{ "Event": { "published": true, "date": "2026-03-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-24", "timestamp": 1774396981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e1795927-e368-47e7-9ceb-151a907cc9ba", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b6b679-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343251, "uuid": "62002e61-f38c-451d-b234-130471da1207", "comment": "Malware payload (AgentTesla)", "value": "6675c8ffd0262d8db33cac5e55293445", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343251, "uuid": "d9d2b5ac-4874-4977-b4d3-7e3d9e6ce636", "comment": "Malware payload (AgentTesla)", "value": "00f544e19abcf848453a4bce497482c900272f57b51e9969daa3dc4d5a721939", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343251, "uuid": "0f0ca8e5-4c6d-4702-a2f3-312531686078", "comment": "Malware payload (AgentTesla)", "value": "ef93f10922202ea787253fa919dc34fb60f130f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343251, "uuid": "60e2d14e-24e9-4d15-9030-22af0e6c50ca", "comment": "Malware payload (AgentTesla)", "value": "687f34c5f78d85a25a0bca1c088840f12e85a86df04b4244a9fe6311ba89d287c9e5bf6fdbc1f426f92c289cad1bc190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343251, "uuid": "aebb6c9b-666d-4be1-9a1a-4be0110e821c", "value": "T1EE65B021DD8C2B1D9760A34C40BF052A67F18868B5257C9E0377FE9BB75A881BE136CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343251, "uuid": "d35bc113-80cf-4e78-a595-036f36bd67ea", "value": "24576:uy8+/Pf5hNTUPeN/H1GOdWdIegvuM+qEP7dyA6BSgoxx/3Mr7hb:Uc3tP5q7VnA7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343251, "uuid": "c6f71360-9b53-45c1-a09a-2a8b5d6eac55", "value": 1425154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343251, "uuid": "7603f881-6872-4cc1-bae3-377957727120", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343251, "uuid": "bd4cfa76-79f6-4ddc-bd0a-940b0900df00", "value": "6675c8ffd0262d8db33cac5e55293445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1ab877-2778-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774353498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353498, "uuid": "b63f2121-7b60-4107-815b-7bf5072a10c8", "comment": "Malware payload (AgentTesla)", "value": "6d774497b9f95dff9a6685d37641c2f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353498, "uuid": "2ed6058e-bbee-405b-8f89-4b8ee1f1eddc", "comment": "Malware payload (AgentTesla)", "value": "0133cf379f713ab2be7c7d06a8ad56b072f4952c83b87ee8d3dc0934b0a447b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353498, "uuid": "404d7a1a-af6d-4345-95d8-c52304afe47c", "comment": "Malware payload (AgentTesla)", "value": "7d3e2051233a0f27421cb466683ffc81d5dcc781", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353498, "uuid": "33c80872-8763-48c7-9660-d8497314ccaf", "comment": "Malware payload (AgentTesla)", "value": "ec140ff9ab53b5c07f3f9a984b74002f4aac5ab948df2b0dbdfcb5abb23044a7a9a553c8339657c7255a6535d4c8e1ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353498, "uuid": "1d10d0e6-e3e7-430f-