71-48c2-9c68-ab67be38a6c9", "comment": "Malware payload (AgentTesla)", "value": "8844465335100e33c142bfb89c433640", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536658, "uuid": "7d5f2d7f-6af5-4bd7-9ebb-68fdef8cb323", "comment": "Malware payload (AgentTesla)", "value": "b153261c18823db96bfd055e398bac3f7c3853aaa006c2017dc17d13e49e23f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536658, "uuid": "37e905de-f6d3-40f4-be61-b8626c306337", "comment": "Malware payload (AgentTesla)", "value": "84cf8bb7ef7d07a0705f5cf91868b85c4d104460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536658, "uuid": "9747d688-d174-472c-8c21-d00a45d50a44", "comment": "Malware payload (AgentTesla)", "value": "a6f82b79cbc6a5e5f0feee7fa3f2aeed9e8cc8f17d04fb6b453b9b93638fe61c15f7492c9006472b49b19acb93db78ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536658, "uuid": "8e156dca-bafc-4fce-8b67-3ec5b645ba3e", "value": "T1CF25BDC1EEA5CAA0DD614BF2DAAEB640077038664BF0DC1D0EB553CA19A3B4CDAC15D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536658, "uuid": "d2a1f381-3666-4687-8b87-109a85c43b77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536658, "uuid": "df0957c8-fec8-4b6f-bf64-ad3fdcdaeb10", "value": "12288:xchBGBYZ/pQeXYI5LtKMaW8eme9SUm/1uI6v2mSMXoxU3ZAC:ChM2Z/pdII5ht7mtUbJIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536658, "uuid": "35a7e0ed-c79d-4da7-a3b0-74ceb2d728db", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536658, "uuid": "e8831a36-ae15-4e22-91d5-099e50701c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536658, "uuid": "eeb232a0-b795-4844-bf37-1d2da1a90793", "value": "TEKL\u0130F TALEP Do\u011fan \u015eirketler Grubu Holding A.\u015e_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3014ff67-edc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683567098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567098, "uuid": "772d27e0-8ec8-4a29-9dca-579bffa28e8e", "comment": "Malware payload (Formbook)", "value": "fde5052283982b31e8affce41a047ef3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567098, "uuid": "9138fa51-4069-448e-bdda-ca0dd70ebc54", "comment": "Malware payload (Formbook)", "value": "b2c8cd267b139c47bf4f07eb05e61cb39ec80db15de627adcce7051189665820", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567098, "uuid": "e4384891-e4c3-4207-b502-fca6b2a9caaf", "comment": "Malware payload (Formbook)", "value": "424b4ec11c7ff99e4d8a6ba7b0ad94cca50be41c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567098, "uuid": "50ab9d1e-4029-4346-b21a-f43f61470955", "comment": "Malware payload (Formbook)", "value": "d2b7fcade2846a8644307e2e654d4737e73496a849adfecc4377ba0a07fd689c5a4e25735d098c99ec84a9c1c3f00919", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567098, "uuid": "8b66e6c7-5db9-41aa-ba8e-5e81e6298d41", "value": "T150B423C0CC8265D6DC55899A7E7D5ED30253670828CCA4DBDE04E1F2536B3B7BE4A81E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567098, "uuid": "571fe630-1f9b-4a2b-ad6a-0f3cfc13a870", "value": "12288:J4qGLaJJwRWqyuTjJHgOT/oWiL9iI63SinsvNPijhku4TgSQasVAJ:7JwWq3T1AweL9iz3Dni9ij6VTgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683567098, "uuid": "90a21b78-e325-48ef-89a0-759580f865c4", "value": 522246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683567098, "uuid": "cb0201e2-ae97-4faa-af07-110b2a2f6169", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567098, "uuid": "98910128-a5ff-4f61-b5ca-ea6710ec40f5", "value": "Payment Remittance Advice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b8575c-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683569089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683569089, "uuid": "a5dc70b3-24f9-4b80-95b7-c865cab05817", "comment": "Malware payload (Gafgyt)", "value": "01006198c6db49c22ed417b71251236d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683569089, "uuid": "7c8e7455-297f-4e6a-8d5a-a8a38651b802", "comment": "Malware payload (Gafgyt)", "value": "b4170e2de823b4e00db8ff66e14ccb05271d01634dc9b9773b39fa2a45cb8708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683569089, "uuid": "84b397ab-896e-45b4-8b8e-e65962d39f08", "comment": "Malware payload (Gafgyt)", "value": "87f68971b2f399dbbca305f092bcd97dda29b50c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683569089, "uuid": "c6ca1240-ac2b-43b3-9688-89f6ab3f06d8", "comment": "Malware payload (Gafgyt)", "value": "8083308f66abf888ecdd75b37dbcf82727bb2832381f2be88ccd573c2af9f983f235f1a5bad2ba7c67f69e161975ec79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683569089, "uuid": "a76d5e50-23a5-4370-bd1a-c5ba63e882f4", "value": "T1F8A32903DA60847EC48B93761BDFC6225223F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683569089, "uuid": "b70d6825-9672-4e98-bf78-9727bd54d169", "value": "1536:Q9fT9WiCOtxvWtfEo5vXJM9wypej++3hxEgL7nLGPTms5TDUMHYr/:Q9jCKwtsOnuejjhxEgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683569089, "uuid": "508cbe8a-65c8-4c0e-bddb-01b5be1b2a60", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683569089, "uuid": "5e27bb11-7919-4215-bb4d-8ff2120a18ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683569089, "uuid": "f108d6dc-12e2-4373-84c6-56ae034d7ba3", "value": "allahx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56296215-ed5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683522065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522065, "uuid": "aa61843d-3fe7-45eb-9c75-db7c6e0a764a", "comment": "Malware payload (Gafgyt)", "value": "a6a3f499d9dcbc39321353c2ea9109f8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522065, "uuid": "627bdee4-3231-4b87-8529-0eb82f04fce7", "comment": "Malware payload (Gafgyt)", "value": "b45e98ce0bfe48a2b2dd5f9a985a1449d8bf4099dd5b596cb1d053e32de8947f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522065, "uuid": "4ce1d203-fb24-485c-b7cc-e26c2ad82330", "comment": "Malware payload (Gafgyt)", "value": "226baa929f3ac53ade88395548ed29a5ad2885d2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522065, "uuid": "57791f76-4e07-48f6-a717-7c7d7d07d60e", "comment": "Malware payload (Gafgyt)", "value": "0848a413e65b375d0dde37a98a30e77094d845449568a266c10de6ab38c71abf0fd07caa1f50bd560f84334413327f26", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522065, "uuid": "4b4d8e06-4cc3-46fc-bd16-82c19b791a11", "value": "T17BB32956E7808B03C4D22B75BADF42423323DB5497EB63065928BFF43F867AA4E23515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522065, "uuid": "163151f6-8a99-46ff-a6e4-178aaa75c594", "value": "1536:2jynmAeaI7/Pct9WleHi7YWLjzHY7YSgM1nbm/ISG7FXczw/9d0fyZxTpL:6jaI7/PccYWLjzH7SgonyI4M/90y7VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683522065, "uuid": "9b9056fc-f68a-4c50-a851-803edc416745", "value": 113567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683522065, "uuid": "bb24b179-9dc7-44d2-ae75-dc7c54e82fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522065, "uuid": "22692ede-f768-4108-9b40-1152e25bdf57", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adb7542-ed78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcarusStealer)", "timestamp": 1683533588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533588, "uuid": "009aa763-b496-4964-bca0-330629d5e4d8", "comment": "Malware payload (IcarusStealer)", "value": "0301483cc8508f663c162b2bfe0e3bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533588, "uuid": "8195fe0c-6a4b-48fe-a3cf-c741dcb86918", "comment": "Malware payload (IcarusStealer)", "value": "b4e2bf50cf2984569728c14665f752183ae9e587c0851aad3f362be00cabe3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533588, "uuid": "cddc8aa5-cd91-4db9-86b3-baee893aff4b", "comment": "Malware payload (IcarusStealer)", "value": "9b8d6de28f47799e4af7501b3a87d723b04eaa94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533588, "uuid": "011db982-11e9-473e-99d9-80e356aaffc4", "comment": "Malware payload (IcarusStealer)", "value": "3213f4baae706841922ae688027275f29199af2df92e212d2127dc4f228d8e04698957a21dee1bd5637d9938b631d778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcarusStealer", "colour": "#E74B21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533588, "uuid": "2cdd0163-e67c-476e-8e12-e00e66676a86", "value": "T1DF8455212DEB10DDB3B3AFA15BC8B9FF89AAE573651E71F5304147464722980CC61B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533588, "uuid": "6295f34a-4033-4a7c-a211-ea5f49d1af07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533588, "uuid": "ab81efba-1b2b-435c-92f5-3dd98226db6a", "value": "6144:P7JJ2cBPQbp6ZHGBnqmTysu0oHIWUNoyy/1:XRBPJZHGBnqmTysu0oHIWUNoyy/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683533588, "uuid": "37105ef2-c357-4379-9793-66b733ba8b6e", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683533588, "uuid": "ad75d397-ec49-4988-ab83-991069c7cae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533588, "uuid": "33408055-9aef-41e4-9529-ba1337cfe389", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78aadd6-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683588800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588800, "uuid": "655d1ead-b24e-4d93-9e18-b023c81f38db", "comment": "Malware payload (Mirai)", "value": "3954bdcb5886b08d6f9cd6840b7d6ac5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588800, "uuid": "b2682398-cc6c-4c4a-b680-afbb4db83e76", "comment": "Malware payload (Mirai)", "value": "b5097af7468477ca809168044586defe209b4529636adcffc3b8bf223527cc83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588800, "uuid": "95158d1f-c6dd-4a17-b5f5-fc15e3000846", "comment": "Malware payload (Mirai)", "value": "52d2beb0cfd1e4521fc1b90f849caded2027b789", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588800, "uuid": "1cda4aa6-516a-4cd7-8d39-aa5a674006e7", "comment": "Malware payload (Mirai)", "value": "84331f7e8f82a74ef8b679234324590022545fb66058de103fe3db6cd93a71ce68bfc7768f5d1207ebe54e2244b044e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588800, "uuid": "ec5cafe8-07ad-43c8-949e-dc99e40e89ac", "value": "T119F38E35D01EE5D4C0220238E9E58C3A9F117048527B2DFA9FE78492149BDB8FB297E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588800, "uuid": "7fd8d9b1-499b-4619-8739-e0f80ff06562", "value": "3072:A1anqnNqSaIqTMwA6flyyP9tq5dqdCdq9uy8BKFGSuR7WDcvpDf+A2fA/7xRaJcL:A1aAraLMwA4P9tq5dqdCdq9L8BKASuwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588800, "uuid": "cee406cc-2459-49ec-9e96-766970eb11eb", "value": 171072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588800, "uuid": "6be8e88f-5583-4dc6-b0df-5f41fb965c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588800, "uuid": "ed6ea2b2-f721-4148-8be3-c014075d3dff", "value": "3954bdcb5886b08d6f9cd6840b7d6ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2006836d-eda1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683551180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551180, "uuid": "a574f2f7-fc29-4abd-b3ac-8457431a4116", "comment": "Malware payload (RedLineStealer)", "value": "1882c8118c53686696a27a5232ba8027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551180, "uuid": "2acd2362-59eb-47e3-b58d-5ada51bda106", "comment": "Malware payload (RedLineStealer)", "value": "b545eb55ad689d565abf98b9ce3aed93ae4325687c1257d7c53720a33550fa97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551180, "uuid": "e679b7da-547d-47bc-a8bd-9e6269dcff02", "comment": "Malware payload (RedLineStealer)", "value": "5246e72962e7a994a50b7007b13b104f60503ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551180, "uuid": "b1cb2ed4-2c68-47fe-8df4-a11103573f33", "comment": "Malware payload (RedLineStealer)", "value": "fea3f8fe47034afc383ac0542cca91222c798ed9b7289a998794abab1d59d2b98305d04c0379d2538d603d8407069929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551180, "uuid": "e247363c-8579-4245-8771-11ffe036d890", "value": "T141B40253E7D84173D9F26B74A8F603831B36BDA25D38435B3345A89A0CB2684B5353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551180, "uuid": "c29e5478-1baa-4733-80b0-0a6e5f12e484", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551180, "uuid": "8a760d6e-8c5a-48ee-8337-033c4dca76ef", "value": "12288:RMrMy90fEMHSJGGl5c1u319TR9gX/B6E8YN7TX09WVC:1yzMNqXXTrXYlXBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551180, "uuid": "f8a1c1aa-76f2-48e3-b87e-3c4f4e5cc27a", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551180, "uuid": "41a18277-876b-4d7d-a389-2737fcedb25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551180, "uuid": "b857ddc4-193f-4639-8cc2-1da658292291", "value": "1882c8118c53686696a27a5232ba8027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9718d1bb-edc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683565123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565123, "uuid": "47e01a85-1e49-472e-9166-02a45b5dfc89", "comment": "Malware payload (AgentTesla)", "value": "9d4a847da84d7a125df489f91ae63bbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565123, "uuid": "55f7b4ab-d8d3-4139-9e3e-bceb1b56d422", "comment": "Malware payload (AgentTesla)", "value": "b5d3c7a0a47dcfc26d108e8ab87d79a33955bf53c66ceff7f60f309df2ce3353", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565123, "uuid": "cbe96375-a65b-42cd-9786-17892e7b6714", "comment": "Malware payload (AgentTesla)", "value": "3f6ea0ca91ab678a4ca4340eeb640cbfbaf1ec28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565123, "uuid": "c26c630b-84f3-425a-ae25-40ec9c50fe2f", "comment": "Malware payload (AgentTesla)", "value": "8a3b1870474cde3cb6ae06216156428b66a46ca8fe4d87a1e631d70bdb238cf195d467e100f7d06f917cf77a24201dbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565123, "uuid": "a5c0d2e8-2ad3-4eeb-8789-c830908f02d2", "value": "T16835E63814FC3622C2B5EAF2DB94E561FBC0859276358DDF1AD6848616EF90236CBC1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565123, "uuid": "0a15df1c-9671-4b46-b5a5-779be2c889a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565123, "uuid": "33a22afe-e9db-48cb-8f04-34be1bd673f2", "value": "24576:nPf9FX520yP7RgILOuioPZ3etnuo1cyamxI:zYBVgMbZqut3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565123, "uuid": "0db46c8f-1b42-438a-af36-15da6604f83f", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565123, "uuid": "5c026a17-3c99-4288-ad74-4685a62e8b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565123, "uuid": "016441f1-8cc6-4150-961a-c7ade37b9c0d", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce3f66-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683570315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570315, "uuid": "56d9149d-3ad7-495d-9c78-4ae42404c60e", "comment": "Malware payload", "value": "662b2569b8195adc15076bbbf9d97556", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570315, "uuid": "683ba6eb-54e5-45d2-98b2-2faaae6bcd53", "comment": "Malware payload", "value": "b5f0c66caedcadd343ae5a3f65f988860a253fa6f1f1c25493ebf928956468d8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570315, "uuid": "09fbe42c-a0bc-447a-a350-d6e1df79a2e9", "comment": "Malware payload", "value": "af241b1fa49636484c1110dee766cdaa89603247", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570315, "uuid": "84d5e673-d5ca-4b33-850f-a56a36aecda2", "comment": "Malware payload", "value": "0abda0b54a3901a3248eada178fc88b34b7459be4530416ada9ebcf4fca96bd6f7f3dc5bfbf42d3b792aad366a45102d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570315, "uuid": "dd50cd4c-a9ac-47e8-9e41-7dc0cccce64b", "value": "T1BC45E01AF588CF4DE181CBB56A63B488421CBD2777DD24821284730EADF39E5A6D3DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570315, "uuid": "b98e1d89-b024-4b45-97cb-40ed1cb03907", "value": "24576:pLKZWQmmav30xhPWQmmav30xLG+MXUv+MXUBaausyz6CyX/sr:pLKoQmmQ30OQmmQ300+MX8+MXRsM6CyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570315, "uuid": "0445d63f-9aaa-43ba-9060-3ac348629828", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570315, "uuid": "3d6e2c47-a9fa-48cf-b347-7a0937595ff5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570315, "uuid": "4ab584f4-06b1-4c19-be4f-7a37eceeea60", "value": "Order_list.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8cab1f-ed78-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683533695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533695, "uuid": "b6ec4860-6b83-4f95-82cb-4c3bbf5d189d", "comment": "Malware payload", "value": "26235fadd208c44f23c046d515ea295d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533695, "uuid": "00daa566-bf55-47bc-baa7-3bcbb8c43ce5", "comment": "Malware payload", "value": "b63fedc06d9e500f1a8e0da5abb8a9e191ae67a6018698bfcf453b96f519aad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533695, "uuid": "537b9ad6-c686-453d-a5b8-396c93bc8603", "comment": "Malware payload", "value": "3e22368629014f572e61a30849b12dbf972a1b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533695, "uuid": "593bcfc5-52fd-42f8-9118-dccffebe6745", "comment": "Malware payload", "value": "46b0610bf162fca40f5d6b401d37a5b23b204bfabb018628aa707aa6feb554368d017b556f611b1fc3e57ac88a7ecb8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533695, "uuid": "ab50ecd1-ce33-4be0-8d1b-f622d5d5b278", "value": "T15EE3BF26F79CD2B2F519A63864A2F86B1DFE743906AF015BB344035E3965BF026B0353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533695, "uuid": "5d918417-4c4d-4097-b90a-e13f92812752", "value": "46582683e79e897ced5eb8a1828704b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533695, "uuid": "a1d7b7b7-a6c7-4773-aa0a-1086d3539ba4", "value": "3072:3Tj8lJVPR6yB4jPZXdHtpyBI8Qx5V1RVl79ufxY:33yrGpd758O55Vl7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683533695, "uuid": "80be1a42-d7d5-4d7f-8887-90c135013250", "value": 151136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683533695, "uuid": "dd1aa4d5-7c02-425a-917c-84be4601891c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533695, "uuid": "06cb4758-9d92-4525-9e74-7e1e2b21ed2c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2610b36-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571585, "uuid": "871f53a2-ad3a-4dea-afa9-723451ee8a4b", "comment": "Malware payload (Gafgyt)", "value": "d705edfc0b4500412391164470b68934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571585, "uuid": "aab2055a-f473-4558-9317-17dfc234dc56", "comment": "Malware payload (Gafgyt)", "value": "b6749c6357b1b627df2f096461a0e68abe00ffed6e8c133b828549bedf5cc4d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571585, "uuid": "64e26b36-408f-4940-b0a3-df58f78c81f8", "comment": "Malware payload (Gafgyt)", "value": "35a83327e842868166d9b5a7f2c3dbfb8a792b5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571585, "uuid": "92db9077-ec32-44ef-ba6e-ddf47873a746", "comment": "Malware payload (Gafgyt)", "value": "386b798dd5812a78882bd8d6900e0801a5187f1b2bda018ce207a0987dfbd12058a35382c91c50a76fb59a3ba7011661", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571585, "uuid": "102b7013-e875-4853-b355-491859391f3c", "value": "T140A35B53532D0A87C98B9AF02DFB27F187AAECA012B25644950EBFC41773BB41056F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571585, "uuid": "bf35ce05-84fd-4a65-bc17-c5a11747f40c", "value": "1536:DEg/+165BDtjS5Xap3SQuqomJd28C40W2tvnAJfmsCskFw3DW:DXa657SA6q7Jd8omDski3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571585, "uuid": "d3d7c1b9-d056-4d8e-824d-9e3ba4d5c705", "value": 103588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571585, "uuid": "e2192926-40a0-4ad0-8655-74a063b2d28f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571585, "uuid": "af7b7e89-c1e0-4e1e-a811-55a0a867d3cf", "value": "d705edfc0b4500412391164470b68934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4b8ae8-ed74-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1683532220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683532220, "uuid": "bd2a1984-26d8-421c-9557-2831e8fff83f", "comment": "Malware payload (Guildma)", "value": "45210c24c0dfb29b175dd32b6fb2eec4", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683532220, "uuid": "79b07cd7-d8ef-4057-b9f2-c96f8a7a6d2f", "comment": "Malware payload (Guildma)", "value": "b70603ee3cb4595a977f9a0bf95eaaabe804ebe35ccb5eeebd0315989c71abb0", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683532220, "uuid": "ee6109b8-15f5-4264-b402-f840df6523a3", "comment": "Malware payload (Guildma)", "value": "cd58d80483a1fd5e2605aca5ae4670aa9c459312", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683532220, "uuid": "42a4dab2-121c-40c4-aa56-7455235a9673", "comment": "Malware payload (Guildma)", "value": "333d9a498b4f444a18fc6cfbd1f61c35eb5893e7fccf56c3888fa1caba5bb5743a12925efc9b36b64fbf6ff3d55ebc2e", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683532220, "uuid": "a7d229c0-59a8-49a5-b588-5b27bfa6cb94", "value": "T17E012337C03208C5DC5D963744FD3BE6A057826E43E75687046557131F4649E6AF6703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683532220, "uuid": "95bd2955-20b9-40c7-bcd0-f5b5c81c5444", "value": "12:5jP5RdHpHEludj/9WdveEvtaHprUv26Sl2VVORdHpTKtaAX:9PDrklSj/9WdveEVYrc+2zmrT2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683532220, "uuid": "4d61d668-5679-401c-b5dc-f25df82ce208", "value": 668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683532220, "uuid": "0bfd5c8c-97b6-4602-a97b-b4ac284ff69f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683532220, "uuid": "5ae62208-00da-4a5e-8679-5b6b2bcbda54", "value": "NFeXMLON9DR52O9FKTWO7FQUEO37J4S5B9DE324265780.543546.09296..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84c2fb4-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683551113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551113, "uuid": "8a3d5f3c-e900-4535-8ed5-9ef97c585a53", "comment": "Malware payload", "value": "9dcbc97dcf641353f675a408a39ff4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551113, "uuid": "e5e0ce25-2a08-4f06-9501-a99c630cc97c", "comment": "Malware payload", "value": "b7ce8b92e0d41329e98be9b84f42e6a716f263cd24e302e2d795f7c0cb5cecd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551113, "uuid": "325c11f6-b278-43b2-9c38-4348580e0f85", "comment": "Malware payload", "value": "4fde6b60fd56afc043a6a62db443dcdfadefc8a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551113, "uuid": "84a27c74-b314-4d6b-979b-0c1d323e2d1b", "comment": "Malware payload", "value": "6b7cd8df3c942c69165a8b55b1efa992331f206533156ba0468fa71c077d741a6abb18c6234187debad86c6ab897bae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551113, "uuid": "cbbad015-5c50-4bf5-a891-9f3c5f3222a3", "value": "T162451252B9C084B2C4B21D7465E59B742A3CBD211F388FDB93A87D2D5E301C2A93AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551113, "uuid": "2df2203d-09a5-4091-b96f-e3abcaf53bb9", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551113, "uuid": "74f4e323-3e5c-4be8-8f09-22948603e1ed", "value": "24576:08qXhDyUY86L1DARV/QnojOMQAKSBcf9Xb7mja3JyqS4bn08WriQXM6p+uxyE:084cMQyRcf9HmjMbS4b08WrjXM6p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551113, "uuid": "35454731-6249-424b-a563-03d565721170", "value": 1235016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551113, "uuid": "b1734ce6-4e14-413e-8490-1dc763d310d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551113, "uuid": "9c734845-95fa-44b3-bbd0-29bad7238899", "value": "9dcbc97dcf641353f675a408a39ff4cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c2c0b7-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683534404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534404, "uuid": "a4888968-8374-44ce-8275-26659eb2ec85", "comment": "Malware payload (Loki)", "value": "12f9cf423cfc7d9bd8dac5bc0ca73c82", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534404, "uuid": "1d5493ac-0915-4997-961a-b35a376dc7bf", "comment": "Malware payload (Loki)", "value": "b87c24674d29fa3a5b0dd7b2c4f2e5b4bb9441387735d8ec86b37425a98b1d7a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534404, "uuid": "a31a66ae-d98f-4d37-9fdd-0a27cfe20728", "comment": "Malware payload (Loki)", "value": "82cf57b2f7062a07c97f72c9aad03f4244ac1d43", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534404, "uuid": "eed8695e-56e7-4b68-a88a-1b68d9eb145c", "comment": "Malware payload (Loki)", "value": "c4ef2037117ea7e44ece168138d6b6a53cd4f87b4fd14197b3453d66be639ceff323df61bea729b2a8305f4fc80b7a31", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534404, "uuid": "4e449cc5-43eb-48e8-8997-b1f64e6f971e", "value": "T1BC45D01AF588CE4DE581CBB56A63B488421CBD6377CD24821284730E6EF7DE5A6C3DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534404, "uuid": "0ebbb9fe-2246-46c3-8841-ad4eda56d28e", "value": "24576:LLK7hWQmmav30xDPWQmmav30xqE+MXUv+MXUhWW+aGsWnyX0k:LLK7wQmmQ300QmmQ30z+MX8+MXSWjswI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534404, "uuid": "1f9f80a6-b7a5-4715-afcf-662bb75c4780", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534404, "uuid": "62b3612f-ba1d-448a-8fa6-5b2aae7d212d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534404, "uuid": "3f684f4d-8b1a-4658-b9cc-dcb7f96f9f2f", "value": "paymentslip23455.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0a2ba8-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683534555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534555, "uuid": "c9c29869-e239-430d-a77a-00eeb3b0ede0", "comment": "Malware payload (AgentTesla)", "value": "840948be86fa6d956e279215d50a6c57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534555, "uuid": "808734d3-a4e8-40eb-bb54-b83775736dfb", "comment": "Malware payload (AgentTesla)", "value": "ba3eb4a8f3d82525829a03faafc5324d90b4274ce40df20dca51d3715f8de848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534555, "uuid": "f15fc323-b6e3-4616-b888-b444729d05c4", "comment": "Malware payload (AgentTesla)", "value": "c6d5a6978e5cebf7166f799838f554a89debf88f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534555, "uuid": "20911c8f-4384-4898-9751-a41bdf9f4bc1", "comment": "Malware payload (AgentTesla)", "value": "7b3e6d18d2173cbc8a483352212de601db8a1880714fe18e658b38db836a89a034c53e49959630381212403a20c6f661", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534555, "uuid": "3f5ce777-3adc-4e80-a0be-32efb847b10e", "value": "T11534D05277D342A1C9496B3182D7103417B2F3877AB3DB4A398942951F433EA6F9BB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534555, "uuid": "63e61906-4f87-499a-adf2-c639f0359083", "value": "6144:GhjxstGdqyshZA51BAapqEBuA+vSjeuKqXb4mW99/n4:cNstGsysTU1CapqEBzO2dby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534555, "uuid": "78c29ad9-d407-4e2c-b095-c9fa7ed89a6b", "value": 248392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534555, "uuid": "39708da9-d393-4293-9be5-48f04a4075ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534555, "uuid": "676c38c5-f2e1-4806-9da4-9995eefc2ce1", "value": "Ziraat Bankas? Swift Mesaj?08052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ddf246-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683529045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529045, "uuid": "d1901a19-a2c1-44e3-8136-53ce5f0cead9", "comment": "Malware payload (Formbook)", "value": "b77095273c3615edd71fdc14a5b6872a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529045, "uuid": "14f09a7e-ce74-4439-8a64-6932fd0b1a39", "comment": "Malware payload (Formbook)", "value": "ba666b362fbf39a28389eacd17bbe764cf1ea11428f381bb2c874e2dbbe5586d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529045, "uuid": "d7d9541c-5338-409a-8547-0e9dbfdfa5ee", "comment": "Malware payload (Formbook)", "value": "e3bfdc81446434eb55625ae2bbc7be91c6868399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529045, "uuid": "e39ab40b-4fc7-47b4-b836-c599186c98d2", "comment": "Malware payload (Formbook)", "value": "6fba4a383be1240e1bfe17f79e56377a727a02841b5fc8132d491a15df77e5aca2e7c8172711ab62982f7bc6421a05d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529045, "uuid": "2f99622e-3eaa-45e7-9102-9e9798253600", "value": "T1D2A52421AAF51D0BF032AB3ED8E377556A6DFEE10727D66A1540B34A5D27AC0CDC0623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529045, "uuid": "e1b15a61-709d-4dee-9116-e3d0685124c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529045, "uuid": "fbcf5913-35ec-4bf2-b710-dbd374d25dad", "value": "12288:87uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyNxc68NMXzp9VWWdTwWDOdKu68:oMXzXcWDOdY0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529045, "uuid": "10e44615-aca9-4218-9d08-a5d097b86273", "value": 2148864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529045, "uuid": "055d1869-f35c-45c9-b4cc-a6dee31efc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529045, "uuid": "01c51a71-569d-44a5-8ca5-cd624ef1a2e8", "value": "PO20583167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc52512-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683534321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534321, "uuid": "90b440a9-34a8-42a1-a08d-ee9c58f3d211", "comment": "Malware payload", "value": "3c4b2505f26d6c2e4dc9aaa6369433dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534321, "uuid": "f3914665-9af2-4c22-bd8c-62d7dd075a5a", "comment": "Malware payload", "value": "baee13a0f456700073ae6aff109a6eb736237a1257acd7a706c3ab58fca22db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534321, "uuid": "a525ffd1-8c1b-4904-97b8-65443421c15f", "comment": "Malware payload", "value": "a05a5fd0ff7e7c87c45cca73a648e4adb35ddf5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534321, "uuid": "06b5fc64-bdf7-4503-89bd-e53dcb83cd5f", "comment": "Malware payload", "value": "66d9fe3ee17bf151058ac428895352db9619c21098b5427271e0c8145c069116afe6f40ced35a262b4041e626993f1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534321, "uuid": "eb2e6bac-3e53-47bb-9813-1b605f4734fe", "value": "T1FC0474587BE800A2DA6941B5B4F55C938231BDE65443DE5C2C863FDB7A31B168A80F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534321, "uuid": "3a0e4d0e-065c-4d9a-af91-a486fa561d77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534321, "uuid": "8cb788d2-7bd4-4987-b953-163117afa69c", "value": "1536:0F1xSrYvn6+b6saj98x6OgWNUrvUrZUryktVcl:9qpaW0rsr6ryk/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534321, "uuid": "fc7654af-36b1-485b-92a4-c12093f3cea6", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534321, "uuid": "79f20327-effc-483a-a98c-e104947a6a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534321, "uuid": "504d937d-909e-43cf-af0d-a6c5c9178975", "value": "3c4b2505f26d6c2e4dc9aaa6369433dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a38b4c3-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550284, "uuid": "c0edc98f-4f64-4c8e-b4f1-624ffb370a5b", "comment": "Malware payload (SnakeKeylogger)", "value": "cd2fe8087ba823ff3f03248e91304abc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550284, "uuid": "99f1439c-1295-46ca-be3b-353ba1497150", "comment": "Malware payload (SnakeKeylogger)", "value": "bb29bd98dc2e9ea502e1e473b659e56940e604cd87058071b08a95dc7eddf7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550284, "uuid": "e4c327a6-fed7-4b2d-ba9e-93e896937dcd", "comment": "Malware payload (SnakeKeylogger)", "value": "0d35f13e05751f72375f371ec715016a41270fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550284, "uuid": "7ea3bc9e-38be-4508-b73f-f31dc28f7bd5", "comment": "Malware payload (SnakeKeylogger)", "value": "d119d26aa644c2a2c25cd5a319d0e1993bf4dc520fe6e1ecd63e34ebecb3722000e473a8e7ec0681576ca00fc70fbe61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550284, "uuid": "2deeda5e-2d48-4574-bea0-069a2970519e", "value": "T181B4F15532B68F61F9758BF01938B98403F230A798F5E9580EF561CD9AE3F102B90B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550284, "uuid": "750366de-ce15-48a8-a9b7-88b2877ec70c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550284, "uuid": "0d5dbf97-53c9-4e68-95e0-fb5254024a37", "value": "12288:gLfJYkvnuruXZT/KO8XgrJ8SQjK7tCsdM0aZuUYkI5Kq:gLfikvu6n8uHtnrUhI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550284, "uuid": "e71b368d-43ed-43c5-89a0-87b5c6b8b78d", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550284, "uuid": "3fd6f756-acf7-485a-9201-449fdd75044a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550284, "uuid": "4e5d5442-0788-42ba-a989-f350fafd8a5e", "value": "cd2fe8087ba823ff3f03248e91304abc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612e42fa-ed7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683535398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535398, "uuid": "4aa9fc1b-5ee1-46ce-afc4-49c2e8ee4854", "comment": "Malware payload (AgentTesla)", "value": "ccd1f2f9cf4d5a726588f05ad8f973bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535398, "uuid": "3bb9860d-b039-4b8b-b40a-5aa62c9297c6", "comment": "Malware payload (AgentTesla)", "value": "bb3167924a5576e7b920d9f7976452b90c6c2674f08e63b0ba658d49eaec20ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535398, "uuid": "a119d02d-bb36-4f60-a82c-0b09c08f1263", "comment": "Malware payload (AgentTesla)", "value": "c41623c6f4d5c3eb5cbcf4a269f3fc06f5383c28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535398, "uuid": "cebf4772-7396-45ba-9ef8-99376c6c88be", "comment": "Malware payload (AgentTesla)", "value": "e2bf6269603ae26d6a13db2420d46f8bdc238881aa389fad9e0540b388affeb8ff6b3fd951130cf79a1304b12bdcde2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535398, "uuid": "e4fb590a-cd95-43a2-b947-b46a244b2d4d", "value": "T115F339E992CEDA51D71D81B8C5A4111807B2A17B8F17E75D0FA0AEF93E463C3362B871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535398, "uuid": "989c6fab-4a10-4d87-a952-5277160de252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535398, "uuid": "2b013bab-50a8-4cd9-ba82-507a71630888", "value": "3072:ss46cMsE+JDdjIREZeGGNTW9HGM8AWuXYaTycY8bZwdSRl35o:sB6cM4pmKv18RYyuw0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535398, "uuid": "57b5b2e8-2781-47dd-8215-ef35d144f4cc", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535398, "uuid": "4919313a-b4e6-4357-a564-64be5053ea01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535398, "uuid": "4c81ed62-93cc-407b-a0a0-9d80fb7e8b58", "value": "ccd1f2f9cf4d5a726588f05ad8f973bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599782d5-ed5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683522070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522070, "uuid": "b88f92a5-6b37-4f80-9559-69ae6bce16e5", "comment": "Malware payload (Mirai)", "value": "b5b2a304e21eff78c1c2010ba4277310", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522070, "uuid": "e93405bd-6298-4765-84f5-4c59a4861ed0", "comment": "Malware payload (Mirai)", "value": "bb360de929ca6604c02340fe3abe23bbfb3c2efbe99fc3b710dc05742d00ba18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522070, "uuid": "5b00a7c7-df94-4719-bc75-7f6858f46f22", "comment": "Malware payload (Mirai)", "value": "d7fb4afa9261e90f810b7942a3f2d5c82cc069d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522070, "uuid": "45f72803-366d-46a0-95ee-fd7002b51ff6", "comment": "Malware payload (Mirai)", "value": "28fb3191f6dd974d7e38b66c4fcb2e4f0f12d2af94cffb04daacb88e264e6cb0b12bb9afb433bbd8fe2977a266f29e92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522070, "uuid": "66fabbe1-e69f-4d65-8c98-c27126a24766", "value": "T1E8632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522070, "uuid": "25ea75b5-c1b3-4f89-a671-96b76a0cdcb5", "value": "1536:ONKlxkmiig51kRmO//kWUzrziAsDwY8rNRuVAvvWr:ONDWzk13ziAsDHaJvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683522070, "uuid": "9b893807-2cf2-44ca-9b61-e774daa1e7dc", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683522070, "uuid": "69fe8384-ad43-40ae-9685-e2868d436852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522070, "uuid": "0ceac893-8c1b-4c77-a7a9-f9bd642cd6a3", "value": "arm-20230508-0501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d31742-eda1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683551329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551329, "uuid": "71e4dc20-fa61-420f-9ebd-068f9b9f1ca3", "comment": "Malware payload (RedLineStealer)", "value": "a1338ed18a102c8ee2b6ad76cd3fe5fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551329, "uuid": "011a2d1c-dc1b-4bde-b591-e670eb19f99b", "comment": "Malware payload (RedLineStealer)", "value": "bb7479d1e0689a68a0e9cb3341d22e625dfba03a436a9306a6e4bfe47eca0638", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551329, "uuid": "ac7a9be7-47db-4cee-bbd2-a41fd8d8e146", "comment": "Malware payload (RedLineStealer)", "value": "2b4ad26e75c9adb9dad3366f1a1bf7976eaebb16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551329, "uuid": "7908ca79-7d7b-4a9d-a9b2-1093b21c0e67", "comment": "Malware payload (RedLineStealer)", "value": "941fc2bd64edf9a7669616d0e6e6692694f0c963c697747ec65f6aca25fc21b0d27351fc5cd359136cf0e6e5812a67d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551329, "uuid": "09e8174d-29f3-4f91-86e1-484a769e3871", "value": "T101A40212B6E84471EDF617B04CF746931F36BCB14D78939B2B466A1A0D33A80B93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551329, "uuid": "b33552a2-0e3e-43ee-b28c-d9a6f4979e56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551329, "uuid": "beb1f4a3-a6e2-4cf8-929f-9e1c4a5a5ccc", "value": "12288:8MrQy9087XLPE5TOBtI5KnQiyCrKr3n7M2hs0zg:cyFsTGNQiyCrKr3o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551329, "uuid": "436c576d-5568-4910-98e6-f1197bebae9d", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551329, "uuid": "40f304c6-7386-4ee0-9fdf-27f4c7debd14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551329, "uuid": "43f57730-dcfc-49c9-a66b-aae1fdec1989", "value": "a1338ed18a102c8ee2b6ad76cd3fe5fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832b94d7-edc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565519, "uuid": "f747be26-b265-495d-9109-bf0e178acea6", "comment": "Malware payload (Gafgyt)", "value": "391be0237e68cfb38e1b9af34641e6b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565519, "uuid": "8c72445e-4543-47ae-b60a-577519889f65", "comment": "Malware payload (Gafgyt)", "value": "bb78e6c828d241b87c2f45151ec64f21075fa2c7655646a1397d40a376dcd0fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565519, "uuid": "ecbad3bf-4af3-4826-873e-9fe606f3c42a", "comment": "Malware payload (Gafgyt)", "value": "4ffecc75b608f6cc771c11759ba726ff659ee793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565519, "uuid": "70456fb7-59cd-409c-9944-c0cd28a1b7ef", "comment": "Malware payload (Gafgyt)", "value": "60cb7181fe2a09cc4ca92ff52151390cf0aa80f0b9ff96785701112130886aaa6c64d51ef42d3ccac0ef06edde9e64ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565519, "uuid": "8a24827e-d788-4722-a332-112b9f75639c", "value": "T127B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565519, "uuid": "fb2646a2-6cac-4112-bc0c-273536464244", "value": "3072:2d0wKSAewzi+Xn+8Uhw6W+aPKJmDk1c8xF6KjW:bfO8IBvJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565519, "uuid": "5e0d2f84-b016-476f-bb3f-81a4b70945c6", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565519, "uuid": "22ecb368-8384-48c6-a4b2-0a50afcbc751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565519, "uuid": "1ceb27aa-73e7-4f6a-80d6-555a4d9bd558", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdc13c2-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571580, "uuid": "6915c809-77a0-4ca4-b109-edbb4c20ad60", "comment": "Malware payload (Gafgyt)", "value": "e49fce7d1274484db2bae3ab1caac366", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571580, "uuid": "abfcc935-877c-423b-a820-69b9e9ccf58b", "comment": "Malware payload (Gafgyt)", "value": "bcf6454ddb0c495f8dd6956ba6888c2769c5d21ade63d653ce32ca3261bfadeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571580, "uuid": "f0220731-9345-49be-a1be-e9b319b9ba63", "comment": "Malware payload (Gafgyt)", "value": "d6238456b1c1c756e7bb8e3a9d4d4ab798f78b9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571580, "uuid": "2c10193b-a7d7-4ce8-98b6-c8524ee1d8fd", "comment": "Malware payload (Gafgyt)", "value": "a67de5828a9aadc415534db10f7e2a9418298f2294891e5859da11563be44e5b7aeb56f06c2f9b9188389d737581d186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571580, "uuid": "e13ba726-074a-4738-b309-15cce7e0f09c", "value": "T1A7E34905DB408B17C1E2277AEBDB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571580, "uuid": "1b36e1d4-6590-4d2d-a6a5-569ebde33fc0", "value": "3072:Bt8iFDKEfFN+Fa+1sW3h7nI8txVpUMbmQwfCMQiGW:z8iFDLf/+FaNSh7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571580, "uuid": "d158794b-d199-42f6-be1b-22b29ca2d848", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571580, "uuid": "31761719-f44d-444d-b13f-50ac22233fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571580, "uuid": "a1fd81db-b267-4306-9fc5-b7e3039dd783", "value": "e49fce7d1274484db2bae3ab1caac366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d913a8-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683565900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565900, "uuid": "1f8a7af7-d985-47de-8024-d5a19d24ad12", "comment": "Malware payload (Mirai)", "value": "80d6c1a70c0fa885c4bc5380fb96a085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565900, "uuid": "d5cb516b-654f-4f08-a133-ca67b711adf6", "comment": "Malware payload (Mirai)", "value": "be5f194a7675c68633938b4d4a52542c665c3d600312825eadc387cf4cdd773a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565900, "uuid": "8e97d140-d492-4c61-ba45-cfb61caf91bb", "comment": "Malware payload (Mirai)", "value": "b7ec976946a1565020c05def44814b01849e80e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565900, "uuid": "caa83733-c8d4-48a6-a7af-ee81197c5273", "comment": "Malware payload (Mirai)", "value": "8f632653bcbfb340b7e65adc30ca3d796c2273d4e4d307398412653558b253e5ac9a2aab8e3b804ba0e71db4bbb6189b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565900, "uuid": "c371fb2d-84bb-47c9-a2f7-332661e80999", "value": "T1D0340F5AB7619DBBD81E9E3B02DA5442009D954A07DF5F2F77B0C628E38A50F71E3C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565900, "uuid": "49f74963-2bcd-42a4-b3a4-bc56687b809c", "value": "3072:qdnr7rxM3hViyTVRFrR1281N7R/WUqHEiTeG0:qdn7W3ziyTLZ281N7R/WUqHEiTeG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565900, "uuid": "63df9584-105f-4103-816e-ed35166b348f", "value": 243670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565900, "uuid": "05164f0b-ff7d-4d4c-b03b-02b91ba11b8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565900, "uuid": "1a386639-f697-4f21-ba01-7541928c6e74", "value": "80d6c1a70c0fa885c4bc5380fb96a085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7842ad20-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528564, "uuid": "a36b051c-b51d-439e-b25d-13e931c10280", "comment": "Malware payload (Mirai)", "value": "5b9a70c066390d751398ef65f4f9c60a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528564, "uuid": "a4719806-fee3-4a48-8673-9bc4b3f2330d", "comment": "Malware payload (Mirai)", "value": "be699f87a6970f06efe2e51d278b0ffac8f20debe4b9dba34b5c6add515d41fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528564, "uuid": "ebbfbf23-1455-45b5-97b8-ccea0d7bf1cb", "comment": "Malware payload (Mirai)", "value": "4b160976720c9a51a96655956bf8b31dacc2d771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528564, "uuid": "6693cd40-a8f4-4d4e-abcd-6f3795a23399", "comment": "Malware payload (Mirai)", "value": "fdce3f67a34d61ce65e7f9d866a6d9314454533a9f9ba9aec1409bf3a48525b7c51705403bb3646c28907980f9309f48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528564, "uuid": "5fdd89d7-bafe-48ea-afd1-620e91bd98b6", "value": "T183E33B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528564, "uuid": "197db4bc-db1b-4ed7-bdc9-296a7e1535b5", "value": "3072:CJLce3pC5mS7/abHbz4NpaIJ8VIJ1FvUXkkTM/9cHMY:CJLce+/abHbz4NUIJxHvUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528564, "uuid": "ee037ccd-fce8-4642-a161-dd9ed33f3cec", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528564, "uuid": "112ac528-3788-4dd4-8a3e-eeea6ffef408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528564, "uuid": "8b97f98f-f501-40ba-8f7d-dadbdb46a5a8", "value": "5b9a70c066390d751398ef65f4f9c60a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd71ba2f-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683570342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570342, "uuid": "b8a0230a-84ca-4d2b-a482-10ac2612f10e", "comment": "Malware payload (GuLoader)", "value": "21a4e31b7ca2e4608bf43d2ad901edc3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570342, "uuid": "ba562e5d-5cd6-4ad5-afc0-116b8a53fb9a", "comment": "Malware payload (GuLoader)", "value": "beda408709feea7d2023f328e9c97bf4d090bcfb3948fc4e4d9c5c580d8f5858", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570342, "uuid": "029c2f9b-aa49-4cf3-a01f-52b69913bb93", "comment": "Malware payload (GuLoader)", "value": "b0e3f0ec85b343fb75bb00fe4fdb3945714d52d2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570342, "uuid": "d77c7935-9bc3-4c68-87da-040d7a1bd04f", "comment": "Malware payload (GuLoader)", "value": "c998849fd71974f8856f72cb59fe85873374fcf52a2ba1a66dbda700b8283c3d836216f653aed288ab7f17cfba8b1686", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570342, "uuid": "5730f94a-f399-4985-a82a-4fdc24004851", "value": "T1B0F2C261ADCA55342E27C6F7AA0D04B4C4B041B7252400BCAE5FB63948ADB18FE3F57A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570342, "uuid": "e554e221-32a8-4254-9dfa-ed2de2e9ef85", "value": "768:7XDUAi25dFuE6dFxAi6EvM6bjUDSXjuISLDIca:7XQV0e76EqOMfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570342, "uuid": "692e9cfd-6e0f-4c56-9a0a-0ffee7fe4053", "value": 34970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570342, "uuid": "14610217-9f28-466b-859e-f9ea22880a95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570342, "uuid": "d62e8e17-4b76-4939-9fe5-1b0a715ff230", "value": "TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05139c12-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683534814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534814, "uuid": "571edcdc-16a9-4430-8b9e-fec7b9259014", "comment": "Malware payload (Rhadamanthys)", "value": "9ca1a99ed17fda0d98ca95448a8baf7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534814, "uuid": "0b4c0267-27ed-434d-9947-3c80b5996c35", "comment": "Malware payload (Rhadamanthys)", "value": "bf2cd59f7af11716d59b147af959c306ff601f229f8ae8dfe016ae064a55cd8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534814, "uuid": "698fcbe2-cf52-4bd6-8381-1ce565ae99b5", "comment": "Malware payload (Rhadamanthys)", "value": "752da245f296a669e1002bc275685b006cea7913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534814, "uuid": "b8c2c4f6-67b9-4dcc-9c31-2d7caae5bd54", "comment": "Malware payload (Rhadamanthys)", "value": "885078356da1b5d6a0198d88b15bd592f536d0a69a338e6a66c3cc79c5b381af6b979624c893118dbbd7df635fd8d452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534814, "uuid": "476104de-4696-4363-85c7-d530de2ea747", "value": "T1B5843B0382E1FCC5EA268B728E1FC6EC765EF2508F59776A12189E5F84B11B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534814, "uuid": "152af6e5-f944-497b-b569-58479755bdbb", "value": "513663070e5d163878e1cb9d4a5e6408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534814, "uuid": "1d174751-61d9-4ae3-82b3-61298fae60d7", "value": "6144:K0dJ/0LKrBk1fsQcOauZgezo+qn/WubCQRMNg4SBLXC:K0daEBNOOkQ+4CQRcfE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534814, "uuid": "13c77d84-dc26-4109-a084-38ce7bd00782", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534814, "uuid": "d160af95-3aa0-4871-b158-e316fe0b955c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534814, "uuid": "8abd29f9-48a4-4b90-a363-fe1a470d15c4", "value": "9ca1a99ed17fda0d98ca95448a8baf7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d3b09b-ed7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683536687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536687, "uuid": "e617ec0d-3b00-4530-9038-753cd9b16c07", "comment": "Malware payload (SnakeKeylogger)", "value": "36a375f4c26a2b7088f0a70395037d59", "object_relation": "md5", "Tag": [ { "name": "comprovativo", "colour": "#EE1A65", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536687, "uuid": "8738c9e9-a3de-429e-9565-e39c60b9b979", "comment": "Malware payload (SnakeKeylogger)", "value": "c08cef5567d31e827239394793a52e9008ad372079228384f300cffe16f61b7e", "object_relation": "sha256", "Tag": [ { "name": "comprovativo", "colour": "#EE1A65", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536687, "uuid": "0dae1488-890d-4647-afc7-9de95b8c0cf0", "comment": "Malware payload (SnakeKeylogger)", "value": "801aac7b9398cff98439ce2742c2a3d094df3dda", "object_relation": "sha1", "Tag": [ { "name": "comprovativo", "colour": "#EE1A65", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536687, "uuid": "a8ffaf3c-7326-434e-97d1-0e2ba88101ee", "comment": "Malware payload (SnakeKeylogger)", "value": "dac9e3d2656894f71499e8d31ce34be52873b7089c6183a61b3d3775afcaef29aa87717f0a84bdb896f57d9df64856cc", "object_relation": "sha3-384", "Tag": [ { "name": "comprovativo", "colour": "#EE1A65", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536687, "uuid": "92f1c170-1f9d-4a46-818b-e18ce8f534d2", "value": "T115B4233597BC648433149FF694930090A2D7E9E79E8CCC57C708312BAE5A13EADF964E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536687, "uuid": "c51e8def-5297-43de-9b69-d9c9ad3a7875", "value": "6144:gNoZUQQ59oe3m/Fh/qQr7QrMRT2MgM2wGqFaE5q+dUzYFywnnLMY17FUS9ala:9ZUQQcFbUqqnT+yzYFywLL9aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536687, "uuid": "4f0a5619-36da-4cc4-aebb-cd9735d923d8", "value": 539804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536687, "uuid": "3deab6ab-16d3-4862-90e3-0b0c7901a065", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536687, "uuid": "f8bdc4c5-e2fc-4a28-97ac-73bfb62bc94f", "value": "comprovativo.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ce3a58-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683550684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550684, "uuid": "6f254aed-922d-4c91-bbbd-f15c5b5657e0", "comment": "Malware payload (Formbook)", "value": "64895cba9786ff965555f5308f7abd95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550684, "uuid": "a0276a64-693f-4d66-9242-afe91c957c95", "comment": "Malware payload (Formbook)", "value": "c11514fce0720af2328f702e0a42aaea3b9d4ef635de46d638a9ca0629e5f75d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550684, "uuid": "4890d12c-d320-41d1-b3f1-0bd72ad62f35", "comment": "Malware payload (Formbook)", "value": "9688fc202f4f684f3ea065a73fe4016756e9ed8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550684, "uuid": "ed835b57-968a-49aa-bc6e-74a961081248", "comment": "Malware payload (Formbook)", "value": "6b9db0af0c3c234b77e2cb1b090c0bddaea2f1e2b1c899785b3fda20f3d3f22ef3debbb26c1570dae8d300f0b740a635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550684, "uuid": "c93500fb-9cdc-4b5d-82fc-af83c39e5286", "value": "T130D4025573B68F60F9758BF00A38B44003B234A799F0E65C0DE5A1CE2EE6F501AD5B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550684, "uuid": "a92a5564-886a-4b77-b938-1f823569fd09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550684, "uuid": "41be0aac-2e5c-4f94-92a5-d6471ba6e1d4", "value": "12288:Ge+MhSIJWKr9tiJO8ht/ha9pUtdBwZMe/B6CgD4KkY:RhdQUgxPp39wgLkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550684, "uuid": "842b85fc-d68d-4f0a-86d2-70c2d053fb04", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550684, "uuid": "90a65928-c57f-487f-9249-6ccbdeb7bd3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550684, "uuid": "4fd4f06e-d964-4a87-9082-bbaab5ab69f6", "value": "08052023_dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdfe7dc-ede5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683580680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580680, "uuid": "21917420-6d06-4111-8ff0-c28239b665e4", "comment": "Malware payload (Formbook)", "value": "0e17be44ab5949aa7e8c435c724d7fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580680, "uuid": "33ad3b76-ae21-46ae-8941-e0638a72dcd5", "comment": "Malware payload (Formbook)", "value": "c1a8208a8af8fb2ab397e586ea8a7f265921e6f21eb592af42a8f5c805d18557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580680, "uuid": "442e6dd5-efac-4dc6-a590-5c96df4f3646", "comment": "Malware payload (Formbook)", "value": "1ecd4bc58605af6eb4566fc14df40275523dbe8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580680, "uuid": "fb035349-e4c8-4b08-910c-3a941a674ff9", "comment": "Malware payload (Formbook)", "value": "968da84c1a0248a65eb75dea74c7b0e517f71edd3a460b391b7705527e4cf869ed06122e03958ac34bf7c0ce552d437c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580680, "uuid": "f4e3f4ec-b683-4cfc-99c0-6ef9c89ccb11", "value": "T1CBD4F16872F99F70E9758BF5193CF44503B234A758F0D6590EF151CA2AEAF006AD0B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580680, "uuid": "d3329716-8c3b-48e8-8d12-b6354be52df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580680, "uuid": "517fe54b-0a67-41a5-ad7e-28648120b4a2", "value": "12288:NHTZxe6aa8B9y8y04ogPZn96ryMj4+7hBQarT:NHNxe6r04hnQ9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683580680, "uuid": "a3b358ec-1639-40a7-8e52-3813a7167f67", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683580680, "uuid": "4df91609-bc09-4982-9532-1e5bb3a54d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580680, "uuid": "2748f99b-e1fe-4994-84fd-7f5b713417ef", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872baf36-ed6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529448, "uuid": "ac675b8e-a702-4bb6-a828-f7031f4ef0cf", "comment": "Malware payload (AgentTesla)", "value": "a47a0f38ba38a8bfcf3d4a5200b221ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529448, "uuid": "01b38749-3819-4bab-afb2-5ba4433a7054", "comment": "Malware payload (AgentTesla)", "value": "c1bcade2701007e8f761a5c6b8106fb736cbd36cf08e4f58ec7137eaee1f09ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529448, "uuid": "56cb1cf9-1e5d-483b-acff-440d7800a1c3", "comment": "Malware payload (AgentTesla)", "value": "304bcfb379334603ea43ccc027d7bcf0cf21e4a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529448, "uuid": "5229ca13-1d96-47a5-bb68-bb02a17af786", "comment": "Malware payload (AgentTesla)", "value": "23b0782c0c1ec860077f58d0184846c7f141ce6b50dc22234c0db06785ab4bca294020cc757e15cd88163e841968ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529448, "uuid": "b2a19f7c-5b82-4008-95e4-357d463ce34c", "value": "T1DEE4BF994E134243ED4DF93BC9A99CE093016E0B3B7C76BF7092C63D6054B7896E86D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529448, "uuid": "e84ccc70-fa30-4124-afc0-c7b8720f93e2", "value": "12288:Lu/3Q6BF39ExbGn4VfA8K3k+GHo0iVdg5LrsQn:qvQ6tEtGn2AB3KoVALT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529448, "uuid": "8e825029-f2b8-4bab-8bd1-bc0d648658a5", "value": 680344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529448, "uuid": "7bb281fc-ac5e-4b04-8711-00786eb191df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529448, "uuid": "b8a134bb-cc75-4f8f-84d7-ade6cdfa912b", "value": "SUPPLIER RFQ 05-06 CODE ZO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6539212-ed7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683536426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536426, "uuid": "6b45b93c-bcc0-45a5-a178-88185cb1cd54", "comment": "Malware payload (Loki)", "value": "34fbc7022384a5377bd9b728f7e35ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536426, "uuid": "30ceafff-da58-4fdb-805c-4f9242327aeb", "comment": "Malware payload (Loki)", "value": "c2b5806d85c2bc07ea08bae0ad6827378de60328adc733196652b74ab65640f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536426, "uuid": "5f46a7af-b289-44b2-94c9-058176914149", "comment": "Malware payload (Loki)", "value": "14c1bb403d031658d6ef70cb913731f13b30f894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683536426, "uuid": "0a615a2d-be88-4a52-8abc-a3f47d329f20", "comment": "Malware payload (Loki)", "value": "4ac377a9c5220d553339f552c7979e51d2e85c7357afe46d58a5569013f3967f394bc9f9f77f085c4348f31def59799b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536426, "uuid": "c5234c40-6b74-4958-979a-24a94d068eb8", "value": "T1D2641A4383E1FDC5EA269B728F1FC6E8765EF2508F597B6922189A1F44B00B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536426, "uuid": "2c67e128-dabc-49a6-af50-0966eca6fc2d", "value": "09ad811c7b24c560499d47bd7c66a41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536426, "uuid": "9313cbdc-88a0-4fb0-91b3-35953ae730b6", "value": "3072:ipXh6MiIe4LAJ5z8+8Ju5TYBAEiMjEvecy3Iga5MG3PKQqqTM:+h6t4LAvz7Ou5lMYGfhgC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683536426, "uuid": "f099ff37-d958-4bd9-9044-e51ed10f9bf8", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683536426, "uuid": "335d0722-b67c-4840-8466-0bafed19bda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683536426, "uuid": "90b8b079-3fab-4355-9727-65a509e41394", "value": "34fbc7022384a5377bd9b728f7e35ee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddb5f2e-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585750, "uuid": "d3b91b98-28ef-4013-8b19-040aa6cd535f", "comment": "Malware payload (Mirai)", "value": "8ed0dd9d578c1a99d5b4986a73329306", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585750, "uuid": "23c4c29d-2aec-4939-ba62-8ce707c13b1b", "comment": "Malware payload (Mirai)", "value": "c34758ca44055600e5709939ca4d153ffef3b03145e26b3d0386384ffcf9a967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585750, "uuid": "5c558467-b221-4a3d-8806-2a71bc5f3e97", "comment": "Malware payload (Mirai)", "value": "c6d63b6d45e816f885e168a2f4dd5b0dcab1e4ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585750, "uuid": "38ac9225-06b4-4259-b154-ddff65f41469", "comment": "Malware payload (Mirai)", "value": "39587acf8a15eed403ec9545c13b0507871788c43570b075c7893dec60db9022057a378ab58150a73e84ea050885aab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585750, "uuid": "db77e5f5-d2cf-4d07-989e-8900a8988ee8", "value": "T1DCD2E18976D253FA8CCDC67EB31E003A709978E9A6B29363B305C5430776180F691D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585750, "uuid": "c3f8ec98-4383-4341-91d9-9e92012c70d6", "value": "768:0lxKd29WcxEns+V6IHE4RlY990WI5yKLB:Rd29tn+9HEw0adhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585750, "uuid": "1ad8b443-5166-4bac-9b0a-28010f9657b4", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585750, "uuid": "37100de7-2d87-4650-809b-c162a3f3b4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585750, "uuid": "874270f9-7937-405f-bdd2-547502a78f71", "value": "8ed0dd9d578c1a99d5b4986a73329306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e41a106-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528548, "uuid": "8e80b1c6-326a-4dc0-b9f1-cb0213c28de6", "comment": "Malware payload (Mirai)", "value": "41719fc2d5a1ff87d4aacae151b622b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528548, "uuid": "6c446a18-c12f-45c5-b1dd-fed52b65b941", "comment": "Malware payload (Mirai)", "value": "c356e79e75b271b8260eb22303df686461ea397a215feca921fac67524366826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528548, "uuid": "d96dd4dd-341f-4113-a0e4-ab756180f1b9", "comment": "Malware payload (Mirai)", "value": "4e08acbb8fa5bfa73d1cc5e2ca5a500e724222c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528548, "uuid": "9c78bfd0-5720-46cc-9cb9-a51e710cc114", "comment": "Malware payload (Mirai)", "value": "312d5b2e6c8a470230088a68b2db6aefc4dde59b79212b1591741c31d454b8f01cc93929172e7d35d56eb68fa8db6e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528548, "uuid": "cc71830e-fd48-44fd-8f49-9802e6ebfa95", "value": "T1AA633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528548, "uuid": "bbfd0ec3-2b45-4a08-ae8e-5332fd611a5c", "value": "1536:lGRaTYmol/hGIAs4PNvAOQjGm75123tStkl:lya7hJiGmVDKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528548, "uuid": "0082fc93-9720-49ec-89b3-b70609ab90d5", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528548, "uuid": "7493e503-5033-4aeb-8080-ada6a5c31802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528548, "uuid": "89536301-4058-427b-be15-5d1119b79864", "value": "41719fc2d5a1ff87d4aacae151b622b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49661a3-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534249, "uuid": "72b1be6d-1ca7-4b2b-b8a2-14bc1897f858", "comment": "Malware payload (SnakeKeylogger)", "value": "78381b9a164431148cc6d8c1256b0ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534249, "uuid": "bd485395-193e-4f6b-b207-23310e3cb30d", "comment": "Malware payload (SnakeKeylogger)", "value": "c3f3e5052e6a603098bfe0838f32ac8f3c09710817af3ae0e96384dc013b007b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534249, "uuid": "079b4026-d71e-4274-8c7a-0ef8b89e9f39", "comment": "Malware payload (SnakeKeylogger)", "value": "9975314df7ce3863f692117535c5764ef4bfc727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534249, "uuid": "00d3a820-e031-4227-b68f-2cf615e71c09", "comment": "Malware payload (SnakeKeylogger)", "value": "3a4d890a5fe3af484d9aaf009825903a012e4a94ff69cac57f4b712e6b6518ea7eeae23831753939477d2b97552395f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534249, "uuid": "d89a0dce-c9a7-4fa6-9c7e-31258582faeb", "value": "T1D7B4126872F989A7F83D96F80A18F590133170A794D2C5D81FB66AC94EE6F006F8065F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534249, "uuid": "7905f299-991f-48f7-b539-62913fc93648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534249, "uuid": "a64e6fa3-c66a-4202-958a-87fe0f3eb56c", "value": "12288:joEk2PXMzuzoIDHMMEaXT3FPXI6PYbqKRoVRM:jfP+uztsMEc3J46Pg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534249, "uuid": "ccef511b-cdb8-42b8-a721-817544f4a17f", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534249, "uuid": "79446e54-9e8f-4103-8880-17b494c111a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534249, "uuid": "6642672b-88ae-4eeb-bc01-69a06b1fb25f", "value": "NEW PRODUCT ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b29e3c-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528696, "uuid": "431ceb57-b45b-499d-b494-de4199a1e922", "comment": "Malware payload (Mirai)", "value": "b35d01f14941b20efdbe89c332cd3a7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528696, "uuid": "cf1065cd-53d3-40ea-9542-cbf06d6141e0", "comment": "Malware payload (Mirai)", "value": "c419fec16dc1671b8bfde1cecab59f291f5496ceefa52732c2d1edaaa3f64c70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528696, "uuid": "4a56f014-6c42-4e98-ab61-84928ec6e08f", "comment": "Malware payload (Mirai)", "value": "5c722d399817b0b25e659dd7c0f2958a39141c84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528696, "uuid": "c7acfbb5-bc19-495e-8baa-6bc7b4da4ca7", "comment": "Malware payload (Mirai)", "value": "71087873361650875c7dc5a563d374345ea17af9b8e969ebc175f4a317d29b36da5a76671a1298a1daac395bc4e8bab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528696, "uuid": "3ceef27f-a07c-4d4a-9120-061a5ef19be3", "value": "T1EC534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A96B5E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528696, "uuid": "fdc5859b-132c-45d5-a418-8397568829b6", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMVZ/p9OyDQvSFRMNYL6FV+tg6wWI:+5HAdOmGyNtTAdPOyUaFRMNae+aTWxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528696, "uuid": "49bec0c4-8ad8-4b76-b8a6-64bd8cf18536", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528696, "uuid": "3b1cdb94-368c-4002-939f-f011748b1b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528696, "uuid": "561a9bab-a3c5-4c08-a12a-b5a18342404b", "value": "b35d01f14941b20efdbe89c332cd3a7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef93d11-ed6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528173, "uuid": "cf6f6d1e-3773-402d-b207-6905713d70bc", "comment": "Malware payload (Mirai)", "value": "822db601ddf7a54a02ac4084e748b1a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528173, "uuid": "a6acd9bd-03c8-4a84-9654-ed2695754dce", "comment": "Malware payload (Mirai)", "value": "c4763fa8dc439acbf87f9f557ea1202fc665a5cfbd9643d1c6eedf120980e2bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528173, "uuid": "e9b77381-f09e-4610-8536-d43b110ad156", "comment": "Malware payload (Mirai)", "value": "49baa2598bc9dd2773b24eae497cd66c7ba2d602", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528173, "uuid": "c9c90cd6-ad63-406c-bdc2-faf44ecbf151", "comment": "Malware payload (Mirai)", "value": "4ddf2c89f1a1f30982759a74cc21ab6deab1dfade90cd7c54bebdbfa8b0be4c6fbbc317796a592ed224fe795408e1e64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528173, "uuid": "ffacafeb-abd9-4050-99b5-da6649359bfc", "value": "T10C730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528173, "uuid": "1bf67e7a-b03c-4e0e-b749-0623660717ff", "value": "1536:2ln25xPBXk1wnnkL7+KE007I+RMqai90DIyiUNbsvHTGcV5GYIWv:7xpXCMkM/BTaFNbsvHqcVERq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528173, "uuid": "8b9089c2-6b04-481b-b36b-231c6e0352de", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528173, "uuid": "ebabc363-85ae-4860-9d90-611d35bc5a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528173, "uuid": "acc4e121-840d-40ea-8930-9086a0bdfc3e", "value": "822db601ddf7a54a02ac4084e748b1a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b366f32-edc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1683564513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564513, "uuid": "b0a09829-1291-4ab3-a1a6-59ef1cf1fd22", "comment": "Malware payload (Guildma)", "value": "056bf22aaaabf3c4af0f9ccf4d488a6d", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564513, "uuid": "5e1941f4-a951-411a-8282-7f706bfbd5ae", "comment": "Malware payload (Guildma)", "value": "c4dbe99fdf11cf3b7c8b1646e68fc2bf67ceed0b2b188aff08735c1af1a5eef4", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564513, "uuid": "dd8038b5-1ed5-4f49-a15e-866a1ad4c8e4", "comment": "Malware payload (Guildma)", "value": "1e03118943ed017aa42ca41524839a7e4e74ccab", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564513, "uuid": "d838ad42-7e59-428c-99a1-6ec520c9277c", "comment": "Malware payload (Guildma)", "value": "9046c61709ca149347d838286452be4e02f94d4dff5f0b957246979873f65d58cc1af65b97bb2f799422f0575e86dfce", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564513, "uuid": "55c5e444-47e6-4432-92f0-07ee87c39d3a", "value": "T1EAF00211C2FE35D8FE7EDDB4784E16C8C51853A585654FCDA48E53467EE94AEB372000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564513, "uuid": "22c99d8f-7e06-4711-867e-67ed449648f4", "value": "12:5jwaJ4+dQVia7h5PZ8r/NzcWmb0W2ZiiwiHxztgCjDw6qkcz2aD+dQV+Xta4Q/:9tNI7htZ2TjWWdtgC/wgCbqZLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683564513, "uuid": "08e0ed5d-acb7-4417-806b-0712b9e79466", "value": 645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683564513, "uuid": "ff29d174-2a90-4b58-a02a-d61320bdd2ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564513, "uuid": "f121eaad-8960-44c9-aa4d-868a0e123c5c", "value": "segundaViaBoleto29166.972005.39998..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a46e5d-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683534816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534816, "uuid": "63ca757f-6906-41ed-af9e-4b7eaab7cc52", "comment": "Malware payload (RedLineStealer)", "value": "44153d0fe3f6252596bc95c2aa1225a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534816, "uuid": "0db2a93a-e898-4c52-ad67-a6912534f3cf", "comment": "Malware payload (RedLineStealer)", "value": "c5908bf913514bbf1b52bb43734288950c002d9de7a44b0e900761f42a87e200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534816, "uuid": "ca16f468-5401-429d-85ff-1377d98bfca5", "comment": "Malware payload (RedLineStealer)", "value": "6b7b0c24bb7fc41757580cb61e2b992a398aa7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534816, "uuid": "172fa334-1c35-413c-8906-a3f7df01fee6", "comment": "Malware payload (RedLineStealer)", "value": "ac919b1c14b41aa6ae10876e1b4cd04657684cfec64d460330d73746a3ab57ef676ef78c9a9e58413592e2d0a0902258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534816, "uuid": "8a452e10-c4ea-4383-af67-9ff73413e5f4", "value": "T1C4B4120297E89032E9B5277009F31793073A7DE25C78C32B3795A94E4DB36D8AA71727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534816, "uuid": "fb9626d4-588d-45aa-9999-0234cf478837", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534816, "uuid": "675cacaa-c56a-411d-9b0b-f69e19885cfd", "value": "12288:BMrSy90UcT+AnyT69bVWdEz1gPYGSMwiwbbhnZr:7ylcTtnyTGoCqLSMwjFZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534816, "uuid": "0a74c8b8-514a-4e6b-91e2-b82a9e22fbd9", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534816, "uuid": "40b12db0-9df0-4e00-af7c-cc400fbf1b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534816, "uuid": "657c95d8-89c1-439f-8325-9fe2404ae95c", "value": "44153d0fe3f6252596bc95c2aa1225a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0928431-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683570374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570374, "uuid": "0df6fc70-3d64-4e5c-b1d9-cb4c7ec4a836", "comment": "Malware payload (Rhadamanthys)", "value": "97a2299be5863c0b77368f0d5a27f8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570374, "uuid": "eb335ef6-c098-4ff7-8968-51815efea475", "comment": "Malware payload (Rhadamanthys)", "value": "c71c91c8c6cdb4cc17f2777a9078e0863f1e9ec76555043e85286af14fe275d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570374, "uuid": "cdb8dc87-d188-44ff-944b-71d29da70f78", "comment": "Malware payload (Rhadamanthys)", "value": "dace7860b2b6fd3c2f85916b640471adf810c6bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570374, "uuid": "970785b1-aebd-4a95-8a5b-c3b2bb6463db", "comment": "Malware payload (Rhadamanthys)", "value": "2dcb6e190ba81d1152130646a58e401ed7cba44167b1b0c648c190be6f570d75db639526ab0271f62997122a947f9936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570374, "uuid": "c66231f6-82cd-41d4-8295-445edcf53541", "value": "T13B946D1362A17C61E6264A3ECE2ED6FC361FF9918F5637EB121CAA2F04711A3D172711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570374, "uuid": "c86e7aaa-20a4-45a0-83cd-702309a71bbe", "value": "ab2eb8e5a3c6d771edc653904f2b9e28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570374, "uuid": "90886a0a-c08d-4292-b911-21cf7b5ed259", "value": "6144:iYjwAoZ9Y5K1DptQBX/v6HihkfauL2nQEVNO:7jwACYM1DpGBXtTuL2QaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570374, "uuid": "334e06ea-eb89-4e51-8a23-e4b8425e7b92", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570374, "uuid": "a24e3d65-490d-4604-a50f-3e7fbe862543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570374, "uuid": "c76a92a9-5ed9-4db5-aeb1-5726cd8533dc", "value": "97a2299be5863c0b77368f0d5a27f8b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3da978-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1683550933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550933, "uuid": "7c7c1aa5-27f4-47bf-827f-a4cefee7d0e2", "comment": "Malware payload (WSHRAT)", "value": "b2b05e1631db082866c8f9d38cddf403", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550933, "uuid": "433fd072-5eda-4047-9b6e-5238d20c786d", "comment": "Malware payload (WSHRAT)", "value": "c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550933, "uuid": "13cd111e-6d21-4146-85ce-19a422ba22aa", "comment": "Malware payload (WSHRAT)", "value": "3f19e69b66bf8c50993b55e5744818e3e92d4156", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550933, "uuid": "7b72e308-08a8-412f-9c96-c40c10571022", "comment": "Malware payload (WSHRAT)", "value": "ee2bd154fadf932eee76304e0e91ee2987fbd35fbfc85bb96cd8d55a6f76cb1ddc79e862057a5de6fa872d2758a120bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550933, "uuid": "102ccec9-6597-4268-959c-00ba7c64e484", "value": "T13B151CC525E83A06DBB3F764C711D522AC78E9231DCB21D2BDC43A8EAE76C505DBD920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550933, "uuid": "1f2def1e-7e5d-4b6d-b225-1ab4b753e155", "value": "6144:ROD297zg2plJPacQwE6hkpA0LysIfFk9jvCsYS9H17d9qFPNL6Z4MnJHI9Q6NCwU:+LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550933, "uuid": "c3737482-e5fd-46e2-9d8f-316dd112e0d3", "value": 920241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550933, "uuid": "8033782f-a1b6-4c1a-a0b4-34fcda6a0f11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550933, "uuid": "f4d0829b-4996-4168-8e3e-9c2a1badae97", "value": "Scan0030.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e7c581-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683551075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551075, "uuid": "bfc5fcb8-53d8-436f-80b1-a6c09e9be2fa", "comment": "Malware payload (Rhadamanthys)", "value": "f0cebf5fab9315808380c299b50b6d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551075, "uuid": "3aaabfe9-4baf-4ef7-89ea-fd80c4b68992", "comment": "Malware payload (Rhadamanthys)", "value": "c7e1d534ed1a723b3aaecf3a257cf2f1bea5b46fb91b8510d9ae9523a3caf457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551075, "uuid": "a5e83697-7204-4606-bf12-683ba263ec75", "comment": "Malware payload (Rhadamanthys)", "value": "97d345234577cf60b4acbbba7080b3a295e04883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551075, "uuid": "2378c390-d574-48f9-bff1-cfd2a1dc09c7", "comment": "Malware payload (Rhadamanthys)", "value": "9731af8296f8594a2b81193ca70d5976823d3031b7902baf894daad37a5963cc8b8928085c11c13a1bbf50e18b7d8893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551075, "uuid": "0503755d-4c39-497b-ab35-944feefd7d8a", "value": "T13784AF1272E0A8F1F5224B328E1EC6F4762EFC91DE647BDB325C6A1F0A711A5C572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551075, "uuid": "f2dc8160-d0ab-4c59-8497-837a4bdaf4f9", "value": "51ff29d4db4362644e59273b02a12d87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551075, "uuid": "7d52f5e0-4513-4c37-96f5-f6c7e9524896", "value": "6144:4s1/rwGW7XsecrkAzJU5uJtTgllBdFM3G/FlXffA:Z/rwGWojIAzJUkbgTS3uFlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551075, "uuid": "82487de3-687c-4cf5-8bcb-030a7fa17fa7", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551075, "uuid": "99738f5d-d84d-406b-b139-dabc54280364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551075, "uuid": "90515b92-4592-43d0-b95a-ecb89b836e83", "value": "f0cebf5fab9315808380c299b50b6d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba666d3e-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534259, "uuid": "df27c38b-3b84-4893-a4d6-ae9e07c7b36a", "comment": "Malware payload (SnakeKeylogger)", "value": "47245a8954bdf53dea70e6bce223a6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534259, "uuid": "0a55cd6d-2651-4735-b40c-cd45a841fa2d", "comment": "Malware payload (SnakeKeylogger)", "value": "c867fd488ab6ce0432121c22a8135548149fdec7ac7034c5e9ad6a78f4d08c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534259, "uuid": "ef71d067-e219-4d7e-8951-036399bd459d", "comment": "Malware payload (SnakeKeylogger)", "value": "d6b209cb02a5fdb0a8e8864cdaa0abbc4378de13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534259, "uuid": "9deb5632-fb45-4167-b89d-b02a7c8e0d34", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed27e11d31f0241ea444d0093787e3123b93a182325726df035602c00ae44286e926671be6712ccb655bbec1e50b0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534259, "uuid": "37a8ada2-7425-44cb-ad21-7a6919dbc79b", "value": "T10BB40154E2B6CB90E81D4BF4251CB140137171939DC1F65A1F2963C8AFABB1CEA886DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534259, "uuid": "9145b198-dd9c-447f-ad80-75414851b4ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534259, "uuid": "372adef6-0936-45f0-b25d-cb3dbec74c2a", "value": "12288:daRDyIR6h+kGeeZosJ2XLXEv/g7Ms1ienFHaPO:8MIR6peZosaLXEv/gV1iM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534259, "uuid": "8bde2d87-bae0-47d0-b1ba-3658f5178e08", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534259, "uuid": "977f3e4a-c98d-4464-9efc-d6dfbeafac45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534259, "uuid": "d0ff793d-07e9-4992-ab50-a423027b53d2", "value": "MBUaTHW5wrIZaL0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c579ac-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683552662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552662, "uuid": "5f9add39-d253-4c44-91fe-fce1726036ee", "comment": "Malware payload (AsyncRAT)", "value": "435738f35c2bc815fa7186e07ccbd6cb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552662, "uuid": "a397a62a-fbf1-4b36-849a-9fac9b980792", "comment": "Malware payload (AsyncRAT)", "value": "c8a2e6686c66c2e7b85cd17c5af1aab79c48abdd6f756bbf9ffd4c4eb0ab77cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552662, "uuid": "20a4ac1b-3964-488b-8394-922af442fd5e", "comment": "Malware payload (AsyncRAT)", "value": "2ad7e8fcbe8f7db3a33c61889cf5e56a48b49dbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552662, "uuid": "fe7e8ac5-eaa1-4a31-827e-55a12d380d33", "comment": "Malware payload (AsyncRAT)", "value": "e4235e23e025567e935b31e0985be1d4da5cffdd8480b8a40298feb86ab1fd698907c669ece51b178546be9aa0851a3d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552662, "uuid": "7f6e2992-3638-4d42-adfc-ad8dafb48d66", "value": "T109011039C1929FC3B808FA7327DA29B02430F7E396EE50D4498544CF16BE058A09916A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552662, "uuid": "bf3f5eee-6971-440d-abc1-8bb394d67ce2", "value": "24:fTTTTTTTTTjk5dRAmIDMLbffINr8bXqFutjbT/PTC:fTTTTTTTTTj82msM3NautbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552662, "uuid": "7382216e-1251-49f1-8156-4b94433bdadb", "value": 783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552662, "uuid": "1da37982-7f2b-41dc-900a-a560088eb248", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552662, "uuid": "079dd69d-86bc-43a9-a0cf-3ef492793eb0", "value": "c8a2e6686c66c2e7b85cd17c5af1aab79c48abdd6f756bbf9ffd4c4eb0ab77cd .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c936e4-edbe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683563804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563804, "uuid": "caeeebb3-a2d7-4358-9b08-9a70d0b4711f", "comment": "Malware payload (AgentTesla)", "value": "e52dc6c8ee44a054704d061291319fe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563804, "uuid": "3df51716-b54f-45a9-bac8-b18c94c20bbf", "comment": "Malware payload (AgentTesla)", "value": "c8bfd9368340e6e057d18ac8d45eb758bff6fadc9550711d5e25e9f183cecee4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563804, "uuid": "8b4e6ddd-625b-49d0-95f1-008cee464ab3", "comment": "Malware payload (AgentTesla)", "value": "8a1c5b156cd83ab734cf0bc2b8ec424e3df295fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683563804, "uuid": "0eefa019-49e7-4dec-b262-a796282ae53e", "comment": "Malware payload (AgentTesla)", "value": "c3a2ff4ea5359ea0ca4ae47b5b924cb20eedd1e531b463281f696e5bc29434890349112ca9faa52fdfcae12f8396d60f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563804, "uuid": "f6d66a2b-18b9-4027-9e92-7af36ecad591", "value": "T1D0C402A572FA8F60FA758BF41638B44403B130F798F0D95D0DF1A1C96AE6F502A90B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563804, "uuid": "bae89678-0e4f-457f-b3b8-5f71e75ed247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563804, "uuid": "7e04c04c-517f-4ee9-8654-bb5945adfb2b", "value": "12288:PWIRg0zA8xwXdtEVhdkQbhACs7Fx9QSdRouJMR0HUOd:XRPzJj112bdpJMvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683563804, "uuid": "05cf6f3a-3614-4128-8d12-cf332ca7b433", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683563804, "uuid": "08901a47-3626-45cd-aa31-fb8d878de421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683563804, "uuid": "2d1d7307-5108-4ca7-8b17-7478167144a6", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b325bf14-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550567, "uuid": "68e0d50a-34f1-4f35-bfb2-74857083d104", "comment": "Malware payload (SnakeKeylogger)", "value": "5d68ecd099c751e423cb93c9371e1012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550567, "uuid": "cba883fb-4bd2-4a93-bd94-39eb0ab4e0b0", "comment": "Malware payload (SnakeKeylogger)", "value": "c9234000f8f576a39a7d2a957826094c1c0e37b141ef26ee2e8e36a62e09805a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550567, "uuid": "fec02b0a-51a9-4544-9c55-2e3a35609b8a", "comment": "Malware payload (SnakeKeylogger)", "value": "69283c0f96ba6895a32d811caf51e774b36ef084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550567, "uuid": "4907fb85-186a-4734-ba6b-aedfe66bd83b", "comment": "Malware payload (SnakeKeylogger)", "value": "2b5caee87e308cb7b576efef34ec2946b1ce934456dc61dbf502721dc5b6d0cfb6c2857525d1f99e43ffb2f981be96f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550567, "uuid": "fe3a726b-15c3-45c6-aab4-219a22aa1b83", "value": "T104B4F15532FA4F61EA788BF02538B84007F130A359F0E65D0EE651CD5EA6F106FA4B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550567, "uuid": "8e9f24ae-4de0-4918-8c15-322dcc723376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550567, "uuid": "2503045d-3264-4f1e-8e53-c6ae1b6152e4", "value": "12288:8EkdqMAuX7hiDGn5RKOGO/z+kyJCP4kjOuANz2XmSPt:8TrX7hiwnfGKz+iBOuiwmSPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550567, "uuid": "07eae89e-b396-4447-98be-c534e681c62c", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550567, "uuid": "8b6543aa-80fd-463d-878c-afee820085e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550567, "uuid": "c7fa3d9e-03a3-4837-820b-ad588acdfc53", "value": "RFQ - BI # 11-20034-2002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deebb7fe-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683529166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529166, "uuid": "b60f0def-90f9-46a7-8e55-215b415d5ea0", "comment": "Malware payload (AgentTesla)", "value": "d989dd983dab911183900344d3c4b1bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529166, "uuid": "d4cff2fb-d021-45eb-94f2-35218893ba8a", "comment": "Malware payload (AgentTesla)", "value": "c9a906faa58da0d3ba2f29d91fe81eca228d57ce1dcee87f153139c5f1ac54f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529166, "uuid": "ee835ac7-ec6f-47ac-a690-3527ae2d1de7", "comment": "Malware payload (AgentTesla)", "value": "3a4c1c6069e85bcf38a680b9e5b85cea1de9ae0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529166, "uuid": "de357e2e-2474-45d3-9f58-4b7d50e4f700", "comment": "Malware payload (AgentTesla)", "value": "052623d6fced924bfac072cf5349831f526b76e6c29a63f0cfbe5c1efbf5524013438aa9971352c2ac35a89310398b94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529166, "uuid": "e8d75921-cc9c-499b-9a2e-2c9a964886ca", "value": "T1EFF4BE4DC278C464E9076770847ECAB73B4E6F72D25B832871AC62D347518D0A3E6B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529166, "uuid": "f67b3396-43dc-4c4c-a96b-915770e19ce1", "value": "12288:KFMVoWEvx5xlotYpoL0DLVLWDLVLrXDLVLYDLVL5ap5VrW1U4cZKB:KFMPI/otEaR40LKRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529166, "uuid": "66c307d3-0f26-4cbf-bbb1-b3bbd50e0a06", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529166, "uuid": "9bee2a43-627b-44a2-b609-6c859520c253", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529166, "uuid": "c007049e-fb62-4946-9f5d-8399942fda37", "value": "Weekly stock list 0805.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3604142-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534247, "uuid": "f68e4298-3900-4bde-98c3-6bc3eeddffef", "comment": "Malware payload (SnakeKeylogger)", "value": "83b3f4c0ace645f01341ad18e47289fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534247, "uuid": "eea48df1-2fb8-416a-b10a-faddd48fddf0", "comment": "Malware payload (SnakeKeylogger)", "value": "c9cd4f96ee3af2513298b62ff2f1c877364fb537fa3d70ef5268db133a4b9b85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534247, "uuid": "1fced141-5e06-49b3-8da6-dcd25228f6f8", "comment": "Malware payload (SnakeKeylogger)", "value": "8b9bf624b6fad334f0ceda95c28ca7b45cfff8e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534247, "uuid": "3c647a8b-d920-405f-be4f-85318310f2b8", "comment": "Malware payload (SnakeKeylogger)", "value": "8b9a04f49a3827b9de451783877567121ffd565365b57d4800ef2381119b9ae63406e8426ac99e66fb7bbf1219c379c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534247, "uuid": "6a074d41-2b36-4c4f-bc5b-9ee33555abf6", "value": "T19DB40290B2F18E67E20E08F9267CF542137271E39DD5E7D90F26618C6EE6F012E4895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534247, "uuid": "dacd8119-ef55-4818-abf0-a0efc6e8bf44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534247, "uuid": "60983592-c2b0-425f-9961-8a84c142b554", "value": "12288:eqLAr86WomaptByv4FADiom6DCcbniw/aeax:ekm8vomWc4ODioliH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534247, "uuid": "a140a9dc-d888-4c66-bd55-d326e85bc06a", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534247, "uuid": "f3001244-4f72-4052-b7e3-0fe11836e1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534247, "uuid": "dab80840-7d64-4ac2-97ef-14993e5572ce", "value": "business inquiry.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662678c6-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530252, "uuid": "db8667b2-6c2f-4d27-ac75-3c5590aedb15", "comment": "Malware payload (Mirai)", "value": "14070487b89ddaa10c52deb1c35a2d2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530252, "uuid": "8f544ffd-370b-41b2-a68f-8b5ab721e33e", "comment": "Malware payload (Mirai)", "value": "cad3f3d80c07015925bc8f82cceded126038ab5d3d07b3b0c443e15939796866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530252, "uuid": "7df92ee8-15c4-428e-bc5a-8f164d675744", "comment": "Malware payload (Mirai)", "value": "c59779bd40ddfd32a71e3f39bd9e71edd14422ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530252, "uuid": "fca3eaeb-a980-4938-b6e6-765e156f5918", "comment": "Malware payload (Mirai)", "value": "8a35371e1bec878819e01193c8f347d7d2765accc9c866a94f31a24bc472cf0fd47c0e75dc3ad6a7d30d0242b3bce0df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530252, "uuid": "cffd3d91-d1c5-4701-8ea2-d2c2f91c26e7", "value": "T1B3833C89FA80D700C9D886BFF54D518E330703BCE7EDB2D69A26BBB16747496087E815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530252, "uuid": "e49f3085-b8d9-4b8d-98fc-91a70cce0a0d", "value": "1536:liAn/v1KMnO1NX9tA6UxRkCoSGxwqODyuTsMYegiQx1muZhhVuH:lV1Kb1TtsBoNxB0dQx1muZhCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530252, "uuid": "016f0e8c-a041-485e-a288-f3679f9973a6", "value": 81364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530252, "uuid": "9924377b-aaec-456e-907a-c09b66ef20bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530252, "uuid": "d841117e-c30e-4c89-93b9-c3b1ab42bfeb", "value": "Andoryu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8261d3a5-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683535024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535024, "uuid": "95a82f65-8bf1-4d1e-a54c-4b6ed6f3500d", "comment": "Malware payload (Rhadamanthys)", "value": "84ea78e49b50c839184359817be2d01d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535024, "uuid": "1128b67d-4e24-4321-9022-4eabf5fe0dc4", "comment": "Malware payload (Rhadamanthys)", "value": "cba464617c0ab39774135cc89752650e41f8ed3cfc773619995be0267f7570a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535024, "uuid": "aa9b0f63-946e-4494-8862-ca689613ed83", "comment": "Malware payload (Rhadamanthys)", "value": "c83c1e2cb5ab7988765aea3697dab23aa16d42d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535024, "uuid": "42677f66-daf1-4dd6-bf9c-5ecb9e322b6a", "comment": "Malware payload (Rhadamanthys)", "value": "a945d472e5cfa6a2f422daf61f57dd7c412beffa7bcb3e3686d593080b29cb9dc0fb8d8a5ceb457ff3e9947f9fedcb57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535024, "uuid": "038fee5a-9d4c-405a-bd83-f346cd4ff725", "value": "T187844C4392E1FCC5EA268B729E1FC6EC769EF2508F49776612189E1F44B10B2C277B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535024, "uuid": "62ee7872-47f4-473e-9975-31b8c904c174", "value": "513663070e5d163878e1cb9d4a5e6408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535024, "uuid": "9e5bd694-dec0-44a8-b2b7-07471c43a3fd", "value": "6144:W/3ZCBLID/EP5mmj9EN1zj+DMT/omPwl2IVYm:W/3sm/EYWvDsgmPwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535024, "uuid": "451ec610-d933-44ee-b397-ab0d22ba961b", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535024, "uuid": "bcfbcbbf-dc1e-42e4-8655-054b89033167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535024, "uuid": "06978176-002c-48ea-9d48-310baf067154", "value": "84ea78e49b50c839184359817be2d01d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403b6d89-ed74-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683531906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531906, "uuid": "3f9cdd76-3e93-4fe6-b1e7-ddf607c6dd41", "comment": "Malware payload", "value": "e9e9fa689c08fd23006cf14868576693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531906, "uuid": "ed58b253-4ba8-490f-85e3-badb8f8f6488", "comment": "Malware payload", "value": "cbfc4f69200a5e7ee96ae849cc47a5a7606da8b38b911b2d4d741f067611692f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531906, "uuid": "11d8086a-54c3-4d73-b4a7-519a641cae12", "comment": "Malware payload", "value": "b1ccdac67bf2f3ec1c22a332c052cdaa069990ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531906, "uuid": "f53fc68d-002b-49d0-b20d-40322000159c", "comment": "Malware payload", "value": "d1ee14f605dc4d34858a18b940cf60668da349b431ca4977dbb739c1569faacbf4d55c9ef311337557f4aad1d03c9a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531906, "uuid": "2c7d30e2-4616-43d8-8c54-11edefa25641", "value": "T1A2D47D1EB39841E8E067E178C8860A12F7797846137257AF43F1569B2F2B6B05F3E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531906, "uuid": "efd07d4c-85cf-4514-a71e-e09d39357822", "value": "ded106e13859f6be1c811febd70fdc74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531906, "uuid": "2af17e7a-23af-44e8-b691-55cbe30e4b0e", "value": "12288:DwqjS4gdTB7L8GT8gNRQaISd7IG9yy4abbqiPT/Rk2m/+ynrr9dfeZ7zZp+ob/n7:DwqWJuabQHnrr9df27GO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683531906, "uuid": "88739bf9-87b0-4c5d-a5c7-939403fecf71", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683531906, "uuid": "10e24a50-8787-4eaf-8330-902274fcfe38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531906, "uuid": "f6c72682-7c37-45ac-8822-35d3257dfc73", "value": "8905277162106_164921611252834_29\u00ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb1e174-ed8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683542614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542614, "uuid": "e16e0209-2732-40cf-b2af-76dfe7e285d6", "comment": "Malware payload (Formbook)", "value": "b69681df5a4be22c7f52eccd03431742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542614, "uuid": "f993c56b-02ad-4ae9-9417-3de3a3d159f5", "comment": "Malware payload (Formbook)", "value": "cc9fd84fffa1811ef3177586d7c6aee88dc4dc5412fd658ee4bb36ff934eec01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542614, "uuid": "addf0be5-03ac-45b5-b447-d93d5df740ba", "comment": "Malware payload (Formbook)", "value": "0042b18051a33187d32cf4acfc8cdc9faf7fce79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683542614, "uuid": "af877b5f-df1e-4c11-a9bb-331863be1a9a", "comment": "Malware payload (Formbook)", "value": "373a3ac0f6bb202dbb612d0fb8f18b2ad4e72693e411accfabc4b2347891e59990b7efde77609a1a7bdc3240e81e5981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542614, "uuid": "ae1c2959-369e-4cbd-bd51-c6f9db5a74af", "value": "T148D4020472B58FA1E6798BF01938B54403B671F758F4E64D0EE660CA1AEBF102764B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542614, "uuid": "2eab41a6-990e-4d6c-84da-1541373a2744", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542614, "uuid": "6a2b4b06-9ca9-4e26-8ab8-55f90402c919", "value": "12288:wM7i5ZPi2sRVMCv3sJ4mZFKjpvNKgPAcvDZhdhbrvt:N70YF3Jp4ajdl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683542614, "uuid": "e9b4c8f4-ee0a-470a-895f-7ca7792769f8", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683542614, "uuid": "d890697b-b940-47d8-8825-f098a58c8862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683542614, "uuid": "fe96d75e-5af6-478b-8bae-284cd2121cbb", "value": "RFQ 0341101-7996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7aec554-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683570386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570386, "uuid": "bf49845a-8714-430f-9b81-1cba8f76df0c", "comment": "Malware payload (Rhadamanthys)", "value": "81d0c7a6886958eba58b6d0d92b7682c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570386, "uuid": "fe4d76c6-527c-48a9-a628-95be59282b29", "comment": "Malware payload (Rhadamanthys)", "value": "ccad7b6f65bf0381e93cabfceeb6e0bc5f838a37112981733b7f719f8d90087e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570386, "uuid": "ac5362f8-abb8-470f-9776-bcf96551aed1", "comment": "Malware payload (Rhadamanthys)", "value": "1cc851614516ee1bea57103f68ac0fa36f9943c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570386, "uuid": "18d2d585-8ae0-49aa-bb0f-368c0476906f", "comment": "Malware payload (Rhadamanthys)", "value": "f6c03a44bc5dca60f678f334a181f65506d2f47311a6352702a8435b00b1165ac1f074e57769ca724ce25128ee79e423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570386, "uuid": "73c6e629-dbef-4672-acf0-c04d0ede04f9", "value": "T1BD849F027AD1A871E5674A328E2AC7FC6A1EFC91DF1536DB321CBA1F0A701E1D172716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570386, "uuid": "fbe0a0ef-1ec1-4cb4-8068-ff5ebd1002ca", "value": "258686fc6d31cad257218551c31cd3a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570386, "uuid": "9577d06a-68df-49f7-ae24-6197a997b109", "value": "6144:eg4hDeq+PwQXKNf8sFrl2lX7YgUnnVEqg0A7V:evhDehPwIKuGrk7YgiVDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570386, "uuid": "9807a7bd-101d-4192-8927-6a9e87363534", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570386, "uuid": "01c141ef-6369-4a71-99e7-7822472e983f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570386, "uuid": "7f2fc850-8c5a-465b-b948-a4d9d366020a", "value": "81d0c7a6886958eba58b6d0d92b7682c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff526a6-edd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683571607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571607, "uuid": "53a36346-e86e-4f5a-ac1e-05e35aa6851d", "comment": "Malware payload (Gafgyt)", "value": "9d7b5bd0fc8e72e28d9c748f1ecc4811", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571607, "uuid": "8b401765-289e-4e51-94e3-6bb6409e52b1", "comment": "Malware payload (Gafgyt)", "value": "ccadfe530835090afda7be358411caa8465fcd924eb3aea46a6972c76d405dac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571607, "uuid": "f5b00c8d-78b4-46dd-ab97-15c542518dd6", "comment": "Malware payload (Gafgyt)", "value": "5f5bb224e0b758da064a410c3086e29b97efb7f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683571607, "uuid": "01032483-c927-4916-8bde-980aa604345d", "comment": "Malware payload (Gafgyt)", "value": "764f2cd4880432b9eec1cf30b94419e3ee9f6ffa2ebd563f3ce630d8e6185d0a6c34151109d66812f86bf0b12db508e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571607, "uuid": "8dc2a726-7a4e-4c5e-8c63-397c21a6e8ce", "value": "T177C3192337670B23C4EA503441E75337B7B5DB843878924BAAD0AE9C2F1AAD435573E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571607, "uuid": "a91082f5-2119-4dcf-9e5e-581ffdfc6e73", "value": "1536:yXxEQaOOhNeO6b75k0wmpHmtbWE+24dt/MLy4fGmuwA/KiyYIW:3qOhNJ6fpHObB5oKZfGmuwACXYIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683571607, "uuid": "bd66f1cc-22ac-4a26-8fb4-af671a5bd9ee", "value": 119963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683571607, "uuid": "c47dd4f2-f078-49c7-a9da-884a7f0fc91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683571607, "uuid": "521a10e1-1b22-4f8a-bc1d-4914d65618d4", "value": "9d7b5bd0fc8e72e28d9c748f1ecc4811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaee77f-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683550585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550585, "uuid": "386864cd-04f1-4179-8ed7-57dbdae8614e", "comment": "Malware payload", "value": "099b7c642dd936c52d1bcbc9a90f13a3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550585, "uuid": "b5869770-4ca6-45a0-b42e-e2387ec88b6a", "comment": "Malware payload", "value": "cd34e596b84956502c4844a029b087b39d92527bb5d79022dd19731c9acf47c5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550585, "uuid": "793bb113-8774-4078-957d-349f77dc7bfe", "comment": "Malware payload", "value": "5bcef478e646bba62de158f9625b7776b2a756ee", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550585, "uuid": "4e2737e6-7a2d-46f7-b02d-295730c31fe5", "comment": "Malware payload", "value": "0dae2ddc8a274209b6e81e670ca51eda5649941114fb463de3cf4da8035dc292005a9ee1db243a5203ef5bb77089ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550585, "uuid": "4980daa3-f262-40a8-9351-d5c3e069a96c", "value": "T1B4033B5EE78F02A58F411373671B4E89A6BDB22EB35541B234AC433433E9C3D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550585, "uuid": "fcd444f5-de12-4899-bfc6-a0d8c4f5cf38", "value": "768:UFx0XaIsnPRIa4fwJMN9BoKia6sSeZQ/tvm9uCJfKl0:Uf0Xvx3EMnPWsSemVvdHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550585, "uuid": "c3953dec-2112-4be4-9fdd-001cfb4e0279", "value": 39516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550585, "uuid": "a09ecabc-8822-4a2b-abe5-5acc110cd8aa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550585, "uuid": "9e2647ad-c319-4b97-b9a3-f576a222d273", "value": "order + offer request.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9812d9a-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683535089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535089, "uuid": "d58e42b5-3818-4811-a229-e6759c3ed6fc", "comment": "Malware payload (njrat)", "value": "db387208278c3a90d57f688f1b033bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535089, "uuid": "eefe237a-cac8-46d0-a2e8-209a943887ac", "comment": "Malware payload (njrat)", "value": "cd34e9df2818c24a997cb20b620af8498b42df79617e062e4802eae63d56cf32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535089, "uuid": "68971267-e130-487b-8305-24f528e023f0", "comment": "Malware payload (njrat)", "value": "5ab6e58b54b4d43591da661a2bdc538bc69f9850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535089, "uuid": "3aec94b0-385f-42a8-8d2d-83d258dc2e7f", "comment": "Malware payload (njrat)", "value": "7b09cffe5d775f0ed21b47216ff83c20629b24ab52e74b3d00a6fd288cf58588d0faaa33de359cd0ada2d46fc41062f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535089, "uuid": "58f3b1d6-ea2b-421f-9282-44c5ffcc9bc0", "value": "T143C44D243DFB101DF3B3AF659FD4B8AF9A6EF673260A60A9109103464723D81DD92739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535089, "uuid": "0ba02399-af20-43b3-919f-d84a59878cd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535089, "uuid": "cdc12b1e-ec09-4d85-bbc2-b425a9ba3b75", "value": "12288:HiJmalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMpU:CJigAm3lTad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535089, "uuid": "829d2ac9-ed60-44eb-a475-87251dfd2181", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535089, "uuid": "0c68264e-965a-4209-bb32-25be49d39299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535089, "uuid": "cfd6e365-fa21-4b58-bd7e-e0b7abda4950", "value": "db387208278c3a90d57f688f1b033bb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dbab86-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565876, "uuid": "742420b1-83d3-482a-8567-d80cb96de648", "comment": "Malware payload (Gafgyt)", "value": "245edfe5fd9ed693f1b01f61dd5a5533", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565876, "uuid": "86dfd032-95c6-4132-9a8f-35e84bd81c30", "comment": "Malware payload (Gafgyt)", "value": "cf6245e3240281a1c0d2ce991df6ca6c3c9ac06b34ca110ff2e56da91f94fbdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565876, "uuid": "3bdbac62-3f88-41f3-8b55-2c4c8c3a6687", "comment": "Malware payload (Gafgyt)", "value": "a177d7fd120d02ea7374877036fbd95cc2fedb3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565876, "uuid": "d706c93e-4040-4ae5-90c3-5cae60027611", "comment": "Malware payload (Gafgyt)", "value": "7ad3e615b1493cf3a393fa639e196d044f3e20236a50d0934eb3179f63b94065297af77afa14270e555f537ab84517e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565876, "uuid": "943b2971-866a-422d-abdb-7b31d8241dd0", "value": "T13CC3193B6B270E23C0C9507116E31332B9B9DE5938B943D7AAD07D9C6F3A58834167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565876, "uuid": "119259a0-6595-44eb-92f7-6ad8a34b369b", "value": "1536:ivJm7TYtgc6RhSsN95fftvLItIeRdF/Mfm7ypwYujl3IdnuW:pNhSsNPqPlMfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565876, "uuid": "733e488d-ce7b-493d-8d06-6dee90e06a58", "value": 126438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565876, "uuid": "5cc93560-4304-4b40-a61c-89ceb2b85a32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565876, "uuid": "54468d4a-20e8-4350-800c-339e776364b9", "value": "245edfe5fd9ed693f1b01f61dd5a5533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21582671-edc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683568362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568362, "uuid": "d1074928-0c30-4555-b6b3-a126ccab76aa", "comment": "Malware payload", "value": "4998ae2034c3ede48292551dd9827caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568362, "uuid": "29c1e185-e739-4208-8e82-513c6aa1610e", "comment": "Malware payload", "value": "d155d0af73b3e86f42672714caa4391ab615c426a3e3fc44a41e4d125a06172a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568362, "uuid": "1f157e5d-7d9e-4eab-8071-c6bda17c78cb", "comment": "Malware payload", "value": "364959b7f2a5b31404ce0443f1bb6b2611129a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568362, "uuid": "2ccb34a2-2755-4fca-a02e-a6a08546f0d2", "comment": "Malware payload", "value": "b9c0e598fa14074bed05891857ef0f9d36134a3e6b82a339fb0d5f78eb831bb1f7f35a6595205a8bff783e84620327f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568362, "uuid": "0b351592-bc3d-4df5-861b-c66d34765c6c", "value": "T1FC073398B1D10DBEE917513ED09A4421D33A2EAD1B32D8EF9F7408A52F83BF06B59351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568362, "uuid": "40bbebf2-7e84-4e46-ab9a-b3e5c9266dd2", "value": "73e11ff6ddd3f1acfa3606a55c6f8a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568362, "uuid": "2a19dac2-16c5-4d41-a5fb-41d49231a194", "value": "393216:wltUS8r6og45gRb8yF71LPCjjgyiEVk/R3x4pbsfIFvXYuLo:wwS8rVg4M8yFpL6HHio4x4pqIRXxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568362, "uuid": "43953043-a254-446f-8a6d-1b331cd1505d", "value": 17475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568362, "uuid": "2fc53ed5-a03f-440a-b36d-adf026db9442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568362, "uuid": "5a664e05-df26-46e5-83fe-28be6d343e6f", "value": "msi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba70be4-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683570339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570339, "uuid": "4a383cb7-fb6e-4cb4-b625-c2c4fae06ab3", "comment": "Malware payload (GuLoader)", "value": "2bc5747794b3dc8c3b5b1a72814bb15a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570339, "uuid": "c1296464-0eb3-43ed-99d9-1eca41832000", "comment": "Malware payload (GuLoader)", "value": "d167c08baf19919551b1731763974baa43a7193cfaf4704d754308d53bdb2b5e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570339, "uuid": "436170b0-b439-4d70-b761-42673eac5fd2", "comment": "Malware payload (GuLoader)", "value": "b8e6402082631c775d686872e4da7fe40614d6c8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570339, "uuid": "6559c53c-88bc-484b-8392-34af4f3d4d83", "comment": "Malware payload (GuLoader)", "value": "a117a7671b8be5d56ed7072e6a9e2a9f4970a9cb26cf8bcbbeaa654de11b371bd28e1745f5a628bfe75b917aa11703c9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570339, "uuid": "0ba8540a-363d-40be-b515-8ece5df55664", "value": "T1E2F2D2628DC51239096712F79A0A0934F87B00FB513528BFAD1DB7798A817187E3F57B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570339, "uuid": "1a63b1d0-4d57-4632-b51e-fb41629745c7", "value": "768:HXue841+3x4KoDRjbQPq62EHeXhsdrayGmibPJQkFYwUZ:HXuW+3512E+X+9LchFLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570339, "uuid": "037d1cdd-e27f-4392-93a9-046bdb62702e", "value": 34665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570339, "uuid": "497e597c-4dff-4b79-8614-775891d6b59e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570339, "uuid": "c085caef-8f75-4a8b-ae29-9fc81d1ce657", "value": "MCC-NEWORDER_73FILE_KEY_323033.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbfd532-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683527337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527337, "uuid": "d31bea17-c135-41f1-93cb-f410dfc4766a", "comment": "Malware payload (RedLineStealer)", "value": "5cdee7459a06038b63e182cda172f3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527337, "uuid": "286d04a9-55c4-45d7-b26d-c7c83e09ea0b", "comment": "Malware payload (RedLineStealer)", "value": "d1867294a81b3772ad1307eac10b78eceecf28210aeaeb7d524efca6515f0f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527337, "uuid": "d95831ea-b48a-4224-965a-93d8ee1d64ca", "comment": "Malware payload (RedLineStealer)", "value": "2ac49d6c0bbf6c527e54f4bc52fbadad1164325c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527337, "uuid": "48dbf364-df86-403d-aa1a-b6d88ca59959", "comment": "Malware payload (RedLineStealer)", "value": "a21380ad9d7c0c2ae8e1c50ea84f7c4e4824c307ff192964d3c078acfd8fcd0f7faa7cb1ce73a1d3bda00efa7a5ecee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527337, "uuid": "904538c9-a9c2-4232-84b2-dfd19eb13708", "value": "T155A40202EAD94173D5B6177018FA07C31A39FDB09D78436F2795A95E0CB2AC8A4B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527337, "uuid": "5549e611-d229-4a8e-a7f9-e4cfb1f487f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527337, "uuid": "f3759760-5d3c-4559-b622-1e75f6f4989b", "value": "12288:EMrOy90d5QihYFyFc6DZl0AQ6mocGwmkYNaIXcyf+x1Vp1:KyY5rYFyFcy0v4X7kYN5o71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527337, "uuid": "3f08e958-6092-4ffe-b610-b008c23abb02", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527337, "uuid": "505b1c8e-5b57-479c-abf7-d0477b2f8708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527337, "uuid": "e0de8cc9-82a9-4fe9-a0ea-0f302eced3ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d852f1-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550621, "uuid": "363c7119-aa53-4545-a346-a771675d3dbd", "comment": "Malware payload (SnakeKeylogger)", "value": "1896f7fd4af2da7e736c622d72a175d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550621, "uuid": "294cc1fa-eb11-41cb-af6c-34e79e26cd30", "comment": "Malware payload (SnakeKeylogger)", "value": "d18cf7fcde053ba33105a836de182859fbfc493eb5185bbaddee1133b9063509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550621, "uuid": "76073873-03ef-446b-a768-868df910488d", "comment": "Malware payload (SnakeKeylogger)", "value": "1eed49a5134ef9dc219404571a22b7e962c511cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550621, "uuid": "7e052540-8874-4e61-9d02-2536bdb29f06", "comment": "Malware payload (SnakeKeylogger)", "value": "d4c1cc182088abd213ed1024a93e5e2452508a0463d5f896d5cc14460d72334f77ab20adc7b1bfae585e2c1d46b95164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550621, "uuid": "0cf395e4-0f5e-45a9-aec5-35262a1e61ac", "value": "T1C2B4010472FA8FA0E5768FF01938B84107B634A759F0D65C0EE551CE6BA6F102BD1B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550621, "uuid": "51591f8a-494d-4c7f-ae7a-dff34dcb1e23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550621, "uuid": "ad03218b-539f-43d2-a2c5-8fc391fc7780", "value": "12288:Td/76fsLWrpyMuj2DE88TqSxAHhmEjDRQcwzh:FdW1Zy2b8+SxABmEuth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550621, "uuid": "65e6bb69-63d8-456f-8158-8af56d5c8284", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550621, "uuid": "e827a9d9-64ce-4fe3-bfe7-bc070ca0ce42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550621, "uuid": "595ca037-d1dc-4ec3-ad53-ae6fad20c215", "value": "Signed Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce74243d-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683504657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504657, "uuid": "4a2bc04b-35b1-49a9-bc57-be5ffde22e0b", "comment": "Malware payload (Mirai)", "value": "a86678e59f3ea7a8e5eb9f615178075b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504657, "uuid": "274bad1f-1afc-4b21-928e-8aff17a1ce8f", "comment": "Malware payload (Mirai)", "value": "d4108d445a1d3cc5cace91c80c691665eea497110698384e24bad1be9ebc56c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504657, "uuid": "2d67eae6-216d-461e-a512-b47530578e47", "comment": "Malware payload (Mirai)", "value": "96c48288ecd3dbbaa41bb907a88ea7daf5d80dba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504657, "uuid": "4129a7c6-b721-4194-8601-75b9846c8389", "comment": "Malware payload (Mirai)", "value": "e2f7371db578ae3dbce4e32e91fce097d6c258cdb6e8cdec3c81aaa91cdcf5fe7a17f40d658500b93e958eb3e63249c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504657, "uuid": "dab8d7a8-e2b2-4771-84ab-d8fb4bf2d4f9", "value": "T115332A21793A2F17C4D4A47A62F74758B2F11A5E66E8CA5EBC730E4FFF20940A4136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504657, "uuid": "6481c1ab-2aac-4b72-b0d9-1f26adca727e", "value": "768:Ncu2or8q9wjNqmIScYRsdgPI8BzUT82EtO+vDIA:eu2c8SwjNqmISnRsdgQ8n2Edh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504657, "uuid": "a1806c70-4b44-4fc5-98b6-626c31bc4a36", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504657, "uuid": "c28f855c-cfc0-488e-977b-c11a1108dbbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504657, "uuid": "d78cac35-ff49-47b4-8bdc-3b60e606a908", "value": "a86678e59f3ea7a8e5eb9f615178075b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc50d2a-edb7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683560730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560730, "uuid": "96669fd4-32f9-42bb-bf5f-32c1a0fc0754", "comment": "Malware payload (AgentTesla)", "value": "a1ad75c823b61b197c47db3878bfa6e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560730, "uuid": "82b7972e-3ef1-4d7a-a83d-11afbd3e953d", "comment": "Malware payload (AgentTesla)", "value": "d4601263f30743332a7f29149b89adb1b59f3b12c38ef70b9c5fe6c7c8a18faf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560730, "uuid": "a633bc2f-b1d9-468e-b6e7-cefbd3e41c9a", "comment": "Malware payload (AgentTesla)", "value": "993e4656aade67e6482b2678de69bf74f4435735", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683560730, "uuid": "344db2f6-cafe-4fd4-b67c-1cf03b4588ac", "comment": "Malware payload (AgentTesla)", "value": "95db3c32138e6c681561e048a2a815f7a60154d38f18c775b8ad4d1ac3941b9b5a34e41ecadc13c2b2dc0686aeeca706", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560730, "uuid": "9b7d6240-c527-4a39-a4d3-385ee50c24ac", "value": "T1EDD4012271D9BF95E83E0BF82818724007B23167A4F4E76D8DA751D82AE6F810745E7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560730, "uuid": "1f9fc27b-0745-468b-af26-10f25f613a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560730, "uuid": "08f009d0-1fef-40df-8868-c2157fb94db7", "value": "12288:BwtjwxH25k2OHf8YZal3AOWmec/7RoiNU3kKVSj5FF:Bw6VqkzkYZanW0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683560730, "uuid": "6d07a09e-653f-41a9-b2fe-4b9c97a00032", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683560730, "uuid": "3a0f66f0-1607-4544-abcf-2b0426b7960a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683560730, "uuid": "393417d6-7703-4655-971f-c2e8a05d32a7", "value": "#MBT-PO-320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b7691b-ed97-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683546948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546948, "uuid": "0f46ad6b-3172-4f1a-ba31-3e887b2e8963", "comment": "Malware payload (GuLoader)", "value": "1bb551eb76c71143df4d5f4824735781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546948, "uuid": "bdf7e91a-564d-4def-b55f-db04092a9d59", "comment": "Malware payload (GuLoader)", "value": "d54645117158603ba561fc062627f335301bfaead5468df13e66b8a7a1f2b45c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546948, "uuid": "13fd18b5-db07-4437-8154-cd643476e19a", "comment": "Malware payload (GuLoader)", "value": "f3f98f163bc31fef9f27ce129eb6a4e470a58792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683546948, "uuid": "d94bb495-85c8-41e4-8165-236bb3fa4e16", "comment": "Malware payload (GuLoader)", "value": "f047fdc63519c1f931bbb21721d4d81a901abc84463dc1fa35536d243c81a811dc758deb42c369cb08a921a4e7efcfc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546948, "uuid": "b790b55c-eb4c-42f2-b77b-8eefeaa5d29e", "value": "T12FB49D9239C965AFDC2F4674031FEAB21BB95CE07392496E4F80360E4C3654A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546948, "uuid": "a29425b1-8fc4-4470-ab23-2447b56755a7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546948, "uuid": "8a9e1d48-fd47-4e4f-86ce-50d8592f2b0c", "value": "12288:xnhe2eyrHk+5UsnVW9dVdxvwoUhZaq21043/cZsTp:BheYDk+5UeWrnxPMaqg3EZsTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683546948, "uuid": "51b13fd8-32e3-4798-9af7-2dc8787353ac", "value": 512830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683546948, "uuid": "27847da6-dae0-4212-b5bc-5bf109621c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683546948, "uuid": "3aac859b-7347-420a-b13b-12e64c03e4a9", "value": "20230464-1000_OFERTA_000001558.0630_001423pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab56602-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683570283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570283, "uuid": "d2f39819-456c-40c6-af06-185efb626f6a", "comment": "Malware payload (SnakeKeylogger)", "value": "b80d0cbf82ce5e7e3ed00a0e671872bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570283, "uuid": "4ef2c77b-8598-4857-82d5-c51e69a464dc", "comment": "Malware payload (SnakeKeylogger)", "value": "d59e0227f0df4944cfa157554ef86a131e2b5d9a1d3983780e0022b98f1d42f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570283, "uuid": "906eb7fa-e0d6-4c57-8dad-ac09f787ee21", "comment": "Malware payload (SnakeKeylogger)", "value": "c4bf9168ee8f5894d543d429dd5c5df0a3984bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570283, "uuid": "057cd933-fdcb-4cb3-9459-97e625f6ebc6", "comment": "Malware payload (SnakeKeylogger)", "value": "5700c7fece3ec3b177a475a1b86bff492868976034d1cabb9b09c6b083e1a8341cd906b43d0e77ba181f7bef24f3cacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570283, "uuid": "40985602-e65f-4e76-9617-98f8622906e7", "value": "T1936512027EC194F2D4621D325E69AB21997C7D201FA8C9EF63D47A2D9E305C0D732BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570283, "uuid": "aa773c3b-02bd-44d2-88db-1d516ef9c267", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570283, "uuid": "d95fa05b-ef07-4ea1-91e7-7e59c18484cd", "value": "24576:DTbBv5rUDwcywHlqk0DfO4AJaFDKvMrBW4ey2Tygt90e+hoxk08:dB1cL09rOYovMr8Maygt+H08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570283, "uuid": "1b90a0d3-8cad-45bc-b0ec-f281f7d7b031", "value": 1458140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570283, "uuid": "21d7767d-ace7-42ce-bad8-2bf8f59a47f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570283, "uuid": "a8b892fd-fa02-4fc8-a173-8a48b72299ce", "value": "N\u00ba 64494.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ee2d08-ed9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683548753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548753, "uuid": "746d2a10-598b-4d06-955e-97dad5c2b68e", "comment": "Malware payload (Amadey)", "value": "3046ee18ca3ecf3655b704c65c595c72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548753, "uuid": "36591e71-f959-4b09-ae17-9cedcf227a63", "comment": "Malware payload (Amadey)", "value": "d5f14b56cd42d5ef42a59c6b1140de0fd19c4f53e6bab07979b941acd30a11e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548753, "uuid": "a35957bc-8a09-433b-bf15-163aced91994", "comment": "Malware payload (Amadey)", "value": "e50c175ca1120e600a0728b3ae771ea9e3ecaa73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548753, "uuid": "e6a74413-ffc7-49a2-9b9d-29d057dec489", "comment": "Malware payload (Amadey)", "value": "d5408cf8440d1371eba1c3de0c71f3ba2d375900cdf907de36892340e86e29095a70c8cb18a0e2e0f7d8c51bd3b74dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548753, "uuid": "ff1cee87-70d3-4aa7-b6e4-3acb177b64e8", "value": "T127A40263A7D88072D8B127B058FB06C31B36BCA1DE38427B3B49695E1CB35C4A476767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548753, "uuid": "a8d0c7f0-0722-44e2-bea4-0190277130aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548753, "uuid": "9fbfc92c-dfd8-4c21-bd1f-53043c3b1742", "value": "6144:KDy+bnr+Cp0yN90QELY/JGHrC3K9HUpQYY1JTz0ZHjxWzTmHEoOJ3t5LxQuqoc:RMrSy904K2GbTz0ZHjx0Tm2tp25oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683548753, "uuid": "c96bbae0-cd08-4972-8454-5abff2690380", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683548753, "uuid": "9494fef5-d8eb-4d22-9339-bd839d875712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548753, "uuid": "0a70d3d9-1e28-403d-9683-0225ee3a0235", "value": "3046ee18ca3ecf3655b704c65c595c72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddf2fe3-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568812, "uuid": "9193114b-3948-4070-a284-08d837a04943", "comment": "Malware payload (Gafgyt)", "value": "b924074a6ff06455dd6e2122df462c59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568812, "uuid": "b7d3fa2f-c8b6-4930-a7a1-c7e902d0c0a3", "comment": "Malware payload (Gafgyt)", "value": "d5fc3a531b433f4de47f6c565f774dc3ff7c98ddd86d51321af466a546451443", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568812, "uuid": "a0b59c1a-0ed6-49ca-a4f6-c679c2869936", "comment": "Malware payload (Gafgyt)", "value": "12653c898832c0131cb7387d81c8caf63a9d61bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568812, "uuid": "a7dcca25-ad92-44f9-8815-d8c452d1f1c1", "comment": "Malware payload (Gafgyt)", "value": "bd7325db93ef18fa5928ddb3030e3fc6add3ab035f973c2162cce17e07ae7c87c66dd068e38ee92ffe675182b47615bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568812, "uuid": "59adc776-f0cb-4e79-9c89-73065bf08a15", "value": "T171C3193B6B270E23C0C9507116E31332B9B9DE5938B943D7AAD07D9C6F3A58834167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568812, "uuid": "b15af82c-dbf3-4c16-9759-acfd5313c953", "value": "1536:ivJm7TYtgc6RhSsN95fftvLItIORdF/Mfm7ypwYujl3IdnuW:pNhSsNPqLlMfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568812, "uuid": "c698c93d-bd33-47b9-8cf8-d79ce3599509", "value": 126438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568812, "uuid": "6dcf9cdb-fd15-47a3-957e-312750f86531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568812, "uuid": "b228be65-e3b8-40cc-bd42-4b39160553b0", "value": "b924074a6ff06455dd6e2122df462c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cf20ae-ed97-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683547024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683547024, "uuid": "ee60a2b0-7a1c-4f95-bd2b-920f409ee2ac", "comment": "Malware payload", "value": "96b4bd468091ed56e227af2ce104a767", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683547024, "uuid": "9a71ac0f-caed-4093-8481-8ad1af3542e4", "comment": "Malware payload", "value": "d66aac16d486b19ad92f0aea804d547eb8a91e640c4dc052877793873ff4af67", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683547024, "uuid": "f8808797-aa2a-4843-8f3b-36e2b59b12fc", "comment": "Malware payload", "value": "cb894948cfef4d4156e44ea1ef545a67e10b852f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683547024, "uuid": "39ed3ccc-0cb8-44ec-9702-7e6cb03e8798", "comment": "Malware payload", "value": "51314cd604abd04580435230cc16cfc7138e35f90a580b8d8b328b5464f73a6f4cbe8beb97ad00ddcebb767fdfc710f5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683547024, "uuid": "16a46703-a00f-44f0-b9b2-76931aa2f7f9", "value": "T1C2672265F7DBCA26C7B75239467D2D3316268CD942C39687190B3A280473FF84B46ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683547024, "uuid": "0e0586ad-cb66-411f-8c07-968aac08f7ea", "value": "786432:/CMOGaxTSgdRVEPsfQJxkCntKous2UwmLq0wFBJ:m2gPdkkCntKous2ULq0AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683547024, "uuid": "cfe11f12-fd33-435f-9020-7d54a76a5ba7", "value": 31851129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683547024, "uuid": "01d39067-8434-4f54-bda7-b39251a8b6ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683547024, "uuid": "8d95fe94-ec9b-4dd6-808a-c0c395b60126", "value": "metamask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d30f45-ede7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683581518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683581518, "uuid": "f0b962ab-2940-46d9-b949-55c36005347f", "comment": "Malware payload (AgentTesla)", "value": "a1908cdb9030b9c90424a139981a5ccc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683581518, "uuid": "619ba4f7-99c5-4f1e-be1a-ca326320872c", "comment": "Malware payload (AgentTesla)", "value": "d67557fd37174016e188f4e3932341f74c0a79ade0a34fbffc190e91b9e5a0e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683581518, "uuid": "98bbfcde-e25d-4eb3-979f-46cb0e54cf9a", "comment": "Malware payload (AgentTesla)", "value": "487090616098379bc4ce42130891e15bedcd748a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683581518, "uuid": "4bab75ac-8afa-4086-aca2-b14483fb0b41", "comment": "Malware payload (AgentTesla)", "value": "cb817becf652a1903c5e80180e1c8af9e3dd2c658e9b46c7d55b6c70141405947bc3754972b60503a5453ac81ecfce4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683581518, "uuid": "5cfc3fef-7ae5-4a1c-af6e-7a06e08d6092", "value": "T11225D53C18FC3622C1B5EAF2DB94E561FBC0859276358DDE5AD6408616EF90236CBC2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683581518, "uuid": "37c56cc3-c2c8-4365-9642-695747a79dc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683581518, "uuid": "230fb0ee-9453-4c95-b6da-c7fb0e5ceb90", "value": "24576:fPf9F8/brcpepwRDNrZkzU1qvzZToQYJ:wXcplLb1Yz/YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683581518, "uuid": "c597bef9-1684-4cf1-a7f1-b032fbbd05b3", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683581518, "uuid": "cbf79faa-f590-44f4-8cd0-2768d935b0e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683581518, "uuid": "0a12ca58-2854-47aa-8f58-008304c4d7a6", "value": "70913520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff138c8-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534241, "uuid": "64a0405a-0d34-445b-8e08-4dd38485cb87", "comment": "Malware payload (SnakeKeylogger)", "value": "8acfcea0026a2d49f39db27fb7bd6efc", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534241, "uuid": "ee178c56-4615-42c0-b30a-ea2b78b7dcf4", "comment": "Malware payload (SnakeKeylogger)", "value": "d82034c5d5633ff4f38939fd15a82c3612886742e8bedf4060fdb2129c09aacb", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534241, "uuid": "36b39e96-47a5-4625-81c3-338a1cfd001e", "comment": "Malware payload (SnakeKeylogger)", "value": "d8050f59f21df56233c8a8d60ae71e12041efb10", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534241, "uuid": "da7d89ab-a9dc-4695-b837-0b7e74366d20", "comment": "Malware payload (SnakeKeylogger)", "value": "c088356925a499ecab75bc8704d3a5cc6818ffbeec8b956f17ca743184fe3ce313af76d7989c056065d02e4c595039ae", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534241, "uuid": "9a85c2a5-0dd0-40b0-9541-bbb5404df3f1", "value": "T129B412A0B1F9CA67E91E89F4263C7540137271B3A5C1EBD85F2925894FF7B005E4889F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534241, "uuid": "9aeffed9-f5f6-4723-806d-e38f02c899f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534241, "uuid": "f3e2ce96-9be5-47ee-96ea-0ad4be8b7b43", "value": "6144:Ykz9Cie9gbdpEUZ7eq+GzOTl12tXZv1cJmA5Wy9Eq9FkIo+oaf53kjs4YRISyA/Q:PRNnboGfNcz5Wy9B3eaWjs7isDxKpPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534241, "uuid": "dc08d362-5d7b-45f4-a1b7-4824bf0e1c10", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534241, "uuid": "167d2de8-ce2b-4026-a61d-4ee15ed42d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534241, "uuid": "b1b0e310-53c5-4430-86ea-0310b070cc7f", "value": "Recibo de transferenc\u00eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f258ce-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683578026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578026, "uuid": "09e61922-c751-4821-8b8a-a6621fda4fdb", "comment": "Malware payload (AgentTesla)", "value": "3d54b88bf2b6bcd1126ef4eb20d9e9f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578026, "uuid": "f7ad9d3c-d479-4b84-b9ab-59d7d1967eb5", "comment": "Malware payload (AgentTesla)", "value": "d9577a11fb93cf09c220f70d087e55eb4c7c5fed0537aebd8013e7e01a8d5d15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578026, "uuid": "ccc079e7-ae86-4caf-b14f-733b3c8c70f4", "comment": "Malware payload (AgentTesla)", "value": "1fe4483c54fa7da0ea4ee769a36d8717da12e0d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578026, "uuid": "1d974543-1d37-4f47-ac05-8c71c4fdb065", "comment": "Malware payload (AgentTesla)", "value": "3a1c224d8468868e847e5721ccbf27891fb8078702826860794bc3fd3bd988ec07d5b1803e1d22dac671375b16570caf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578026, "uuid": "edcbed27-f2a1-4352-9bdc-20b560fc3eb0", "value": "T1C393B162A3ED5108F2F33F50B9FD65214A3BFEE99C36C94D428456AD46A2940DCB1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578026, "uuid": "724391af-0942-4f11-9638-9f60fbfb7b12", "value": "768:mnHGdUBDCKtfYjE3Luo4+eaWZxidnOk9p0YFPk9Wai2Y:OHGd+CKtfSo4+sxidnOk9p0YFNai2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578026, "uuid": "f1c16750-1ee2-47f0-a13b-4772fa0f4a2b", "value": 95044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578026, "uuid": "9bc6c9e4-8c99-402d-b523-4b5ae64f130b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578026, "uuid": "1ad84e6a-6596-4bbe-b426-042bceca0773", "value": "droidddxxxPayload.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e338ffd-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Autorun)", "timestamp": 1683516468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516468, "uuid": "a4addb97-319e-4962-9232-bf3eac3280b2", "comment": "Malware payload (Autorun)", "value": "a9fbffb01fce87079637c0bbc225dcfa", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516468, "uuid": "2615e0e3-1268-47c6-a8e8-b106280e816f", "comment": "Malware payload (Autorun)", "value": "da3ff4dab527f1cad77282509e3056240880d4e0aacb1fb3df8fe15d95dd7e58", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516468, "uuid": "7f634c3e-28f7-4eeb-8c8f-21c09da915e2", "comment": "Malware payload (Autorun)", "value": "3f9e2dce5534a9a93e3aef5d1f88cbe8a68581ec", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516468, "uuid": "e7bec549-9782-4ea2-9d64-1297c29f0ed1", "comment": "Malware payload (Autorun)", "value": "70047af50004e280ac611df3d23b062031e822d410f204012f0534d6acae41327d1e263708d652b3ced0c0b22cad517b", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516468, "uuid": "aee3b4ff-598c-4749-aef1-ffe8792c7ce8", "value": "T10AC55C64E610D8BAF3D5E978640E7F290CE17D160BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516468, "uuid": "0a2fec16-f60d-40a4-8622-844030762b3f", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516468, "uuid": "92c0cf85-a13a-4240-9034-292fad451e58", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCe:eEtl9mRda12sX7hKB8NIyXbacAfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516468, "uuid": "e9e6e22f-84ee-4dab-b4bd-33828ba0ffcc", "value": 2565421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516468, "uuid": "04dbe601-9a3c-4b9e-b403-2b15a1e1ecdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516468, "uuid": "d5402993-7bcd-4d58-a12d-d07f66dab413", "value": "2023-05-07_a9fbffb01fce87079637c0bbc225dcfa_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31783399-edc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683566671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566671, "uuid": "0bcfdcfb-2180-49fc-a672-6ee782438af7", "comment": "Malware payload (Mirai)", "value": "1614173ac0287d645cd6eb1851c0d840", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566671, "uuid": "07b20c97-cf7d-4f15-a41f-503d87135b1c", "comment": "Malware payload (Mirai)", "value": "da9c35337e4411d969573ef09c6d7bfb31746ccb541f8672077c3b2f9e2de71d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566671, "uuid": "aa119e38-87c6-478f-af2e-215f49b0e608", "comment": "Malware payload (Mirai)", "value": "20f36a97332e66df06574802956e4b361d2c4f50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683566671, "uuid": "5197cc65-5e71-43c0-80e2-e11627218807", "comment": "Malware payload (Mirai)", "value": "cb212f7082d1c66fdfdf3ab8c2e9e95c92514c27a33c41bbab2900d30b85e5b4a722871d812a1e71d7793487ab7822ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566671, "uuid": "6dd9c353-4ea2-4ac7-a03e-edc8651516fd", "value": "T1C2F2F17159369C978B2008F1FFE9423A2F2603FC925E78A387105554BFB905226FA6F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566671, "uuid": "b67ed397-71bc-4a35-b95f-382258afe5d2", "value": "768:kaZaZqJH0UNLIfJzQJi372HsOtyHpJddkW7JzmLYS9q3UELe:ka8ZqK2kfJzQA37UsEiz6wLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683566671, "uuid": "4fdbaad8-7d13-445b-97dc-faf1a3b602ff", "value": 36884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683566671, "uuid": "3890e195-efc5-45cb-895f-c469440f6161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683566671, "uuid": "3c8943ac-395d-4c7b-9ed9-c8ce58255ef1", "value": "1614173ac0287d645cd6eb1851c0d840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d18520-ed82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683537897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537897, "uuid": "3d9cf62f-4a95-4721-94ca-d347a7f8d902", "comment": "Malware payload (Formbook)", "value": "82b1bafde162e92debdc5bd256c3a535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537897, "uuid": "dbf350d0-d71e-4340-b5d6-baf62f8e24fd", "comment": "Malware payload (Formbook)", "value": "db18c2ea53e693b3fa16b5c6ca9512c359f657e2f0ea2cbd462ad17d99da2ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537897, "uuid": "e10cbec6-daa2-46a1-a76a-05e3536e8246", "comment": "Malware payload (Formbook)", "value": "5c431b67d0004292a8b744d7c931a2928ece7f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537897, "uuid": "bcdb9bba-1bf9-4e55-94f6-fd910312ac28", "comment": "Malware payload (Formbook)", "value": "2102f319858e924d722beb3dc462dbe07e2b5c5492c51f3c5a732ec8f2c8c54119605304de323370bc9ba84c0e3c1511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537897, "uuid": "5a48d11d-122f-483d-9e58-4e9fbe45edc3", "value": "T1B344120467F0C067D9835EF1067E3266EBE6D52228F2770B4B682E1DBD25682DD0F366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537897, "uuid": "3341f7d5-5a89-47e4-bb53-22fd2e12d7ba", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537897, "uuid": "0ecb91a2-ad97-4118-b893-d70f8d19a0b3", "value": "6144:vYa660oTSp9Yxw/CQfi9Fq5q+GqS1U+kVg/4r3n:vY00oTE9YuxvGI+4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683537897, "uuid": "a32dbc41-4fbd-4d06-a22a-1871f4201331", "value": 254789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683537897, "uuid": "2e338a0d-87f3-44ad-a3d5-d4001979b3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537897, "uuid": "20d5377a-67b1-4511-bef0-4fb90713aeb9", "value": "Original Shipping Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45512db-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683527350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527350, "uuid": "bb28f840-cca2-41de-a2d0-690b394729b4", "comment": "Malware payload (SnakeKeylogger)", "value": "e0b51bd56adae5fc4b405bb879fa7879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527350, "uuid": "9b3b4e31-5824-4759-867d-46d0b48bae4c", "comment": "Malware payload (SnakeKeylogger)", "value": "dc5d1afb2584bade5caff58e4e153c22ec7a52cdbac6c1b56d289b0621c98b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527350, "uuid": "6fddadf8-326e-44f6-9c75-0f40aec2af9d", "comment": "Malware payload (SnakeKeylogger)", "value": "6fc1e60cb65e1d475d7b35d46e4d7d420c41bef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527350, "uuid": "30835685-565e-43a4-8ae7-713f7168016b", "comment": "Malware payload (SnakeKeylogger)", "value": "2775b83ee0c6c8d9c3dee36b3037b17e50a6cc690892df6863b4aa8bfc807406033e555f783d6810e1f5f53408261e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527350, "uuid": "21da0e03-38f1-437c-bd2e-84a97db8d214", "value": "T165B412A073B9C9E7F81988F81938B6502370709795C1C7E82FB7648D5FFAB101E44A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527350, "uuid": "fa1bb505-6423-46e0-891c-c8e6fe51ad9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527350, "uuid": "d46bca5d-97bc-4a86-b610-8bf623da53d5", "value": "12288:mn1kdEg3kfkF7IzplXICUOOWFcx8TCpUF4YVt:m1kZJUlXHUO60y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527350, "uuid": "644a48ae-daa4-4684-9319-5b03724133b5", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527350, "uuid": "3ca6ddc7-733c-4eb1-84ab-458105480040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527350, "uuid": "e7496c9e-e57f-4af4-89bc-85f1609e364f", "value": "ryLW7Je0Vr7vB0eh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181b7f2f-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568776, "uuid": "6d0ffd15-1d01-4744-a2de-ead203255fd7", "comment": "Malware payload (Gafgyt)", "value": "7c6dea5873a6391b359acc4c53bb99b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568776, "uuid": "c23e57fc-c404-4890-99ee-15f769778a02", "comment": "Malware payload (Gafgyt)", "value": "dc87ea7e42d469b52cc28f78b9b45b0c974f19f25484c0f84fb6abe95b593564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568776, "uuid": "d39eb95a-bc65-4453-9e80-381bd07fdb14", "comment": "Malware payload (Gafgyt)", "value": "60dbb295139360c8032ba127913e4bf2fc612512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568776, "uuid": "00b67d9c-af6f-46fb-ad30-d3d70c0aee58", "comment": "Malware payload (Gafgyt)", "value": "3e2d41d12261bfd40d0a010ea00a9b272a2be8d351f08194a279c393c7cf6989cb0c3f20c59007e1f91bda1ebc3f0b31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568776, "uuid": "21c635ef-3463-4e46-8361-c696df0c8225", "value": "T198B31792F900DFF2F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568776, "uuid": "e817df28-798d-4c35-a483-8a2d75d120b9", "value": "3072:mp+3MNBCpCTyRQpimmrytKSs4OWlKhRm2pgYMx3IPtW:m+CTyRQuytXseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568776, "uuid": "36d0beb2-e2aa-4ecf-aac9-3e9af8638f5e", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568776, "uuid": "57ab6110-29c7-408c-ba02-821b353719b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568776, "uuid": "0d4973ee-fcdb-4bed-9932-999a536aae92", "value": "7c6dea5873a6391b359acc4c53bb99b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98ffbfb-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528701, "uuid": "8ad3bb05-1aeb-4277-a4b6-81001be6941c", "comment": "Malware payload (Mirai)", "value": "f570d3d7bd77f974b02de2b368f56785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528701, "uuid": "d54e7347-bd54-4069-9e02-9852e1debcb6", "comment": "Malware payload (Mirai)", "value": "dd0f8bdabe8057ddc9705c740aa246a0bdc04480368d1ab60d4c7bc5efb8bbfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528701, "uuid": "8ce2555a-f1b0-4605-9f5d-a8360c16b584", "comment": "Malware payload (Mirai)", "value": "b7b1d940f7e80146596117e1a2ceb0a25eec1af2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528701, "uuid": "bd593204-64a6-4270-9b32-40c1d7faeacb", "comment": "Malware payload (Mirai)", "value": "73b0a587211a4e029cf7cc0fe9b4e3b82f3890f99a3a8317b60db235bb65f7fa028d6ebacb0b8ea0cc9f137eca258f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528701, "uuid": "0a5249d8-74bb-4da1-aaa9-474d4645fe02", "value": "T101438D37E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528701, "uuid": "fac3b33b-6e2e-459a-ab75-e408f03733da", "value": "1536:Vaa0brW/Od9hlCR3KE/KYXwKEpPDCMC2+Wg:Vv0brWGd9X5EiYypPDL+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528701, "uuid": "ecde4853-82a6-474f-8a4f-96c7738a1421", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528701, "uuid": "aedbc311-720a-4469-ae31-5c10b6fb79e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528701, "uuid": "fcf48ea1-88d9-41e1-925a-e7548891dd06", "value": "f570d3d7bd77f974b02de2b368f56785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd94331d-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528681, "uuid": "1897b9ae-b09a-4c56-b21d-0386cb66c7a6", "comment": "Malware payload (Mirai)", "value": "452efe98097eead33bbc5a60606b2a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528681, "uuid": "aa54598e-d2da-4e27-beb3-ac4fe06fc2bd", "comment": "Malware payload (Mirai)", "value": "de1d975edb0141983d134664344aa57a234f996c8fe34a7801e78bd87886d6e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528681, "uuid": "37fc9761-5942-472d-8fd3-f13292a385f1", "comment": "Malware payload (Mirai)", "value": "e932ecd10ca0bdb5be693dada9f0aa7287716673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528681, "uuid": "1706de62-c272-4ef5-a4b2-66b97930f5bd", "comment": "Malware payload (Mirai)", "value": "e758803d941c03d4a892298edb9090e420b17f3118e6404378062e9d07fb6e44e5951554273e93ccad818014f2c0a708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528681, "uuid": "ea126137-4423-4c6f-8cc8-a3c0179e95f0", "value": "T10883A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528681, "uuid": "2619c88f-ae36-4b31-a920-8884dc76c1fc", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTYV7ZDYovZ73x/nL8y8M:Rakdn2Eo3ePu5GTYVRYo99Be037W0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528681, "uuid": "ca89d940-1368-49c2-9eba-b30d94b393d8", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528681, "uuid": "6eea1fe8-1730-478e-99f9-ebf518a0ee1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528681, "uuid": "833d0e67-61c0-4b63-8403-877a706ba68a", "value": "452efe98097eead33bbc5a60606b2a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752dd47f-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683534143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534143, "uuid": "abe0c58b-eff6-4f99-b0b2-683e368a25a9", "comment": "Malware payload (CoinMiner)", "value": "81cf99b843a80b9a52e7405999e78889", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534143, "uuid": "9fcfdfe9-bfc1-4b6b-a344-bee0e7c869e9", "comment": "Malware payload (CoinMiner)", "value": "df35ae0d0b0981dcee4616fc5f7e5fa69d6d2b73cbd500fb9950eb0bbaabdc74", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534143, "uuid": "cb1169cf-d6fc-4c01-889f-cee6b60b1f64", "comment": "Malware payload (CoinMiner)", "value": "2dbc3623994dd079b6caf63dfc70fcab5b1f3892", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534143, "uuid": "e541dd07-567b-4fde-8522-31ae44714b6d", "comment": "Malware payload (CoinMiner)", "value": "da3447e0028a39ec734c93a69c72f2549ffb91dc35ea9cbcfd1f217b16db65c42356663611bba149fb1d06a4727574dc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534143, "uuid": "ddf6971d-f00c-4b26-8474-1b0d18d71dad", "value": "T1A3B45B2C7294DBAEDADBC8FF19C884E09699087E077F74219F99558F85223902DC84FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534143, "uuid": "423a1e15-659c-4a2b-a45f-28e0928f38d2", "value": "46582683e79e897ced5eb8a1828704b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534143, "uuid": "933797db-4978-4a4b-9093-51a1611e883a", "value": "6144:V3/ifgZI7kn3DhRjY3LZWyj3LWc36IDvmua/WqOld00BVHKk3bQF1:V3/ifaI4n31RjYt2IDuua+HlG0B96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534143, "uuid": "70878465-1459-4257-b59a-f87f49515bf9", "value": 507488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534143, "uuid": "a9b1a2aa-05ad-4a1f-887a-b1e4e1cc6d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534143, "uuid": "5787fa14-772c-4d67-9ce1-29867e5040a3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562b6a4b-ed94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683545687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545687, "uuid": "4cf6b4be-4a5e-4385-84e6-3324cd86c35c", "comment": "Malware payload (AgentTesla)", "value": "f71d91fa9c5b56f892d1db15fb2f846b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545687, "uuid": "a22629b7-e959-4d42-a5cb-e36ef043d5af", "comment": "Malware payload (AgentTesla)", "value": "df4865204f2a95edd8ec606aa34b61932584193dd64c7670f4cb6ccf44c16c42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545687, "uuid": "01d47860-fc93-4949-9b60-4a1b4262fa1a", "comment": "Malware payload (AgentTesla)", "value": "6814f18b2d977ce7284f8cdf77d67b3471fcd36e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683545687, "uuid": "c70bf95f-4455-4a4d-a1c2-1b561b833dcd", "comment": "Malware payload (AgentTesla)", "value": "43f28fc47d7148299f22dbd62d2e9a54c1e3f998e9ba7917c302d280cebc4fb0ff78eb962270478e17628e2b947ed0bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545687, "uuid": "e36a9ed5-ad71-4fc3-ae40-b7afaecb56c9", "value": "T11EC4EF97B2A9BDABE03948F41568B25032F17F8332D0F6B41D6272445AF7B0D0A77A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545687, "uuid": "6544b0d5-6301-45be-a573-30e33880d56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545687, "uuid": "8dd2fef6-50ae-4c35-8791-c0f24c5d6787", "value": "12288:e2aTU8g1EUVCxVeTjXHBmqeSFfLJKwuycpgud0Ht7c9z/Y:e+5s3ERmqe8tKw3axKNY9z/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683545687, "uuid": "cd5049d1-729d-41bb-a7af-6ba3ac1ffbfc", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683545687, "uuid": "b66c3346-4990-4da0-b151-e6385553c7d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683545687, "uuid": "4ea54138-5b40-4717-97a5-16a19047f2bd", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1a9587-ed34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683504680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504680, "uuid": "f8d1996f-d29a-4f75-a85d-508d3aeda5ba", "comment": "Malware payload (AgentTesla)", "value": "77033e1ede922aa0962e181122d8332a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504680, "uuid": "14db42bc-0f85-4f33-a9e6-0d165335cfc7", "comment": "Malware payload (AgentTesla)", "value": "dfa3a339379ee6ce3bbd7730207cce6f1ad6f88e8c4f3ff7dc300cfe28da0a6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504680, "uuid": "587aa791-0099-4a07-a728-dc9ef186b2d5", "comment": "Malware payload (AgentTesla)", "value": "5dbc3e08ca03e7322c12851563b90ac014c2a03c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683504680, "uuid": "ff62e34a-d628-4663-b018-ab02ba6845e0", "comment": "Malware payload (AgentTesla)", "value": "e2f728a8670dc1f2b9563b23c84580c5f8b3ba6b097777a72cd04408d9b5e4a38adfbe6c7190f524e6aed1b388789bfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504680, "uuid": "578dce64-b99b-4d3a-becc-c3449badf540", "value": "T19F44121067F1DA1FCD921371563F86002F68E4229E769B8F67141B4CB926BA1EA0DB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504680, "uuid": "3da4719b-c68a-4bf6-a75c-1ccf1c5fc59a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504680, "uuid": "f1903686-fcda-4b08-beb5-33495389992f", "value": "6144:/Ya6BYXauFZMFb1MdZcybZEbKm8Itb98AE41pwTbnbwA:/YTruFmlvnLb98Q1OHwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683504680, "uuid": "7c1a68fd-fc3a-45ab-9416-8cd0446bba8e", "value": 275510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683504680, "uuid": "b7d8f6f3-1dbe-4840-8f1b-b532abce44c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683504680, "uuid": "1cabf87b-4326-46d2-ade8-ed9ef6ee08b0", "value": "77033e1ede922aa0962e181122d8332a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a529370f-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534223, "uuid": "8ad2f6ba-3354-4bd0-b660-79aac6ffb289", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d7bb065d0af85e5053a1109b8ee034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534223, "uuid": "79d5147d-a2b4-4f59-88e6-696e4e0b7f5e", "comment": "Malware payload (SnakeKeylogger)", "value": "dfb1e4b77bceb4aa51ca6e7f79785f573cdfa9d047bf38717926730be7f85026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534223, "uuid": "763690ab-96cf-4ee8-981f-219147baa55d", "comment": "Malware payload (SnakeKeylogger)", "value": "a1fa795b7f358176dee67fc0f8cb8416742b8d8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534223, "uuid": "218e07f3-7057-48ca-acd1-21d4aa973d0a", "comment": "Malware payload (SnakeKeylogger)", "value": "8e4069913d34e21293f4a3b782e15674344b6e33059add43a76a5e815eb78c405bded7360be85618687b1dc0f8cca5d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534223, "uuid": "7e7c6f40-812c-486a-ba27-b59f078a4af7", "value": "T178B40190F1FACAA3D91E8AF45A2874500372759391C1D3D84E25A7492BEAF0CDF4C9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534223, "uuid": "8d8261ff-fd78-4d9a-b540-e1738f82b0fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534223, "uuid": "4ed41bc2-6bd0-41a0-8ce5-cb5736bd1f48", "value": "12288:8wQ/6u4T/uDZ1D425kqtSCwqEXm3FvAdTJ:89T4T/W1c2WqUX23FvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534223, "uuid": "872fce94-235b-445a-9e9d-89315feb7d86", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534223, "uuid": "02ad8599-4143-4d7b-af9b-9ba0b8e199f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534223, "uuid": "c94a83fb-71d6-41b5-8cf0-49ea10f8428f", "value": "ti\u0307cari\u0307 fatura0852023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1069af-ed5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683522075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522075, "uuid": "9870d35c-42a6-403c-a807-1b60ba8eec80", "comment": "Malware payload (Gafgyt)", "value": "5e8e751259ce5c7f6ce90ecba4b8d1b5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522075, "uuid": "5ac01d06-a7a0-4b67-a023-84b65135f5d0", "comment": "Malware payload (Gafgyt)", "value": "e0b4099f319b0ed63b2b20a29f73423c256f6dcc18b27ff6477632093d3f0a67", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522075, "uuid": "36c455ab-7d26-461c-91fa-f1a9286bc6fc", "comment": "Malware payload (Gafgyt)", "value": "ae3d053340452eac3a8da907910bfc750f42e624", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683522075, "uuid": "355dab36-c984-4ad2-ac4c-85400dfbb03b", "comment": "Malware payload (Gafgyt)", "value": "ba2f16711af1e6eac6ca61fbbefe7f948b10a53b7014cb19ebe8a2d5da30413c379c2e4af3c5d02c0a4c4f39fa09c9d5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522075, "uuid": "79489076-5e62-4a2c-a712-b27293135127", "value": "T18DC2D11E02152CF2C82BE9BE236F0B615D7947BB5608BC0F6A19B5D98E104BDA4C7AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522075, "uuid": "b0f05b82-e85d-4529-9187-674bad7bec51", "value": "768:7MsHA7+wJhwwqgXHbeviLr4TvvVZqWYNq0JgGlzDpxYsuLxd5a7U:YKA7Vhj7bWmkhZqIsVrYjxa7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683522075, "uuid": "13efdefa-1978-4b95-910e-e319386fcdb2", "value": 26756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683522075, "uuid": "a59a87e6-0480-41f4-96d1-0534cc831c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683522075, "uuid": "d1c8edf0-df1e-494c-aa8b-69258d96ad36", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245db31d-ed78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PryntStealer)", "timestamp": 1683533578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533578, "uuid": "433db9b9-eb07-4cf5-a253-debc8024af7e", "comment": "Malware payload (PryntStealer)", "value": "a28038e031eeff1996f7b0040ba40487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533578, "uuid": "e2112ecf-c7ab-46bf-890c-9f208d021e53", "comment": "Malware payload (PryntStealer)", "value": "e1c703f3c6da6029076e959d500aed7d9f104d258d22381eafc8fd8b9ebdae00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533578, "uuid": "9283c57f-58b8-4ba6-b939-9de11ff4b42c", "comment": "Malware payload (PryntStealer)", "value": "fe80c042e5b20cd00f90cdcab9ff4479a49bcd5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683533578, "uuid": "9529f19a-fc91-4a5d-ba32-a6ef065ef976", "comment": "Malware payload (PryntStealer)", "value": "cc2ac9e8dd92add6d5edafe5e2716f3346487a4f228eed21d2c8ee4aaed0edf1e03b6b9fe34abd36e8b1ff93cdf3f10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533578, "uuid": "0adcbce1-c9a7-4605-86a4-584584ab9807", "value": "T17FE33A247BD88A24F2BEAF7494F211218A71E427B515CA4F0DF928E90FA57809511FFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533578, "uuid": "4a438afa-17bb-484a-8ccc-630b17f660b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533578, "uuid": "a38f2e3f-695c-4263-bf5a-71b4798461e1", "value": "3072:G3YO5kKdXRRurjsL/Tuny9b34GZIKRWpgH3pf2z:qYOV+sTTgy9boLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683533578, "uuid": "338d8246-630e-40b1-ac28-42da3cea04a4", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683533578, "uuid": "fd4a4e09-8d4d-4283-b394-42e4f2b9f5cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683533578, "uuid": "b20cb4ed-ad97-4fda-a198-035ff80d8f45", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67057f94-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683534548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534548, "uuid": "090e0f51-dc1c-4915-ae48-92b14d826521", "comment": "Malware payload (zgRAT)", "value": "dc9e083b29898ecae1c5c71f9c15833d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534548, "uuid": "c5ac6d4d-d057-4014-977b-f0b0a9c7268d", "comment": "Malware payload (zgRAT)", "value": "e2b0b8c5fe219a1b655d2d064b670b8d0b9347f74602c5528ec47d1b22d06717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534548, "uuid": "1e8b16bb-6393-4770-bf7d-a8c3af6f6dc4", "comment": "Malware payload (zgRAT)", "value": "f99a51a5f3f95280a6ffe0e0c919859c965cce0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534548, "uuid": "9b0ee110-6d7c-4a4b-bdb9-c7d997a09aa8", "comment": "Malware payload (zgRAT)", "value": "ac4e087544bc43ec4abbe014b20706e134d71fde87998b51affd1300622dda43c29a571e4c77c47d979b9d56b322ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534548, "uuid": "b2ae917d-0257-43cc-90be-f82089c041aa", "value": "T12534D0063BB25601D90D6A70D1EB413413F2E7C73677DB893A8C139A0E127DDAECA799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534548, "uuid": "25898354-d1ea-4b0f-a73d-c5048bc4f47f", "value": "6144:XsoN68IOwGpg+0Vcunn6oloqzOmN4aJ6GD+E92Bn4:8ok8IOwGeV163qzOm6anD+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534548, "uuid": "792ea614-b052-4812-95a8-a902a5aaec92", "value": 247368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534548, "uuid": "ac2916a0-b763-4bb3-aae2-3bb59aad1d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534548, "uuid": "c6510eed-060e-42a9-bc97-5de9756109ee", "value": "ZiraatBankasiSwiftMesaji08052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bcbeec-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550305, "uuid": "f0dd0df5-9880-424b-9709-f1502297fa2e", "comment": "Malware payload (SnakeKeylogger)", "value": "925f7f92d3a487348676b3b83c65c4ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550305, "uuid": "70febacd-4e45-4c62-95d4-846315de6041", "comment": "Malware payload (SnakeKeylogger)", "value": "e30555e8b658827feff626d722c97c1239ae48ace30f9dea89172d476f569582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550305, "uuid": "f0a2ea5b-b5e0-4087-813e-5941da610fa2", "comment": "Malware payload (SnakeKeylogger)", "value": "a95d8c3ccfce5695c5a1a9c91c13c94b2fd6ee2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550305, "uuid": "45be7347-6405-436e-8b05-acf3de0ce97c", "comment": "Malware payload (SnakeKeylogger)", "value": "e9952ce3f34dc6a8e5854ee51fa667b7e386086daff3c8bf2347f34a483910b32154bb130d6c7e1f966eb84d5ab506fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550305, "uuid": "33f203a9-2ea6-4f49-b4e2-eeb2051c7bb6", "value": "T1886512027ED290F2C5A31E31496AAB21AA7CBD211F68899F73D4796DDE300C0D735BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550305, "uuid": "4b5268a5-f415-4f03-9002-91cf7b2b636d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550305, "uuid": "18d0c9ac-538b-4600-8af3-cfad615bc9ac", "value": "24576:DTbBv5rUDwcywRZxYGN2NPDKvMrBW4ey2Tygt90e+hoxkOR5pF:dB1cLz+GN2NevMr8Maygt+HYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550305, "uuid": "03bdba93-b91d-4ef9-95b8-3b4917bdb196", "value": 1460221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550305, "uuid": "f7be01f1-bd52-406a-b08a-81a0bd1cf67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550305, "uuid": "1315a157-8a99-41df-9877-e324e1b02045", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b60323b-edbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683562822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562822, "uuid": "e650171e-5d87-433a-8816-a062f29fab8f", "comment": "Malware payload (AsyncRAT)", "value": "57e2bc8139286c9c5e8b34efe9f3a762", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562822, "uuid": "97bb021f-a9e1-407e-a772-ec53a50bf7d8", "comment": "Malware payload (AsyncRAT)", "value": "e33ad76851f23305a18b0db3a98c45280c581505da95f701e265a8479713c3ff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562822, "uuid": "15140b4f-050f-41f4-a6c2-9a5594ab25bb", "comment": "Malware payload (AsyncRAT)", "value": "37ee61c9ddc1f81ae024ad465eaa6a745c07dbf3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683562822, "uuid": "e51f8f28-6404-4d21-a105-70e06473b76c", "comment": "Malware payload (AsyncRAT)", "value": "5c2094667cc46d4f944a0b8a71197bcee83ad0b471b20524a0739bb998767573dccca83afb2597b1a6862c87d2feeedd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562822, "uuid": "9cef2c5a-dd72-41d3-8aa9-0479b544941c", "value": "T13125394BBCA044B9D0A9D23189B651917B31B8991B3227D73F50B2BC2FB2BD85F39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562822, "uuid": "6d6ca270-5ef1-4ae8-963e-0167c1dce428", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562822, "uuid": "cdb572da-c90c-4086-a0f2-d3d9165ba834", "value": "12288:s4mT/RcXtvyJdBQhXVQppDv4alnZqby13caYgd2DHs:s4C/6XtvWBmQppTggcaYgd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683562822, "uuid": "d1fc806c-46fe-406f-a312-6528721ed37b", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683562822, "uuid": "a22a7ba7-3e95-403a-9ac6-89dfc8392e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683562822, "uuid": "9265322f-22ad-466d-a616-6e157955ade1", "value": "RFQ# 6000163267.IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b33f3ff-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534072, "uuid": "d33aada0-ce82-4c85-873e-f77a5859fe82", "comment": "Malware payload (SnakeKeylogger)", "value": "10dc3c76d29fb969b5b68b912b66b16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534072, "uuid": "5726ff07-3d23-4472-b80e-7b4d1230c8da", "comment": "Malware payload (SnakeKeylogger)", "value": "e41b0a6b4bcbd587687a7d0fb61fad61a4540df2b09bee9c19f2dccb1478e554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534072, "uuid": "8142e2b3-e685-4fcb-9bab-c55c04006802", "comment": "Malware payload (SnakeKeylogger)", "value": "0d3f98e0bc89a0302f906cf6289e8e2160583f21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534072, "uuid": "43dd6ff3-20df-498b-8351-b8e1906a2e4c", "comment": "Malware payload (SnakeKeylogger)", "value": "d4fd1c4e549fec75afab54b962c723b1b783c0bc8a486ea1262858b07c7d85be3ac98a9802efd558a33a144b561a9ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534072, "uuid": "4c95161c-d81e-4940-8170-8cc8e74dc6dc", "value": "T1DFB4026471BACF61F8B58BF01538F84003B170A769F4E65C0EE625CA2AEBF501AD1B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534072, "uuid": "1bb55f66-f8aa-4248-9739-af07710ef92a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534072, "uuid": "0ea33271-cb77-4065-8b25-10a6f6fb51d0", "value": "12288:bDKmJhQdb7XXZaR1uyCwcMLsIg+oTQWppw3tHsPHePw:XKw+HpWDcBIgpSHoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534072, "uuid": "99717cef-72cc-479e-80b7-2d5f4452957d", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534072, "uuid": "cd8e9208-bf8d-45e3-9085-22cc1c5cb2d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534072, "uuid": "14af872c-2304-43b7-948b-bcb0f0075002", "value": "FQLyYRkV5TDGG6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72238735-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683534567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534567, "uuid": "27236ecd-f6dc-46e2-b244-a5ca9c42b30b", "comment": "Malware payload (Loki)", "value": "f626431f611e7bf564ee104f9089b289", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534567, "uuid": "3f8cb0f4-006b-4765-b625-f7b66d83bc3f", "comment": "Malware payload (Loki)", "value": "e4a9cb185c46bf812bf29890c14a2f20f6dbddfc1e34abe5e15af668077b33f6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534567, "uuid": "25922b0f-0f32-4616-91f1-2ad5e9298737", "comment": "Malware payload (Loki)", "value": "228c6ae8425a04eaa8ff8eb1e77ad6a34ad2f857", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534567, "uuid": "ab34c4ba-f20a-4caa-b575-acd89a407e94", "comment": "Malware payload (Loki)", "value": "4898fa0cd9c538e46219b071351219f64b12713aca94095a51c1001b5c69a9898c8c434adfe00e5803e177a117e9c213", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534567, "uuid": "7952a696-98e8-4a56-a4a4-62ee62111b0c", "value": "T1F5A4129433BA86BBE41D89F44228F14023B17197D5D1EB941F7266886FEBF115EC0E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534567, "uuid": "72aece16-0260-4d92-b6db-26202d195437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534567, "uuid": "1dcfe801-f43d-4e87-b586-8df28cf24f44", "value": "12288:LMcwMEpSb0SCRduBdnoLtO0cePDy980T0VLjb8WncM:L7wM2S0RIboLtYePmXT0ZbTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534567, "uuid": "e9c09665-94a1-43d9-8c35-db84e6fd6796", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534567, "uuid": "2a96594c-146a-4445-b886-0211b0a48e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534567, "uuid": "90b662f5-3f90-4d3b-813a-73294d7e311e", "value": "DHL Express Receipt_AWB8114704840778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c049f3-eddf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683578117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578117, "uuid": "75365931-65ff-48d4-939a-55a466e01b9c", "comment": "Malware payload", "value": "a91c3dfab7314a5b1880b0545561754e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578117, "uuid": "fccadcc2-084b-448e-a4ee-3dd1a68a0cb3", "comment": "Malware payload", "value": "e50ab59039f451ae841fb504e0a1337c34c6e4e8b40d477af345f9c1445dcd10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578117, "uuid": "2fa0e36b-4849-4db5-9b4d-4ea18fd0dc27", "comment": "Malware payload", "value": "c6223a2cbcba6f2bd419edb23c30c32de0f13f55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683578117, "uuid": "a8aeff12-c3f6-4849-8e77-11770fe68bd6", "comment": "Malware payload", "value": "3e162ec7633813194849d2b39b413fa3ccdf1400a0c79f14e2709a6203229a00c7743d0a6afb10b8f20e1b757431e4ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578117, "uuid": "034a21ca-3992-499b-86ec-54718380dad1", "value": "T12A16AEBE1312FDAF177E0D04D20874449D887867B234A1EDEEC406B6A2DA695DD3EDB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578117, "uuid": "5a012b91-9863-4e42-bbba-c158d4f79674", "value": "24576:hu6+xfOl67ixSjeo0j0JdWL4jIm8OQ7B1RWfgjAgSmkeL8HmHaxOrBgieKd+N/D+:aA52ogUR/DHJN6tn3gxc+Xrz7vqVKSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683578117, "uuid": "d1ad0f2d-ebad-4350-a790-75b133e715fd", "value": 4159488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683578117, "uuid": "b0c1c457-656a-4d7f-a920-380631ecdd6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683578117, "uuid": "b97e6186-4036-42a5-b028-d8c2f8404211", "value": "rump_native.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c231708-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683529000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529000, "uuid": "217c95a3-91c4-49f2-a2c9-f565b8c0721d", "comment": "Malware payload (Loki)", "value": "b9afb2f4be06e66d53ff4547aa132134", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529000, "uuid": "f13f756a-3e06-40f0-9be9-325f7e72dbe0", "comment": "Malware payload (Loki)", "value": "e5d0cc163a7c1e14b68cc568e20198961b924e11dbaf1337a88ea521990de5da", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529000, "uuid": "2d3e320e-d0f4-45e4-ad36-1da1503dc04a", "comment": "Malware payload (Loki)", "value": "3edfbe8ad59953a958a4657206791b651d1b894b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529000, "uuid": "82a4bcaa-5b09-4418-a6e0-31485b82e30a", "comment": "Malware payload (Loki)", "value": "a47f81cfead9bdfbbddc78098e0b7fef29b6d612235f5a07660992e9c60df1093e01abeabdcc9ef83dc0d247380cc8ed", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529000, "uuid": "2e544b88-b610-48cd-85e6-a538f294c9b6", "value": "T1609423AF1C10C7BC41AE74862C19020D67EC8BA6CE996592B0B4D46ECF5DCE8897F357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529000, "uuid": "9358920c-29bc-48a5-8e1d-3744cb2645a7", "value": "12288:cDvFMpphZ+3wVGOwvnjL95vm1KuS3SIHd:cDvFMpphZZYO+LHvmI3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529000, "uuid": "9b6f82c0-3292-447b-aa90-93b194ab7f51", "value": 432545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529000, "uuid": "ae6b0fc2-4978-4ee7-b97d-10a8ad4edfc1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529000, "uuid": "a176e5cd-de1b-4f0e-a288-b21a0d2f6a9e", "value": "DHL Receipt_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bec3ccd-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534208, "uuid": "9f5e9c21-e71a-49e8-81b6-e46fe4276ab0", "comment": "Malware payload (SnakeKeylogger)", "value": "085002173c9d09e515978b19b52e775c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534208, "uuid": "01505c60-75df-4df2-8f92-ac2d36f3ac61", "comment": "Malware payload (SnakeKeylogger)", "value": "e64d2225119a5860cb2d7a12914d0834d174a72d387e84b58e3d94c89aadbc58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534208, "uuid": "62245359-2f44-4d70-9f5d-71809855d539", "comment": "Malware payload (SnakeKeylogger)", "value": "f288270f7b2a6463c4e177e4f9d82a07a01c7867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534208, "uuid": "65d9e350-4388-42a1-8f52-e7b2c8fb89ea", "comment": "Malware payload (SnakeKeylogger)", "value": "95d34f6b787878854d523f82379ba12a98d24c8c777ba825d2132b396f3d82088fe3056ee094dcd21dd6672c5e96371f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534208, "uuid": "3d136865-b522-4759-b59d-6b8f291e2dac", "value": "T14EA49E973A44859CCF6D51F7B317854433A9CCFFE918A2096BC833576ED6BA3081271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534208, "uuid": "d5f50761-05e5-4449-8a6f-ee9cd0dcd494", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534208, "uuid": "9061b6f0-fbe9-4092-a462-a6598ec80e74", "value": "6144:n4sL+pKQRtV4QMqHT9xjoOOCTJ3uWFQ+yi1apMc4uAvnhAp081nNVjqKoe:Sv8IF3uWFQ+D1apMcov6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534208, "uuid": "81a5d0f2-0b50-4e61-a80e-a9fa89d24358", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534208, "uuid": "3d0050b0-0ba7-4842-877c-ce6feb27a115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534208, "uuid": "e32f2403-2ab5-4b6e-b830-aadf3351f549", "value": "08052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7eeee5-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683570337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570337, "uuid": "46edbf24-6765-42e3-b993-5216aa4e5cfe", "comment": "Malware payload (AgentTesla)", "value": "b08d4d1f1b7ce4552a7d6f0a1584305b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570337, "uuid": "f5efb210-6bfe-417a-9047-12418be8c188", "comment": "Malware payload (AgentTesla)", "value": "e75e7b4f4db640c54deb092dd373afa2b692a2078461cd0193e2b54b84c8250c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570337, "uuid": "bd34816e-f155-449e-8191-77592f86d05b", "comment": "Malware payload (AgentTesla)", "value": "83a2dd8904e8c57130466d7510b3392a11df0e31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570337, "uuid": "8fd725d9-ab0d-499e-be97-0b7c73d62c29", "comment": "Malware payload (AgentTesla)", "value": "d0dc3ecb877531547a755e85e531900f20f6852e7b0371cf6d4b2819198ed7cb2101c98ce643d8636483797624407ef5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570337, "uuid": "b2ee501a-ad18-47b4-9565-12eac74317e7", "value": "T1A893C062A3ED5108F2F33F50B9FD65214A3BFED99C36C94D42845AAD42A2940DCB2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570337, "uuid": "0faedba6-e13c-49e8-9e90-ed83fbefc8fe", "value": "768:mnHGdUBDCKtfYjE3Luo4+eaWHzePJ0aYPYFPk9Wai2Y:OHGd+CKtfSo4+kePJ0aoYFNai2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570337, "uuid": "1d902543-803c-4dba-9470-c68b20a93b58", "value": 94394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570337, "uuid": "9ea850c5-51f1-406b-a56e-5895080ee3d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570337, "uuid": "86a96f38-95ae-4dfc-9bd2-f708c8e1dec1", "value": "ORDEN 679564.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcb2716-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585697, "uuid": "c078614d-c636-422b-aa6b-f51a814ead50", "comment": "Malware payload (Mirai)", "value": "bd94e4da5f4935d8b6af4e300affaf30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585697, "uuid": "c31ee3f6-78e6-4308-8317-e21d1d31175b", "comment": "Malware payload (Mirai)", "value": "e7dc118ec7e243c1eba9b98b5edbfa0d24d2adf48e9c9efe7fa8ea8e92ccf70e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585697, "uuid": "59c89dbf-8b46-4a6e-8659-8587a410e00d", "comment": "Malware payload (Mirai)", "value": "21ef03744d0443e6adf13a08b57829fc29c79dba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585697, "uuid": "2e974294-d01c-43c3-8719-f680a2c84992", "comment": "Malware payload (Mirai)", "value": "7e14477d931d84948247ffcf9b3c6dcbb24beab25fdc9b12b7288c150be49aa50ba00ea8ec432612430238e0a7ead300", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585697, "uuid": "29032799-80e1-4ca1-ac35-2f375cb1c5aa", "value": "T1E9F33AC1B163F8F4DD0506742137FB332E72B47A6239E997D3E86A63AD85B42C4061B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585697, "uuid": "9416cdf7-041a-4503-bbd0-1acbe8c1eec7", "value": "3072:xR0OWLLnSt2tGbn5y3nDkUGJMC6m9vs60bVmwGKHgaCMz4LqO1Hr3e4GnaB5ug/b:xSOW/n/tGb5y3nDkUGJv5BDesbgTCyK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585697, "uuid": "5fb37885-104a-4a6a-865c-f1148d3ab1fe", "value": 164848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585697, "uuid": "7789dfea-7965-487f-b994-93f179b90c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585697, "uuid": "d43eed2b-41d9-4be1-a537-9f019ef45eb2", "value": "bd94e4da5f4935d8b6af4e300affaf30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c09fb0-ed46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683512212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512212, "uuid": "23237bd0-38fa-414b-96b4-f895d813aa68", "comment": "Malware payload (DCRat)", "value": "bf64afdb3b68c22cb6e75c0725ada2fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512212, "uuid": "9173c404-f70a-48bc-8366-f54f8eab382a", "comment": "Malware payload (DCRat)", "value": "e84fe903559b6d7048d69e0e4a7136236fa35dbd3591670de54ea81cec31a480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512212, "uuid": "d6e22206-0f84-4638-8e57-80819904d85e", "comment": "Malware payload (DCRat)", "value": "f412081fa14e5973a5acd37838c03dc5feec9943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683512212, "uuid": "fec02a27-bbbc-4cfb-abd6-d5cfb8bc7f0f", "comment": "Malware payload (DCRat)", "value": "1ea900c5d90839b1ba248915541dbf9cd940eed48130aaaf25c16caacd02205c6dcad75fb8d50399e0a07db8cf452fba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512212, "uuid": "8c84c0ae-2cc3-454d-94b0-b804c2d55e5a", "value": "T1AF76BF67B612CE68C0CAC571A19797B15B30BC1404B6A30736DE371E6EB2B402E6D9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512212, "uuid": "7cbb6b30-a0c8-4dc6-b509-ad6b059c0c4a", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512212, "uuid": "7d7e1921-d545-4c0b-9eac-d3bc989c9e52", "value": "196608:qEAs2Vg7MBHsE6DZiQlPjq/0zqzxcG5n/2l:qg2VGSuDZiQhlqzxcYn/2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683512212, "uuid": "faa14096-4861-48de-b131-ab445cda67ba", "value": 7802990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683512212, "uuid": "ac73b0a5-cb23-479f-bdd4-13c884877d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683512212, "uuid": "bbfea4ec-1d75-46a4-8ef3-449bee2d5fca", "value": "bf64afdb3b68c22cb6e75c0725ada2fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6f5833-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683534267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534267, "uuid": "585ee816-647e-479f-bc31-9310d2abf036", "comment": "Malware payload (SnakeKeylogger)", "value": "0f6b3fe6462e5437d78f9e31f36b9714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534267, "uuid": "9b74a71f-10ab-4895-b2ad-5b926ad9448e", "comment": "Malware payload (SnakeKeylogger)", "value": "e853894bb59928160a6692647303507c4363ee5278758429ef2e6352f1b22a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534267, "uuid": "5be3c7bb-ae2e-4117-a984-4e290b50a628", "comment": "Malware payload (SnakeKeylogger)", "value": "60c5c8fbf39a9062bab0a0fe246cfca533b78291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534267, "uuid": "58527932-0f63-4317-a115-7a54c54c63e6", "comment": "Malware payload (SnakeKeylogger)", "value": "500da11b1a3fd6dec0d58e80d42967140d9e7bddf57993f5d2a747ee7d46754aa57a617e81469f067a98bdec26d40aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534267, "uuid": "43a10640-ce97-4370-925c-35154b590b11", "value": "T180D3395D27F88C00E4FF967305B15126C775F8121A2ACD1D4AD1F65A2A3EBA08E1BF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534267, "uuid": "73e05a41-4175-4ad3-b5d5-9e7a6aa90c67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534267, "uuid": "67be6d17-e646-4766-ac11-e60aa30a7469", "value": "1536:Y5pA2EO2Mf5ZbkikHTJOIT+ZVPz704MMFpYdKMLOLbKuQmlaCIkpiOWBJGF0Kcl:Y5pbE55zY704/aYbfaOwBsFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534267, "uuid": "f2f8d12c-3a48-40f4-9a7a-16b9c1576fb2", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534267, "uuid": "01f9e6bb-b80b-4657-82b8-a70ae5d8c20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534267, "uuid": "42fbd830-ce45-4b3f-a3b4-44724b0bb978", "value": "0f6b3fe6462e5437d78f9e31f36b9714.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a32627d-edf8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683588536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588536, "uuid": "d28e9660-c6e9-4df4-a787-81b06f370b10", "comment": "Malware payload (Mirai)", "value": "9e70a5acf7dbe24d337aaa74ff08e3c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588536, "uuid": "7843a4fc-68ad-474d-9c70-eea836b0a2ae", "comment": "Malware payload (Mirai)", "value": "e8e5b5a64bfeae27c83106d701a8c181ca8edfb5abdaefa278141dd9f3dc1301", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588536, "uuid": "ad43803c-6c22-4d25-bfb0-ec79c0ab862b", "comment": "Malware payload (Mirai)", "value": "87d871b2584fb50c31451f1226665cee6ec55c40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683588536, "uuid": "829fa5a2-f955-49d5-afb2-698d8df2c850", "comment": "Malware payload (Mirai)", "value": "faf6a150384d534d3fe4d28a7ceae9562bf0801402422c8d963bf572b69cfcee0b99a67de2191348096c49d7755ed4c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588536, "uuid": "5c3a544b-56b7-40bd-8939-5e14b606cf7b", "value": "T12F14F781A8828926C6E813BFF57E00CE331567F9E1CFB162CC511B1477CA95F0DA7A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588536, "uuid": "ada32d94-7f77-4043-8c1c-742ffc8289c0", "value": "6144:3WIy/w6uK6Vp63xvAj+Y9mrsplDKZUXQBKXAVan5X+F8JyvYYuH3E62:3WIy/w6uK94d9mrsplDKZqQBKXAVan5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683588536, "uuid": "464776fe-c79b-402e-8b8c-6e279b77b64f", "value": 202032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683588536, "uuid": "c128c2e7-150a-4405-aa1c-76b33f20a7de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683588536, "uuid": "47d70de2-7a41-456d-a578-2f0a97db20c6", "value": "9e70a5acf7dbe24d337aaa74ff08e3c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11b32ec-eddb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683576441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576441, "uuid": "7c76d4f6-a102-4a65-86fc-f15247fe2325", "comment": "Malware payload", "value": "b9f5bf5d78f1417c131da5adbd480f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576441, "uuid": "66179a90-7500-42aa-98e7-b4435bc0b38f", "comment": "Malware payload", "value": "e924442c7e088d452460e0b2710b2d118be929d58476496de18fd69340f8e007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576441, "uuid": "f54d4043-e272-44a5-86b7-6fc4c0af7326", "comment": "Malware payload", "value": "4040aa23d79cbeaa1ed4406bf68136f219beaa68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683576441, "uuid": "ea77b021-5bcb-4a41-82a0-16d47b45c906", "comment": "Malware payload", "value": "c8f45729c13629b15e7783cfb62eedba3027f267a2cb3d601a30b3ad0ffe5f543a5f7cccaf159c55c857b03fceda3823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576441, "uuid": "18ce5e65-20a1-41c2-a29d-6e193f10571d", "value": "T1CEC2295D3B908166C2EF6BB40AB2DB2142F2E1075A27DB5F4CD844FA6B773C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576441, "uuid": "7867074c-9fd0-4bce-b4e4-7bbd2636621f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576441, "uuid": "eb0dcc6f-d234-430a-b35a-a2608c1d0e52", "value": "384:gLd6XSUcj+GWZBeRHzCYe/4Y2OzRLTm3yilqr635bAtVvG8:+aLcjEoT5e/4sEuVvG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683576441, "uuid": "0703ab0b-2fe6-43e5-b4a9-9e8a77686326", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683576441, "uuid": "86af55fe-9746-4f25-8ad8-5ed8585787bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683576441, "uuid": "0bb1adc4-311f-47b3-91c7-7277939967ec", "value": "bMvD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7f202f-ed7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683534937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534937, "uuid": "95cb58cd-1ce9-4d24-abf9-587af049e7ef", "comment": "Malware payload (AgentTesla)", "value": "482595b6d9c408b4e5095980848a1c58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534937, "uuid": "593527ed-8267-4d7c-8d09-dff62f9eb8fc", "comment": "Malware payload (AgentTesla)", "value": "e98bd4ed05c5d8f05861357156e67cf2eb1ece78e082e39abc9db81be3a408b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534937, "uuid": "4f75bef2-96e4-44c5-b03e-bf6e5b76d1c4", "comment": "Malware payload (AgentTesla)", "value": "08a8713fbd28ddbb44b2d6d5518073f594041f35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534937, "uuid": "ef4abcfe-6a1f-4694-93ff-e191f9f1c9a5", "comment": "Malware payload (AgentTesla)", "value": "22fe66a8234523c92cd1f472391fd0b953ea5e612976b7bee5941956db8a2d08146665986684989ad8af37792a3eb241", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534937, "uuid": "76581acb-02b9-4f66-8079-5c751dfa581d", "value": "T15BC41298B2B68B63D91E4AF45A2CF68923B1719354D1C7D90F2BA5C88ED7F000F4465F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534937, "uuid": "18ee646d-43af-4b43-9305-bebc13e0097c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534937, "uuid": "897c7ce3-8058-498e-adea-21739146d066", "value": "6144:+UD9CiebdnFvgs8YjdbXlNtT8BrLijY0MztkB4IkN3H3qCfoVGqbUW20JbiK56lO:RhqdnF/PbT8BnijaX37QV2WTb/56LA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534937, "uuid": "e243bdbe-894e-4c1e-81be-15649469c877", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534937, "uuid": "ea56f4c9-c076-480d-a152-b12fe0c26ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534937, "uuid": "abf5dbf7-507e-479c-8883-f02360354ac6", "value": "482595b6d9c408b4e5095980848a1c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bd5b1c-edc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683565918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565918, "uuid": "0760a45d-ded0-49f8-b332-a0c00399de53", "comment": "Malware payload (Gafgyt)", "value": "3f348d87c0989d4c9bb7887e84ee7a62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565918, "uuid": "f4268b4f-8ddf-43d4-95be-8ac1929f1f4f", "comment": "Malware payload (Gafgyt)", "value": "e9f314df59f021a3ff84d73aad71a488d676c44cf521e7951c76b9fc71bdae51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565918, "uuid": "5495f34f-0478-47b4-a1ac-ba0a39b3e394", "comment": "Malware payload (Gafgyt)", "value": "4ae39b09fa19251eade7e6276e8195892e1deba1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683565918, "uuid": "5b4f8afb-5f77-4406-b835-233dcd7c7c2f", "comment": "Malware payload (Gafgyt)", "value": "47ebc4d64316aac0c736a1dde7bbb55943be402603178c9b0fcbc7544f7d05d32d9841e05340a41a309f842f422aedfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565918, "uuid": "7a3563aa-c590-422b-9b61-443eb7d6abe0", "value": "T146B32A4796A99FB3C086BAB515EB59300722ED120F2F1A9621387BF4437F5CD740EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565918, "uuid": "0429bdf3-3631-4fc6-89ef-8d82d0ef1644", "value": "1536:MqfWC0o17MhzlJpKgElT0T6Rk0MgPCDB5EDQEPWmmycgYVLu1IPYC:lfHdBeQglT6zPMcQgWmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683565918, "uuid": "9b9236de-1053-458e-8391-49d815556847", "value": 108482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683565918, "uuid": "2c07486f-9b45-45b0-aab0-4bed75ee14f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683565918, "uuid": "3ef0f273-d4e7-483a-84be-be0facc42445", "value": "3f348d87c0989d4c9bb7887e84ee7a62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4004d84f-ed73-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683531476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531476, "uuid": "7c9fed3e-77a7-4207-b0dc-9e7d499cb018", "comment": "Malware payload (SnakeKeylogger)", "value": "3c5381ac09fbbaf21792f2f460ead9f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531476, "uuid": "2903c846-bb78-49a8-8094-2d6c8d6417be", "comment": "Malware payload (SnakeKeylogger)", "value": "ea138d2457b49cccaf16cef8ff2a7479ed5e5207081c5d7ced0a2a3049dcdc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531476, "uuid": "d2fa1f62-4e6f-40df-8298-8e47265fda1e", "comment": "Malware payload (SnakeKeylogger)", "value": "213e69d308110ac175f6346404a9b82d661cd95b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531476, "uuid": "006fd848-bf24-4b83-a36c-e3f1369782c8", "comment": "Malware payload (SnakeKeylogger)", "value": "c4901e303b896560be9b50b1f5daf8748b3e59c4eae4bdf3edd0b8c2975f7f0d87817978250fd5abb419c5ee4f0eeb2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531476, "uuid": "60b30aa5-9c52-4624-b55f-e1ea37500896", "value": "T1DFB4F15132FA8F61F5758FF01634B44107F230B758F4E6580EE961CE6AB6F102A92B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531476, "uuid": "1d111a5b-64c5-471b-8b41-db1f53f60f0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531476, "uuid": "9d132a56-ba0d-403d-a54e-552c6c906c22", "value": "12288:NYXr/JWkOIjpzQs3N+pHaEejsErsI7K8yIj:wWTIjus3QpHmRrH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683531476, "uuid": "169895f1-7dff-469a-9f4c-6ae5b8109341", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683531476, "uuid": "7f2287a1-fe7d-458b-ad01-3aae1d52c59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531476, "uuid": "dd75b36e-6418-4c99-ab33-469d259f87fd", "value": "QVTUumgq2gicXbN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573fcc93-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528509, "uuid": "48b258f2-23c3-40c1-a5e0-b6852dea2cff", "comment": "Malware payload (Mirai)", "value": "9c66fa0cc3ac03888d56372ae560334e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528509, "uuid": "1ffb322c-3609-4367-bcb4-c5d7e983af24", "comment": "Malware payload (Mirai)", "value": "ea25dcbd3827aeaf34ae28c171bd3bd3117c94a74add3f7a37e4ee2cf238587c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528509, "uuid": "59825163-b11c-44ff-abc6-8a3ed3e8000d", "comment": "Malware payload (Mirai)", "value": "2c5f2f2197eb3126c1cdc41e84b4ed452b548977", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528509, "uuid": "162dd2a4-3578-483a-9904-f912234b5952", "comment": "Malware payload (Mirai)", "value": "d04417b8050bf83f212829b7c9ac4fd0207c033546f3991e689d4a9715c7d01800b5b9cb33bf0bf551f938feac29f8ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528509, "uuid": "f54db7cd-e792-4506-84a2-dcbeb51b0f79", "value": "T1B4633BDAF801DD7DF81BD77A4853090ABA30F3D512831B376397B9A7BC721981922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528509, "uuid": "e77134c8-698e-42a6-a37c-a2bc7e49f708", "value": "1536:nIgNKtENot70aDYnPq8VpHw1ox16P9dJWLa1ngChQo2:nIAKtEGTEnPTw1y1y9/SChZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528509, "uuid": "ad5c31fd-4572-463a-84e0-c54a1efd3fbc", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528509, "uuid": "8e2158d7-0c97-4280-b408-d2b67e04402b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528509, "uuid": "8c8aef6b-fe79-4f3f-b359-48b08a1ce0e1", "value": "9c66fa0cc3ac03888d56372ae560334e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aede2e96-ed6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683529085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529085, "uuid": "5bd89775-effe-4224-bce3-c5bbca91ea46", "comment": "Malware payload (SnakeKeylogger)", "value": "201b16dc94b6f715c765573f7d283c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529085, "uuid": "857ea85a-7284-4383-9a73-ea4a416b3c31", "comment": "Malware payload (SnakeKeylogger)", "value": "eb70269bb8ef78bb7c44342ed5efac0d76df99207bf45e9f9739aad5b9cf9563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529085, "uuid": "6280c224-019a-407c-b5bb-4f1cfb2e3a05", "comment": "Malware payload (SnakeKeylogger)", "value": "f1b07bd87abebcc9839ef4a0dd2d20f0c0661482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683529085, "uuid": "1ced0a0f-19af-4b19-810f-3f031a54cd1a", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d423728b22f17be56cc7fe5e875864e5f004be81333a565fc271fe8dd9e2a1c789bc4b51ade8ec7834211c524cf6a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529085, "uuid": "53280cc6-c38b-46da-9d31-a975d87ee68b", "value": "T198052CD1F150889BE95B09F1BD2AB53014A37E9D54E4810C5AAEBB1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529085, "uuid": "eb40dbb7-8561-4345-9b45-6effe9e4f477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529085, "uuid": "4fbcf7af-b113-4186-bf54-bf60a45aaf75", "value": "12288:hcKVUntwYm1J/2cPpODNN1ucejsnQjapNTOe:hK+v/vO31ux+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683529085, "uuid": "84d2fde5-107f-492e-97bd-80b9eac19867", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683529085, "uuid": "e2aaa91b-7bed-4ba1-911c-6c3293892701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683529085, "uuid": "f24d843c-e719-4b42-97e8-6affa9c7f9e4", "value": "ORDER#102718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994f9be0-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683570281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570281, "uuid": "7d0721bb-a782-424f-8a90-9a28cbeeff09", "comment": "Malware payload (SnakeKeylogger)", "value": "961058043c2925c38ba3454bfd3fa062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570281, "uuid": "18039542-352d-4ecf-8b0b-80912db21bd1", "comment": "Malware payload (SnakeKeylogger)", "value": "ec5a5103e89195cb445c89737a73996d34374ea0a99ddbfb0165b70b645dc414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570281, "uuid": "1bb9cbb0-08ae-4c96-a4e0-8986b4a78c45", "comment": "Malware payload (SnakeKeylogger)", "value": "9dd2440408c84bfc988e9cdefe370f9d38bd3705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570281, "uuid": "298f703b-d502-46b5-8603-546276f93300", "comment": "Malware payload (SnakeKeylogger)", "value": "9bb504a0903ffeacfe13ae9e7bd104418107f162a5287983589487a624ad602f3336f72a3ae2f9d1e2f4f44684690d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570281, "uuid": "2e379738-7017-4200-8ccb-b7cc865bf08f", "value": "T1DAC4F111B2E6BF51E83E8BF82814714017B2716B64F4F66D8DA261D97AE2F400B45E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570281, "uuid": "5e3a085e-d3fa-4503-b932-2cd9af9085cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570281, "uuid": "7e369af0-b50d-421c-b031-84f52c22241f", "value": "12288:jaU3gxf0nXEBY/rzM5ztKVsf0bwzeV7gIFeUyjoDj:jN3gx2Xq6c5qsf0caWJU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570281, "uuid": "b3a91816-6c36-428c-b2a9-724fca086551", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570281, "uuid": "35e49c7c-73e8-472a-aa84-c92158d517a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570281, "uuid": "6be36b5e-ed5f-44fc-9e96-dbf977ec03b5", "value": "Por favor confirmar.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5830d8ea-ed6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683527652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527652, "uuid": "e7a28820-404c-40c5-a604-63830f7451b6", "comment": "Malware payload (Formbook)", "value": "4de9d309e114114fa821c9b7bb72d0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527652, "uuid": "d320ad85-bbc3-406d-80d5-89aae5ed1cf3", "comment": "Malware payload (Formbook)", "value": "ece8d55b66fdd470a1037290b30a2e6e66d0ff38fa366ec37a2b0a330364093e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527652, "uuid": "fb65d891-8b8a-4501-a023-98c1a9a7c725", "comment": "Malware payload (Formbook)", "value": "010b0e52bf6fc756f22b04c6dea24b0db9b31ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527652, "uuid": "fb09e434-02b5-4f3b-aa84-20b89b221fcb", "comment": "Malware payload (Formbook)", "value": "7663c1d348abf2e74796509c6a240ec122bc9009e27d027cbf005559850ca4db5b3dedd43137140966a33234d619de26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527652, "uuid": "e571e051-e9cb-47e9-8887-9ce59f4ea27a", "value": "T1E1F4F122A169EB12D7B843FE5608490407BC2575BE7BE7182CCF50C9EE76B505312FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527652, "uuid": "749e7351-6710-451c-aa7e-d2b5d85c06b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527652, "uuid": "2f255022-506e-4894-9c6b-6c40f1a1c0f4", "value": "12288:336M4DvcLt3zO0JSeo2113s9tr4CNNF06+DkJV5c+uh09HgCTrHBz:6M4qqapo213s5NNFu4JV52KH/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527652, "uuid": "0e5f92c8-8a68-4e09-8ba1-ec707758e51b", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527652, "uuid": "d76404eb-f7fb-45d8-8285-c6ff92d712b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527652, "uuid": "e00b62d1-5d30-483d-bea7-18fa9751ac22", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4312fef5-ed82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683537924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537924, "uuid": "39d3cd08-a806-4708-80d1-3368ddb1bdfb", "comment": "Malware payload (Formbook)", "value": "5d61ed3238e6595746494a80367f99d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537924, "uuid": "3b05c6ed-17ed-414d-8cdf-3adad40b5647", "comment": "Malware payload (Formbook)", "value": "ee4ff10990ca92dca3a0ee6feeff6930f5dbeb239e747cf69ab4560a65a9fd0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537924, "uuid": "6f1a8541-8130-4fdc-8bb9-bb7355e5b571", "comment": "Malware payload (Formbook)", "value": "d42d77e481bb20f3e122225509f8af0f24cf4405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683537924, "uuid": "422bc1ea-80d7-4b28-9e85-2510c14bb4a6", "comment": "Malware payload (Formbook)", "value": "789d43a1779ea9b54407a8ca27484e6f50bfb7aaf10097fd5c9840cc1dd60dded670fd92f95b76067773a3cbdd849045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537924, "uuid": "63fccee5-2755-457f-a844-63beadda9540", "value": "T14AF4F122B169EB16D3B843FD5608490007BC6825FE6BE7586CCF60C9FD79B906311E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537924, "uuid": "3864a54e-e04b-4881-8469-29477f26aba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537924, "uuid": "c55a23f7-d6f8-4d19-af72-07fb720d0226", "value": "12288:xTASitfv1AfjXIQS504PQWvNtybaXbgZHCdLnfyZzNr6Wn+aBg6SR5ZjYBz:1ASitA/OQKNtybaXbgZih66Wn+WERP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683537924, "uuid": "1a5fff59-f37c-4124-a032-64264ad0c5c8", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683537924, "uuid": "778b03c8-8d94-4478-bdb5-a04d611ad573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683537924, "uuid": "6f1da498-605e-436c-8d6d-dcbcdf210ac2", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6aa75c8-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550547, "uuid": "788ab73c-d24a-4fa4-a540-1bcd08926465", "comment": "Malware payload (SnakeKeylogger)", "value": "89750189387b308b2fd0837f182e715e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550547, "uuid": "df7c8a4f-672e-4fef-9e44-a2f8d6a152d1", "comment": "Malware payload (SnakeKeylogger)", "value": "eeb17e6d418ca892e7fc46aa88fba3fc6dd0b72d38c4e7accc58facb15504a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550547, "uuid": "399658b6-38ac-4568-8a38-577282718fb7", "comment": "Malware payload (SnakeKeylogger)", "value": "7a0009ab26ca3e088aa54bedf2f4c6006c795b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550547, "uuid": "ad734777-2a28-4192-bf43-adeb15e39dc1", "comment": "Malware payload (SnakeKeylogger)", "value": "d60d28f1d304e3cd65edef129c098ee9bb2de9e7045d169d203ace628db003c224bbc90d268f5daf1cd6a4b26627712c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550547, "uuid": "f294dd9f-73f1-494e-95ad-3af76e8eda0c", "value": "T18B5512037AD154F3C0722E365A666B22A97CBD201FB989DF63D4396DDA315C0D3327A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550547, "uuid": "6c374fc8-0218-4c9e-920f-fb892d260368", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550547, "uuid": "a49263e8-ec3f-4d40-84f5-2431c2d97a77", "value": "24576:lTbBv5rUFcDnMdQzgfo1hU/XDaDKvMrBW4eNTygt90e+hoyaxlX:PBHnMdB9vMr8jygt+0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550547, "uuid": "487b9648-18cc-4c7f-b8a8-ab98b89b8b15", "value": 1296398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550547, "uuid": "37f21bfe-fb8d-4927-9086-d1d5c7971c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550547, "uuid": "546644fa-bb0e-4076-83b6-e07111f07621", "value": "invoicel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a4af86-ed9a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683548308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548308, "uuid": "2d27f9d1-2576-4539-b245-afaf5e191348", "comment": "Malware payload (RedLineStealer)", "value": "5f3fc6cb27698fb022e99c93ea5a6c46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548308, "uuid": "59f0c2aa-c524-4701-97eb-12a814095d76", "comment": "Malware payload (RedLineStealer)", "value": "efb1bd2291e35da7f22a7fe0345bef2c04d3fe3fcc73bc448dda00dc4e9bad8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548308, "uuid": "fc01b2a6-7448-437b-87c2-1134b4a10853", "comment": "Malware payload (RedLineStealer)", "value": "7613403fcbe1da8ceb56945f41126d2cf32cb1e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683548308, "uuid": "21ae0cd1-0e8e-487b-aae7-9f7265a9c3ca", "comment": "Malware payload (RedLineStealer)", "value": "97424675295c68b72605799bbfbfe284c0a7ff201625ddaa5ca15a94a9cf82c282b94f261869acf54d8ad1de4314a182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548308, "uuid": "dd3a4f97-13eb-417b-9925-82603dd79068", "value": "T129A41242ABD89532E9F633B018F602931A3A7C615C79476727466E5E0CB3294F93237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548308, "uuid": "601085eb-3d3a-476c-91f9-099774b64e60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548308, "uuid": "5c4bc3ce-a352-491d-af37-499429755baf", "value": "12288:6Mrqy90WrCiPxsZTbeBsScZgLQZv+VYNpNLOE4MqGXD:0y5rCiPWZucZ2QZ8mpNCE4Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683548308, "uuid": "77bc7184-6e45-4da5-a4d5-bde38376d6e5", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683548308, "uuid": "c21c3704-e442-4eec-ab0b-e3f1e40b9bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683548308, "uuid": "d2d7533c-501d-4ad1-877a-4496576ce74b", "value": "5f3fc6cb27698fb022e99c93ea5a6c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70239bd-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683534360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534360, "uuid": "c63f3548-3932-4b09-8c8a-8577f8f305c9", "comment": "Malware payload", "value": "7008af4d6c8a792cc119540ed6591c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534360, "uuid": "e11a56ce-7dd5-4e19-a6d6-792e612e2f2d", "comment": "Malware payload", "value": "f05410be61773c8019254c58a2932d47da169ad47887fe14cc26a43b55399f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534360, "uuid": "3f94a0d5-0a93-46a1-b3ac-8145b87dce3a", "comment": "Malware payload", "value": "744e314b4ad2f840b863fe27e3d0f50dcbb48440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534360, "uuid": "f864ac7d-7cfd-4bc4-b388-67a945a84281", "comment": "Malware payload", "value": "3587969d1c8652b01a7abaec690fb2c66e219e56ccfa786f6e9ff182162f43593b04b14a68204d54b640c621f26e0796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534360, "uuid": "dc8dd19d-78ba-4adb-ad6e-a08a397ac4d1", "value": "T1F0B3F12933F16AF2D891DCFD2D9E2D4D4295E08B13A2398848FC0ED79F9B09724553E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534360, "uuid": "cb9d5a4b-04fc-4725-a961-3ad0ee3d4678", "value": "d4c40d2e91e0691f544d9090d8b1a19b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534360, "uuid": "6f2bbb5f-8ea1-4ef4-979b-f10535a718c2", "value": "3072:WOcuw0MOFPPKd0BfIMTQnonApINeKQNcZPoPgNrKQ:Z9MOFPPyCzsaApMwNmrKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534360, "uuid": "8eb3d4b7-c3b4-408b-89f7-183ca7a5b2ac", "value": 107440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534360, "uuid": "46365eae-9d87-4dc4-a32f-e876e1a9994a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534360, "uuid": "12dbf0f9-41df-4983-a47f-8509dfe4cbf8", "value": "7008af4d6c8a792cc119540ed6591c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d8f4d9-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1683528718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528718, "uuid": "c330bb4b-b75e-4a45-b5a3-789a27f1638d", "comment": "Malware payload (RaccoonStealer)", "value": "1ab8b226d47e45f5fa339798ccae49e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528718, "uuid": "05f09f1b-314a-45e7-afd4-171e4fe7324f", "comment": "Malware payload (RaccoonStealer)", "value": "f0ea6cf3417bf75417b5228b4afd31e5257f65f19d3deb39a39499c15a872c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528718, "uuid": "55bb1629-a429-4031-be73-b5f56867647c", "comment": "Malware payload (RaccoonStealer)", "value": "b2301f86289592744001f134ed7d0f35f56fb9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528718, "uuid": "bea6c1c5-d211-4bfb-a438-bc416aa55200", "comment": "Malware payload (RaccoonStealer)", "value": "8ecf51e8b0999597bd130a9dce45fa8171e64dd2bbb3ae52879cf96d2f02134ca3026444bea38e7bfb3145e3171ed430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528718, "uuid": "643d4ffa-f9c7-420c-bd09-a375a7170240", "value": "T122F4E02527B9BBA1ECB6C3FC6608A4016FB57D2057B6E6D84DCAE0CC5154F18FA10B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528718, "uuid": "0d756d2a-ac79-41e4-9cef-afce8056fc05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528718, "uuid": "aeb5468b-9a7c-4259-940b-8269879b794b", "value": "12288:6811KH6XZ0nj0Is0W1y7ymC492lkzfjGmb02QdKg8e:NPKH6J0hW1ymmC4GkH9Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528718, "uuid": "a762a6f3-4d92-48b8-a349-da287c012ac0", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528718, "uuid": "f1e615d6-0db2-472d-ae7a-7003930c9a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528718, "uuid": "7af3e6d2-7a17-4a19-8f7e-5ac68a8bcd28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c58bf9-ede4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683580184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580184, "uuid": "16c8a5f3-cf45-454d-a4dc-da1318164934", "comment": "Malware payload (AgentTesla)", "value": "89ec613a0a18b8d177faac038019611f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580184, "uuid": "0cddb814-d63b-4f46-929a-df7a823e0023", "comment": "Malware payload (AgentTesla)", "value": "f10dd98b11b51294979160959031a2087f00361c546d945d75a4c2fd7fac6c28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580184, "uuid": "d7950ad8-c32e-4a13-9844-c58d7c7a7c4a", "comment": "Malware payload (AgentTesla)", "value": "81c64e9b40ef1339f02a0c4eb3f962ce62a3552e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683580184, "uuid": "ad3bb70e-9116-4907-a168-45a5dabb3c63", "comment": "Malware payload (AgentTesla)", "value": "cf053194da4074b27709f2daf75a2b52b4e16ff831171128e8ccab08b9d67fdaa1979c2ecc69c6e7288291bb9eeed0ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580184, "uuid": "c36e596c-7023-432b-8385-a45c7426e1f6", "value": "T1B5D4F15023F68F61E8758BF41138B8A407F2B4E794F0E65C0EE564C95EE7F602A81B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580184, "uuid": "4f747398-f7c8-4130-87bf-6558745702f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580184, "uuid": "cd3104db-6e48-4432-93b5-43e41d3e8972", "value": "12288:N53N/gugTnxuKw1DvGRn+GmWNcO5BYxp5h+uHoUAHjZXln:i7TnxuKwxvGV+GmYcOuPPwDZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683580184, "uuid": "f4defe24-2d6d-46ce-923a-54446b734caf", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683580184, "uuid": "8fc7fc96-6a80-4d8a-bf2e-528158e2594f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683580184, "uuid": "18256bd7-c656-47e7-a05c-373af9dd98d6", "value": "#MBT-PO-320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5b8fcc-ed72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683531336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531336, "uuid": "507b4eec-85ed-421d-8376-d0a49dc99cf6", "comment": "Malware payload (RedLineStealer)", "value": "af48f775a0a49225abd7d3fbfda7b10d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531336, "uuid": "35a73a26-496d-4c9a-b511-c57e7bfff64a", "comment": "Malware payload (RedLineStealer)", "value": "f1ec4855006e287da707713cb5b7182ca5d9da1fb40dc4e499b5ae6939ba448b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531336, "uuid": "291e4297-bdec-43ca-9773-7694b7cb8045", "comment": "Malware payload (RedLineStealer)", "value": "9daf505de9a39fceec5aa5ffe15fe9b7101375ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683531336, "uuid": "25e3ec87-6149-4307-8491-f90388f431db", "comment": "Malware payload (RedLineStealer)", "value": "b71daacbd8c2d2cf1313c4cb2620b8ad5db70e92e3dd9b2980f3a6123b3ada524c855d1f62c2f39afc1ddb2d7424f184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531336, "uuid": "30da9ec4-8cb5-42b2-818e-ffdf23aee240", "value": "T193848D03520EC9AEDE9BA1B9FCC4C2A52B18ACB87B5FA14BBBD47D18057F190B54071D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531336, "uuid": "eb1df865-034a-46ae-be21-8c22690c9dee", "value": "d03a32a9d6119786dea4a25b734d4a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531336, "uuid": "959e9f12-2c36-4042-a355-a2ba2e741478", "value": "6144:6c3h2JJrs1g/zjTY5cQ32Oi5u0Fu9IzodnkRG:6cR2JG2/zvVbOnI4vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683531336, "uuid": "d366074b-6fd1-46e8-8410-27cdc884ba2b", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683531336, "uuid": "df394171-4a33-4525-9379-b505b01e6c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683531336, "uuid": "cb2f5813-8bb0-4853-9857-088a08c43d40", "value": "Video Presentation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c93630f-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683534397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534397, "uuid": "99a8c005-598a-4c55-a28a-ac41d52e7591", "comment": "Malware payload (Loki)", "value": "b94ab0ff3e9e9f20e322a7571fcf041f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534397, "uuid": "a7ba207e-25b8-4e93-9de1-314120171b53", "comment": "Malware payload (Loki)", "value": "f24781001f198ec760cdf8805dc1fb123558d60d32e0cefbffe0a410f0519838", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534397, "uuid": "20983d51-9d32-4820-96a7-590abdd3ef99", "comment": "Malware payload (Loki)", "value": "4b2cdbfb38262df6976f0ce23c8e5aa8a002e5a5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534397, "uuid": "81338af3-0763-4552-b9ab-e0f47f51f62c", "comment": "Malware payload (Loki)", "value": "d2f90292888c4f570a2e93779e03879a26afabffb5a5a7d28217afdfc58df193739216e0ae18db9567052faabc3ca14e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534397, "uuid": "0ebf7a96-0589-4a8d-bef9-a29d93475e72", "value": "T124F2B45AE79B02B48F8112B5271F1FC99B6CB53E735040B2386C837433A9C6A46766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534397, "uuid": "aafc03d4-21e2-4c0f-9050-803e5a7bf6d6", "value": "768:lFx0XaIsnPRIa4fwJMTMIzsycs/2biGJyYlEFud:lf0Xvx3EMAIrcs/aJVkud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534397, "uuid": "572e00e1-fec6-4198-8dac-f5caef226dc3", "value": 34889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534397, "uuid": "01b353cd-8bd4-4d44-a60c-624952ec56f2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534397, "uuid": "fb39218a-8d63-4dfd-a7d6-ed5981e45969", "value": "May New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7473c0c-edac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SparkRAT)", "timestamp": 1683556158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556158, "uuid": "e5153d24-92e6-42d5-b9e7-0e92e49a0d95", "comment": "Malware payload (SparkRAT)", "value": "41fa51816abea20a91900edaf46d8512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556158, "uuid": "d5f18c99-9103-4729-a30c-00499dcf3b02", "comment": "Malware payload (SparkRAT)", "value": "f252274a873b52ec33625b8f8ddb77dcdf9dfc8781585d22461f11c9d337b39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556158, "uuid": "f0a7a7f1-0469-4bb5-abc9-816b47295a1a", "comment": "Malware payload (SparkRAT)", "value": "9e2364263c617c19930a1b374d0c87cf8ab4f6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683556158, "uuid": "e80cd146-d47a-46cd-97b5-bc507a3602ca", "comment": "Malware payload (SparkRAT)", "value": "795d814cba1e0020355963fcb3df3f71693c76f38a7dbc3f480be900d72427b64223563cf89df3783f081d74a08ef3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556158, "uuid": "f7813310-0c1a-4f74-814f-92449fddfd4a", "value": "T12FD63847F95180E8C5A9D170C62A9263BB307C885B3027D73B60FBB92E36BD46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556158, "uuid": "cc2008f0-7a33-4335-879a-cf3e068a4a19", "value": "87fff2010412aad37f9c0bec93dd5d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556158, "uuid": "c62c9f74-ad4e-4e3e-bc40-11edb0d68112", "value": "98304:6nVtvXa8QN5RRS8hS9/dSIrMyMjhbwg71EZ5wUYL5fi:6nVxxQ7NIdS4MyMjhEuG4Uy5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683556158, "uuid": "b626dee0-c6c0-46f4-8ac3-fc416522b35f", "value": 13388344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683556158, "uuid": "349a1de5-8c91-4725-b8d8-6803f7d98a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683556158, "uuid": "51ac6449-0e63-40bc-995a-ee550b8b5fc8", "value": "SecuriteInfo.com.Variant.Jatif.7130.11703.17675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d372ff45-edbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683564366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564366, "uuid": "aec4c4c5-1a02-4681-b36f-357e058eae59", "comment": "Malware payload (Gafgyt)", "value": "429057080328c7e6a6a11d8308307e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564366, "uuid": "aa516551-0438-437f-86ae-5a5917767c38", "comment": "Malware payload (Gafgyt)", "value": "f2a91d6453e0bd1302696ca27b730fb7acffdd12e8b5899ebf3bee65983b7f6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564366, "uuid": "37ab8e16-1115-4c09-86a7-34356ca41851", "comment": "Malware payload (Gafgyt)", "value": "d7cb2f018073db8587cf4947ec67d2d24daa9e6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683564366, "uuid": "c7552fed-370a-4a0e-a976-a76417fdbb0f", "comment": "Malware payload (Gafgyt)", "value": "083e5fcfabb86e683fe13d5f7c96661797fa8176b6e3a83f7b8ecf439cf0b970530e6f68f5e7b08fcc882258d53ad90f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564366, "uuid": "a49fcfd7-1fb2-42c4-9ec2-884729bdce46", "value": "T1CDB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564366, "uuid": "ff6fb983-6e41-4caf-a207-bc15413d9df7", "value": "3072:2d0wKSAewzi+Xn+8Uhw6W+aPSJmDk1c8xF6KjW:bfO8IBTJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683564366, "uuid": "2b0f853c-cdfe-4070-9c7e-32d79e9e5bec", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683564366, "uuid": "daa3f6a3-baad-4715-ace5-e772f7d4260b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683564366, "uuid": "366818f0-e58d-48df-9f3e-69682e632ae6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ace355d-ed6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683528542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528542, "uuid": "f9a32de9-cb9e-424b-be2a-58198814a8e7", "comment": "Malware payload (Mirai)", "value": "814896c8f977038a9cf30d6ea9cc0cde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528542, "uuid": "5e5d7dbd-27cc-4750-a202-1acd0f5c8a1b", "comment": "Malware payload (Mirai)", "value": "f3439f877a4be1c5ee1f2d22b0c73c725fe13da496c0976ac4042c235eb05dad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528542, "uuid": "dfa5c1a3-9522-4359-b2aa-cf2b88d07964", "comment": "Malware payload (Mirai)", "value": "56af1695da0cb286d3143fa7c0b04e690bd7ecd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683528542, "uuid": "bff7c82f-87b2-4c2c-b479-26da5518fe11", "comment": "Malware payload (Mirai)", "value": "7d00c91329e8143111eb3d09a0c971c65724bbfb855a378410f016f896cc00ee96019a14d936effca5a31b295f9ce370", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528542, "uuid": "ab10b325-76ba-4c2d-b1e3-460a6b0fe898", "value": "T18F633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528542, "uuid": "cf7ac4b1-6674-4765-9371-5e7d68f266bf", "value": "1536:lGRaTYmol/hGIAs4PNvAVQjGm75123tStql:lya7hJ9GmVD0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683528542, "uuid": "785cc22d-2fdf-45d5-b535-c44a24d60d7a", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683528542, "uuid": "25b9bdcd-283d-405f-a697-8008fd04b4ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683528542, "uuid": "8f65e695-75d8-4a8e-add9-5069602c2cc2", "value": "814896c8f977038a9cf30d6ea9cc0cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862c68e2-ed79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683534171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534171, "uuid": "30aa4401-aaa6-4e73-a928-e6755adaf181", "comment": "Malware payload (RemcosRAT)", "value": "b37ad0b34e2fd56cf57217d17d89107c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534171, "uuid": "d445765c-95e0-4087-8bab-4847804c23c3", "comment": "Malware payload (RemcosRAT)", "value": "f4e8b7d9843776c8d92cbc77a69ba7cdd9ade0314f8e4cfe7cad71b2f83de6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534171, "uuid": "2fb31d0a-bade-432b-b453-bd63258472d7", "comment": "Malware payload (RemcosRAT)", "value": "021bfb2b3bb7d5565fafb3dccc476386371c4210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534171, "uuid": "8b296ced-ca0d-4e66-9883-b5f436e7afb5", "comment": "Malware payload (RemcosRAT)", "value": "f75c3036b6077d5566c34812de5ee3cf3b15500c56d83595f1a0c54b1c0a891dcc85129b8af9d92d97cf0e51234d8d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534171, "uuid": "9e4f9baf-a375-49b7-904a-90e0af96a79a", "value": "T1EB052399B2FECAA7D5194EF8861CB4911370B1ABC4E4E2CC4E7A65C69FD6F000E4454F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534171, "uuid": "44efa583-d817-4f0d-ab8e-2eae50dd5d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534171, "uuid": "3b61f47d-a726-40db-91fc-1c5ca5253bf8", "value": "24576:hXxr18+9f7nRq/pHmlreE4ds1SVNdiTHdjIb:hx1hGZmlT1ODii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534171, "uuid": "e4540b2c-15d4-40cd-8bed-e1f37de16154", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534171, "uuid": "061a25cd-494a-4ca9-bada-49dbda9900ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534171, "uuid": "b70fe0a6-2002-4b5d-bf47-c0ee03f4edf9", "value": "ESU51092W310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937ee42c-edcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683570271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570271, "uuid": "5cc169ca-9428-4d2a-87c5-5965b5d3bc38", "comment": "Malware payload (SnakeKeylogger)", "value": "5001fa4bde0f178f32ce03df35a5f0fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570271, "uuid": "8e4e4e4e-de7b-478b-8096-b62dade39868", "comment": "Malware payload (SnakeKeylogger)", "value": "f68d6a0977abf5978dbcc20cfff9fbf9b308ff08c7066e94d0a4a50abc545fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570271, "uuid": "95118678-d81f-4b10-931e-3ee90e4397d9", "comment": "Malware payload (SnakeKeylogger)", "value": "1777b16b67199cbc3e71414285f04c3ae49cf137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683570271, "uuid": "4922e315-93a0-41a1-8c28-96a17f9f8054", "comment": "Malware payload (SnakeKeylogger)", "value": "06eb1822d40b1629d9cc5ddbe7521d3829c43bb3faa5f524bbaa6eeb133242cab50540cf599ece122b3b4c02452c371b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570271, "uuid": "8187fa54-a2a1-48f0-bd5a-d6b78ed38b01", "value": "T1EF250201B291BF51E92E4FF42458754007F27D3BA4E1F66D8EA6B1E52AB3F400A41E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570271, "uuid": "2fcee8d5-46c8-450a-aaba-926071980904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570271, "uuid": "af25edd8-fa1b-480b-9148-e6cfd6e53345", "value": "24576:bgivJ4MyjCxlCzIc60A2CYA+cP1KgzneZ:bNvxAC2zp3da1Kgzne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683570271, "uuid": "87afe9fc-9ea1-4f9b-af06-f4c65fed489a", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683570271, "uuid": "a08149cc-978b-4ebf-8b6a-f3142ad08e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683570271, "uuid": "b6bfab82-22b7-47bc-964e-57f7dcfb8706", "value": "New Order-Xle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f3203b-ed50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LockBit)", "timestamp": 1683516459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516459, "uuid": "0c45dbcc-0627-4a27-a3fb-1d304d738393", "comment": "Malware payload (LockBit)", "value": "59fe569fcc6b84aa8e8e74236fc8d8e2", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516459, "uuid": "4ad431a8-13b8-4250-84f8-e39a45fd1ef2", "comment": "Malware payload (LockBit)", "value": "f7c432afe20c31ddd75dbb214f1b7aaeb400d9d17da6d9e3c0d7cf1dd38bf524", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516459, "uuid": "e06796b3-6087-4919-8863-a0fce424ffbc", "comment": "Malware payload (LockBit)", "value": "c9c71661709bdd9f9da212bcd5bb6373cb1e58a0", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683516459, "uuid": "daa592cc-34b9-4a52-aa0a-df93278dd567", "comment": "Malware payload (LockBit)", "value": "26683f20c79a0dcdffaa9491a07d4341bce052d9c3e5efb83e7d28e9611937494f234bcf48be1a2be9d76bd8e4a6b947", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516459, "uuid": "92243fa2-e569-4797-ac67-dddbb21eb643", "value": "T1710633247913F277C8376EF27F61917177EFD65D0BA08093EA162B34656181F8B2AC0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516459, "uuid": "34cb9665-71f2-4d45-ba20-b64b7bcdd18e", "value": "7edec838fc0613c24eb84fc43296ea41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516459, "uuid": "a5510fa8-dd5c-4a21-9fce-db1ae89b5875", "value": "98304:RkYcyokoQj+a0TVYVxNqkdrIc3zoZbNcMlC:RkLy/+/VMx8YIyzabNcMlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683516459, "uuid": "0a4dc128-6b45-4159-9650-d62d33865649", "value": 3708928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683516459, "uuid": "1dcb7bfc-e229-4d93-92f7-4ebb3af48d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683516459, "uuid": "e2c614fa-4a66-4b54-8c39-1f2770c026f8", "value": "2023-05-07_59fe569fcc6b84aa8e8e74236fc8d8e2_darkside", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309cf9a2-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568817, "uuid": "a13f4457-6ea7-40f2-a21c-98a211d5762b", "comment": "Malware payload (Gafgyt)", "value": "27e579d00103d253065684ca94dbb470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568817, "uuid": "c1345e30-8533-4958-9227-269cbe393021", "comment": "Malware payload (Gafgyt)", "value": "f8f2b2f71133b706578b94371b9d2b2551b8baf285da9bdfb942cde4870fa3b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568817, "uuid": "7f1d1a0c-7360-4002-827b-4e586dd4b672", "comment": "Malware payload (Gafgyt)", "value": "fd0bd459307c301f1b4b8f99a2671ced4f53e54f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568817, "uuid": "f5e28cb0-a369-4c47-9e59-e8c5b12f8e0a", "comment": "Malware payload (Gafgyt)", "value": "e899b8e9e0ffd9c3e98db9608267ec620e842d66ba08da854953bc21e682f12787e3986861d2c367c3fb194403da7954", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568817, "uuid": "9a73601a-6b60-4564-9a55-ad2e6ff32978", "value": "T11F933A56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568817, "uuid": "64e687e9-1dba-4902-9c8d-aa285dfdb99c", "value": "1536:mmqmWTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emPGMUNLe5um7WAgcVjmZIcBI:mms2UVUtBUI8GwPfHkk8rReLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568817, "uuid": "99766403-e6c2-407e-9a40-70cf95b85179", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568817, "uuid": "8c14c7b6-8396-460c-8cdd-26806ddc7665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568817, "uuid": "fd8ff300-8de0-4f46-b875-e7ed4c55bed1", "value": "27e579d00103d253065684ca94dbb470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ca447d-eda2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1683551938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551938, "uuid": "2e63dcee-f1f5-4e8c-825c-c3fc1d91d3bc", "comment": "Malware payload (ModiLoader)", "value": "f67ab8557bf377cb8075aa19c1be2830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551938, "uuid": "d16a76cb-280a-4c48-be2f-7c856a0b7801", "comment": "Malware payload (ModiLoader)", "value": "f983cdcb52e6144ba8a87fb6f8904f39d3626be45c1725bdb89a2522525f3a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551938, "uuid": "b8e02ac8-eaa2-4e99-8379-ca53bfc68fc5", "comment": "Malware payload (ModiLoader)", "value": "79cfebdbfcdfe57c64af0891046a6af1ce5c208a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683551938, "uuid": "73b41c79-42a0-473b-bb63-39ee8e973454", "comment": "Malware payload (ModiLoader)", "value": "d483d57451f475274c4eedee69b4aa2c3b4a5127e664990acf5414b1eb7ace9690a7ff42f4bbf0cc4ae8954973cede37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551938, "uuid": "4c6e3fab-9d8e-4e28-817f-2610652a4952", "value": "T102057D9FE2D3C137E96227758E5A9B9474267F602958F84AB7D63D8C2F3E5803808353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551938, "uuid": "f8aca8e5-2cbd-4b22-b7e4-e296282d676b", "value": "39ee9d8fb14f217c683f93ae1bfee6d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551938, "uuid": "f11f107d-7671-4354-bcac-d06a64c7a2dc", "value": "12288:vX44VFiwL9aDSm20iw+hm4m7YHDcbhT4EbLGHrn1XAjQzB/PD:vpzH9aDSm2A+hmD6c9T4EvGHr1QE9/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683551938, "uuid": "5b3aa71a-7ea6-42bc-81b5-0771e9e9f5d0", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683551938, "uuid": "0fa13961-0a44-4cc1-9096-7e4fef341198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683551938, "uuid": "cf73e9d8-86ff-4fac-9269-58b2fc88242d", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8602c029-edf1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683585710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585710, "uuid": "148f941a-5f5d-4b7b-b8bc-5fa3d77cdf13", "comment": "Malware payload (Mirai)", "value": "8127e246d0bf0edd8c1f2e2186247939", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585710, "uuid": "3517a66b-9051-4638-81a8-1e9327c71027", "comment": "Malware payload (Mirai)", "value": "f9b2aa92ed311468d817a5fcb7d30e490dfd9f1e6450d06d272e97babba162d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585710, "uuid": "179f4732-8e70-4a63-b6e2-b690d29b4876", "comment": "Malware payload (Mirai)", "value": "deb4b19c37d1b979d74889a0ea21da640fac2de5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683585710, "uuid": "f6b283e3-ace1-4991-a012-853ea04cbd2c", "comment": "Malware payload (Mirai)", "value": "8ac21a4d1ced9d62b3e773bf7e5ab87aca5472abd2a31dccb66302248b06f7d204e6ba1275a37198029b7c285edd7bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585710, "uuid": "17a1631e-4d40-4d16-a315-771c89277416", "value": "T13FC2E0BFB6AA6A67F61D233DE035811B03E4F52C939D6B9763404032EA5E81D7531CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585710, "uuid": "4a87f026-bc8b-486c-b1ed-109f4c30334b", "value": "384:M21DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZH7FBxOX:vMwxdyoEUnDz+Y8tqHWXmbFBvQfu0N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683585710, "uuid": "ec330a83-ab98-4fc4-8fb3-7547af5363cf", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683585710, "uuid": "9e9352b3-202f-420d-9c79-80e2db0c254c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683585710, "uuid": "7265be1c-395f-4af6-a9cc-266b02766d22", "value": "8127e246d0bf0edd8c1f2e2186247939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681e2e52-ed7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683535839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535839, "uuid": "b0141219-cf7c-43b0-b6b8-889d6fb9e8f7", "comment": "Malware payload", "value": "a18ec743ab1501d01a20d5ca6def3f6d", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535839, "uuid": "5267b7f3-da82-421b-9910-5f81e7871d28", "comment": "Malware payload", "value": "f9c717151a57177994c83185683eb72a647d13e6a7c4bd09e97d252d6ddf97fe", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535839, "uuid": "2549196d-91a6-49e4-9238-c2b6f6a98b19", "comment": "Malware payload", "value": "66a45ac05236120d701ca0264bafa3fa9d68fa1d", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683535839, "uuid": "59d1526b-89df-4591-962e-ea8a8b44ecda", "comment": "Malware payload", "value": "7c7f96da0b651132090b96301d8d8f67c30cfa77e1aeb53c695a5cd8e031e1df8a269a13bebbdc7f373df573fd84bac3", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535839, "uuid": "3ff74bee-73b9-4d06-8ba3-ed5727a5ec84", "value": "T14453099CA48CD598C9B9EBF2E752F0CAE24D737B4A8A44B271AF5FD20203D15E947C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535839, "uuid": "ce582077-2d0e-4a71-bc94-4e1f2c58d82d", "value": "768:S0jVjgocGH4FBncGH4FBQNsgecGH4FBscGH4FBIacGH4FBPYLnnndTVrXmm1wDa1:BXcs8csxecstcstacsaMnnn762xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683535839, "uuid": "c728cdaa-74d3-4267-b75e-d033ae78a0fb", "value": 62063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683535839, "uuid": "a5b53988-664b-4ae6-af48-54a04e9895f9", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683535839, "uuid": "a0b84b96-1c97-454b-b624-c6403c84299b", "value": "STM-427312684.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6797d8b3-ed89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683540992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683540992, "uuid": "13f47023-66f2-49c5-851a-91c65d2a6cd2", "comment": "Malware payload (AgentTesla)", "value": "645341444d5fbf5407a5494d30bf3138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683540992, "uuid": "63333f8a-7f75-4f23-9773-8909b141e601", "comment": "Malware payload (AgentTesla)", "value": "fb012706e028ca770d05ae4580045de7450d40b069bc8f8a250e292746b45b90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683540992, "uuid": "eb7823cd-1665-4295-b7a3-e82e2c0a146a", "comment": "Malware payload (AgentTesla)", "value": "3da79312f5574340c3cec6c3b649b56f76b4bf94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683540992, "uuid": "79b1c725-84b5-4ec6-89b0-cca1dd3aeb48", "comment": "Malware payload (AgentTesla)", "value": "d61d95d286143a364a064472e2dc736fe026fed248c4decc45ef591bb4fe4793274200edb672ffa7e1832fb6d398fc0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683540992, "uuid": "7d23da46-cddd-40d3-864f-376a45709fd8", "value": "T147F448771E9AAC9DD999CEF026AA31120DA2FE12BDF0C55A0D51708196FCE00739ECD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683540992, "uuid": "a267eb68-ff10-4a13-b0a4-52c1351541c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683540992, "uuid": "833bed93-fb07-4430-8e72-4cdef325a865", "value": "6144:Jq9CieT+tC71wElatNclv/rLkOhV9Uy+va3ubrBYDtQ0CI2YOG3wMtcsX2n1R5o9:JQ84CLfnrLh9U2uR5hIVHt+yZzTXjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683540992, "uuid": "088a1f59-1e86-49f2-a43b-834cbd7961bc", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683540992, "uuid": "5e25d658-410f-49bf-954e-08355e9f663f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683540992, "uuid": "ec658709-6541-4467-a7d8-3772ffe48937", "value": "YKBGunlukEkstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e63eb82-eda4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683552653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552653, "uuid": "f5c0a944-6bde-4dc3-8980-7adb583fd1c9", "comment": "Malware payload (Formbook)", "value": "9cc86ae1c4e3e0eff8a3974ac104b94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552653, "uuid": "9e131e18-6de5-49c1-bec8-1dcdd25cd805", "comment": "Malware payload (Formbook)", "value": "fb0e85c85e1e2745115bb7c832f102cc4e4ef11f60740e77fc0a47163080419d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552653, "uuid": "dd49d3db-f7c3-40cb-a1fe-43c9bec204ab", "comment": "Malware payload (Formbook)", "value": "acdbbcfe2c1fd3ea01e47bdd4066671185248ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683552653, "uuid": "543f7d29-c24d-43ed-bb53-a99feca09ec2", "comment": "Malware payload (Formbook)", "value": "6d11aaf10a55128837a6423f03f8396757e31de2d67fa3c962c1498b2d6d3c519fa1edba0d0cab61ec38e51aa834d36a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552653, "uuid": "c9350f77-b425-45f1-9209-d316c62f0337", "value": "T1CC441265B6C0C9ABEDD20A760976073A7EFCB61266A19A4F77001E0C3D73981D70E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552653, "uuid": "800b774e-b1ec-4e0c-ae8f-c170665082dc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552653, "uuid": "55d4238e-e576-4c81-8d38-6cd0d22e5fb1", "value": "6144:/Ya6PC9lYtTmkMnusbtMS2WIXjvLCrM0mtqf+Yp6tKClm:/YVUlYtsNbF8XjTLqfO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683552653, "uuid": "de76f791-0bbc-48ec-aa40-7cc247688e27", "value": 254779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683552653, "uuid": "c361c8ae-f247-4ec6-b154-1763ae5ee963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683552653, "uuid": "e6cc17e7-6f19-4821-a17c-aa28994a7d83", "value": "DHL-34533445doc-234_pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0b0e30-ed52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683517221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683517221, "uuid": "a98c2592-06e7-4b03-a71f-6045ecb83cd3", "comment": "Malware payload (Smoke Loader)", "value": "8d725361377fb643449614a196f413a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683517221, "uuid": "2094db37-d8a6-4488-9460-0a7ec188f808", "comment": "Malware payload (Smoke Loader)", "value": "fb332f7b241cc9956ead9401f2fa69b14ffbf0730996e4b0718ee0f874d7d52a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683517221, "uuid": "10eafbe2-f41d-414e-9e00-961449239a5e", "comment": "Malware payload (Smoke Loader)", "value": "bac0d5948fc7ef23179e46246f6a0cf089505a1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683517221, "uuid": "d615b647-086d-412d-a03f-db09aca237bc", "comment": "Malware payload (Smoke Loader)", "value": "1ba420142f06286df29e2eb4a8133c7e4c09926663353d15992d61d304e8f3fd9d2be49ba5e2b6cf6bf08786af34e50c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683517221, "uuid": "7fc57a0a-cb3d-4dd6-b98a-25ebaa897e7f", "value": "T18164094392E1FDC4EA264B728E1FC6E8775EF2508F59B77922189A1F44B00B2C76B710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683517221, "uuid": "88bf9291-d569-4b19-820b-48132aebc4a6", "value": "09ad811c7b24c560499d47bd7c66a41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683517221, "uuid": "8f9efc41-20f0-4192-a6f2-7d72e394e879", "value": "3072:7pXk0BJ6LLvJVpk1V7tlFR8SDuEKncPcsiG9s6+lhga5MD3PuiYqqTzQ:Jk0raLvPpQl7Xx6AsqbGrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683517221, "uuid": "7e7b2546-7737-49ea-a6e6-4bd1c4c82c32", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683517221, "uuid": "c2ee1dbd-f880-43e2-a847-88507b23c709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683517221, "uuid": "d2713b2e-0b41-4b73-b0b7-ad9b75eebf67", "value": "8d725361377fb643449614a196f413a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4b1e92-eda0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550714, "uuid": "c12b451d-a679-4ea3-b3ef-896bd98ebbd3", "comment": "Malware payload (SnakeKeylogger)", "value": "0f323275dc3e41b9653a49c0fb5195e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550714, "uuid": "0ae87573-e722-473a-8886-8ae534cf05a7", "comment": "Malware payload (SnakeKeylogger)", "value": "fbadbfd07054097238ecc6ed27a1e69e4907cbf038b4cc2ef52bd2f07085d0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550714, "uuid": "2689956a-1c73-4311-9a4c-6ff3be4f5584", "comment": "Malware payload (SnakeKeylogger)", "value": "30fd78ef053156217c92e377000e75021a6320f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550714, "uuid": "1b14396d-e121-4c91-83f2-bed4ece6abfd", "comment": "Malware payload (SnakeKeylogger)", "value": "da341f521444b37a1ff2694443d3291f09fb37f3966b785bfe5cacbee097f41b1777b161f6b65ef4c2305e54c5c9361f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550714, "uuid": "193c8322-5d1a-4177-82ae-402f24169267", "value": "T1E7B4F15533FA4F61E9768BF02938B54103B131A399F0E55C0DE552CE6AEBF602EC0A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550714, "uuid": "4872100d-2520-4df2-9c76-d4fd217b68df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550714, "uuid": "e56d01e2-6212-45b2-a66a-6ae2133e6934", "value": "12288:MYEQS5E5eBP1/yiFqc4erQ5ey5dVE8+Pnb0WUIn:za57P1/yiFq7ekrVmnbFUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550714, "uuid": "38774e2b-6014-4071-9d82-3ca943cc242b", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550714, "uuid": "d3514b24-acbf-4ecb-ad1f-6a4ad9af9d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550714, "uuid": "74f9c189-ca4a-4c17-823a-cccf5a5da4d8", "value": "bvesTT9U0p8cfn1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aabc1f-edc6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683567107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567107, "uuid": "d33f63ee-4799-444c-819d-bbd527e820c6", "comment": "Malware payload (Formbook)", "value": "a0eae724a324d168ea7f600be5ca3984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567107, "uuid": "a20bd9d6-2150-49ff-b5c1-cf3f48ad395c", "comment": "Malware payload (Formbook)", "value": "fbcd0824d723107fbf65f4d82506544ff6514364e745242e74a8d7f86d16575f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567107, "uuid": "da5cb7ec-db99-4f22-adae-920cb9fc677a", "comment": "Malware payload (Formbook)", "value": "107fdd58bfa83415e8359e22dcd3710a006e4dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683567107, "uuid": "aa1f717b-7a44-459a-abee-c30beef39027", "comment": "Malware payload (Formbook)", "value": "d7a1b6243cc42736bc594e0d53235d88b450c9502085e89d5b4aa824c0301272aff365abd04ba1aff11bd9ef3ab42c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567107, "uuid": "0023197a-0a40-4eb7-8487-1695bf41419d", "value": "T192C412D0B1F68AD7E81E8EF4297CB941137271A794C8D6C84F35608857F7B416E88A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567107, "uuid": "33520d41-453b-4442-81ca-4e1fcab02a58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567107, "uuid": "1f0ace7e-040d-43e8-a439-33b3ad08bab8", "value": "12288:xnrTfq5uTjWegOT/oWiT9iIf7G7LyvNr/jh0uILNS0T:xnXfqoTKdweT9io7kLk5/jy/LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683567107, "uuid": "c8caa2e0-790d-46f1-ad5c-c3368c73b63a", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683567107, "uuid": "ff896e97-788e-463a-a734-556e6e446ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683567107, "uuid": "509d5dd8-df3b-42be-91fd-03958c0bee9a", "value": "Payment Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222182ea-edca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683568793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568793, "uuid": "6ccf9ae9-594b-4b45-8f0c-c6a5949d60c2", "comment": "Malware payload (Gafgyt)", "value": "7494251b0512b662aa1a6ed47ef29fe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568793, "uuid": "01fc1982-79ea-42b9-9c19-e71f13eb6f60", "comment": "Malware payload (Gafgyt)", "value": "fc1c0a8eaf1b798c3e72d4842a4bab10ddb55db44b9540ddcaac5954b6a20e5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568793, "uuid": "5c494e93-e874-426d-8759-db265ce48c82", "comment": "Malware payload (Gafgyt)", "value": "c1163dcd54d2d5dd88569bc871e3f7dcd6199f45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683568793, "uuid": "58a996c9-2e82-44d3-81de-7deb81ed90df", "comment": "Malware payload (Gafgyt)", "value": "b8ae13a5cf66c1ae6b60a25f7e1b741f8e6a8449148c2678f60633875b3438ac3b9560a0cb13499bbf238f11560beeb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568793, "uuid": "47a43495-9510-40ac-a1cc-fa9b9ef8e225", "value": "T116E39366BB619EB7D80FCE7309AA4501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568793, "uuid": "abf6c6dc-4e45-4a4c-a506-6e579f3ed47c", "value": "1536:LVeTVe4SsruJwYx0O9vPBysZgvsgxqAz/0ufMytVGpLfaMLAImlP+s4zWfOodW:LHYuJRBx+sK/PflMSImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683568793, "uuid": "9a6adac0-f0ee-412a-b24e-cb83b89f22f5", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683568793, "uuid": "55b6fe1a-dca7-4057-9adc-4e4e78d38c0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683568793, "uuid": "ed371b88-4811-4643-bda8-630c327d3db6", "value": "7494251b0512b662aa1a6ed47ef29fe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c312ce-ed69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683527136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527136, "uuid": "6bc70c4a-1a62-4dde-aaa0-4c93882aa635", "comment": "Malware payload (RedLineStealer)", "value": "f0fca1cbf4e4b62846f43b7240f2c566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527136, "uuid": "0239f765-e036-4761-b26f-da369803df13", "comment": "Malware payload (RedLineStealer)", "value": "fc7638f62d84fd3e510ac1cd6c3db50f5f1851947cec10aa27fc897ec893228d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527136, "uuid": "f8268c2a-e4d3-4ae3-91c5-7cda3b622bc7", "comment": "Malware payload (RedLineStealer)", "value": "9554c9f601b520a50fb991448822520db339cc69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683527136, "uuid": "95793917-7abc-4bfb-bffe-5e812929833a", "comment": "Malware payload (RedLineStealer)", "value": "910a1f05967b04651e5a59f576529c2446ba1e8b9c33e8684d0fb3ba61270de285bac9be96cac8342b12e8a4d9c57aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527136, "uuid": "8d89fb11-6b03-45f1-b769-512df56a81c2", "value": "T14F64F90382E1FDD4EA268B729E1FC6E8779EF2508F59776A121C9A1F44B01B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527136, "uuid": "c185aea2-c45e-4c4f-a968-b7fd49ebfc38", "value": "513663070e5d163878e1cb9d4a5e6408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527136, "uuid": "fe733897-934a-49c8-9ce9-e04f7aba7349", "value": "3072:tAX8vPXctGlJOCLRFIARRAfk1FawK/AyAnnwe8UHKssCgI5gM23P7WLOumeCQ+T:WeXc8zLHIKAfk1BSAna0AJ96LOumeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683527136, "uuid": "a8bb9a75-35ea-4998-87b9-18a0d19f183b", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683527136, "uuid": "bd758f5a-c2a9-4db1-bfd0-e3c3d2a7c45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683527136, "uuid": "bab8325b-fa50-4a3a-818e-0e3ee5286dab", "value": "f0fca1cbf4e4b62846f43b7240f2c566.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081c1de6-ed70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683530094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530094, "uuid": "f28344b5-6882-46cb-a8cb-42d9d8798f41", "comment": "Malware payload (Mirai)", "value": "b70fc10bf1ff3965f8c3e6b9548714bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530094, "uuid": "a60e34be-d624-4ad9-b111-cbb5760c697f", "comment": "Malware payload (Mirai)", "value": "fd4ceed043f3002cc082e2b3b718e2a69a835047eb698c7d58d6395373a9442f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530094, "uuid": "ac97cadb-326a-4a80-b66e-2a1b27f1e694", "comment": "Malware payload (Mirai)", "value": "2e9e740b01a54c5f64b359169c8bd0a448e9a09b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683530094, "uuid": "d80972bd-f5eb-4db3-b28f-701caf4e949b", "comment": "Malware payload (Mirai)", "value": "7385734e9038188f1f057b3d4f846178e4cfb43eaa6cffa34a8f6b3f9ea9282dbc65b88099ff22e9d041f840708b98ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530094, "uuid": "74c11dc0-0fc1-480a-a128-475a614bfd87", "value": "T109335B43508588FCC4E9D2704A2BD435E127F42E027AF69C2BE5FB227FA5E625E6D580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530094, "uuid": "1f47c03b-481d-4e6f-8218-567a6a5a5fd2", "value": "768:40jFeigM2c40pJ6LsQUbFPXrQ7x//f8hdU9B9QzUYPM964NGOL:AiH421QUdXIBf83U39QAF64NGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683530094, "uuid": "1094300e-4a14-4b60-af69-76df6b78194d", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683530094, "uuid": "fb131793-5be6-4d8c-b84e-b95f650e438c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683530094, "uuid": "8aa55e7d-30ee-4954-8720-248a703573c4", "value": "Andoryu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2a4060-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683550636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550636, "uuid": "eb20bbbc-871c-4b9e-a9e4-a4d39772a77c", "comment": "Malware payload (Formbook)", "value": "6a0737ff7f12954f5caacac6d3ac6b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550636, "uuid": "f9980720-130e-47ef-b93b-31fca86f8075", "comment": "Malware payload (Formbook)", "value": "fd969f116ad42b7daa0fc85cb45fbb2e5c0982ac6c59b88e7859d298292379f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550636, "uuid": "58dd0e93-221b-455f-b145-b2d13c887821", "comment": "Malware payload (Formbook)", "value": "9e30e52c07cbdbf915fb09ab89e82ead007b3060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550636, "uuid": "b065a65e-7f67-4762-a80b-22d71eb4dfc1", "comment": "Malware payload (Formbook)", "value": "5619057cfaf3445fb6a43c6f2affd420d59a1f1345288862da615bac86e52bb317f0b02291380fd6cda36717a1f80183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550636, "uuid": "6f67e2aa-25b2-495a-b085-5193cd6ca982", "value": "T1EDA4123FDF711997D13CA33162E81D131F96A21272087F3809CB9DE5A5B7A606B93983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550636, "uuid": "87a7ee39-16b5-4de6-8492-d1e8c438b729", "value": "12288:I8gBwizg4JoqlynH2QcEKU/C0u/RiHE1Y1FLca9vlJiGfrwKc5/Pr+rcnW:I8gBwizg4JoqlynH2QcEKU/C0u/R2E1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550636, "uuid": "a10684eb-8198-49cd-b6cf-bf49f91b18d9", "value": 484704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550636, "uuid": "dc651c4b-1257-4119-9410-8529077e9fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550636, "uuid": "3258f1ef-bee3-4069-8f73-33f20f488024", "value": "HSCANNER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef2d6f7-ed9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683550480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550480, "uuid": "16343ff8-c6ef-4b29-ba41-dad019a6d9f0", "comment": "Malware payload (SnakeKeylogger)", "value": "eb829d561a09c941102aa094b379f4f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550480, "uuid": "bfdd1399-4465-4d55-97f4-2e238e051ab6", "comment": "Malware payload (SnakeKeylogger)", "value": "fe115e2f52a393dde19834949351aab5dad7e0aa5021f66b863cef86c1180c67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550480, "uuid": "7e35bbe3-83f9-46be-a881-87d46b965f1c", "comment": "Malware payload (SnakeKeylogger)", "value": "5dfd81843ce3cca917bd29fcdf142a66b6cc1f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683550480, "uuid": "dece4a24-b67e-4947-9bcd-21a71931c7a4", "comment": "Malware payload (SnakeKeylogger)", "value": "2b47b62e908d830bcbcc0bc1fa0e48417bec977ef56bdb524f7db35ff8269e197cbb2c2aba4c40ecef36edce681d3b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550480, "uuid": "0aeb59ef-bbe2-4ee8-abe5-a53eadbf01f6", "value": "T1E0B4F15572BA8F61F5769BF41538B44013F234A358F0E66C0DF611CE6BE6F102AA0B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550480, "uuid": "a89e6227-9588-49c9-843f-d571810ffb3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550480, "uuid": "ad9cc5eb-aa44-4652-80ff-182a52db592b", "value": "12288:+7VwcH+LvD9wV3Fe37JQqPmbalAjtAJmXcf1Y8r:lcsLZRPyUEId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683550480, "uuid": "d5f17fc6-6d7d-4de1-bd84-e7a5f03d9f31", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683550480, "uuid": "17b32aa1-5667-4d6e-a739-e4f9293a5ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683550480, "uuid": "f7571b7e-6ca6-4ccf-b662-691b726f099f", "value": "08.05.2023 SAMSUN L\u0130MAN RAPORU.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf5916a-ed7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683534802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534802, "uuid": "6cc3b04a-66ca-427a-b104-1c1b61b66264", "comment": "Malware payload (RedLineStealer)", "value": "878406150296b76bd9418f40aa8fc68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534802, "uuid": "90a5b9c8-cbaf-4383-9954-9e1857794865", "comment": "Malware payload (RedLineStealer)", "value": "ffb8eaa7c99aec6346c904a7adf3fedaad7f758a72eddef93b6aa6159f033e9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534802, "uuid": "1a3e7768-d0d9-4301-af7b-efc4f31dde61", "comment": "Malware payload (RedLineStealer)", "value": "886be07a64fad652d9e169368afeea79f23cd8a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683534802, "uuid": "fc364869-8a31-4c9d-83e3-fd2e55c2916e", "comment": "Malware payload (RedLineStealer)", "value": "9317a33efdd3c5f0e7ceb34314ee3c14e1c1332c37aade19a71ee0f2e33b4a88f48d1d2ab4ba589aac1273e3b7be3d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534802, "uuid": "2f3de52c-28af-4d8d-8c7e-20fc8d4533ec", "value": "T12BB40213A6D89133E9BA2BB018F602931B367DA15D3C835F37555E4E2CB26C4A43277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534802, "uuid": "a3261738-e3e8-493e-991f-ad814492ee9c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534802, "uuid": "fe8cab7c-7a14-43cc-a4a6-c5c3cccf8aa7", "value": "6144:KMy+bnr+Sp0yN90QExlnzvrdekW8nZNX9eyA2oEWYjebG/lNh4XMpvKA06YgoMsM:EMrSy909nzv5dopEGbG/lNWavE6oNw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683534802, "uuid": "031414ec-ef3d-4d0a-b189-6f3d829da9ae", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683534802, "uuid": "c4ba9706-57a5-43c2-a5ae-2996ecdeb585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683534802, "uuid": "583b83a3-ad06-4e8c-b3be-a70ee2d75302", "value": "878406150296b76bd9418f40aa8fc68e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }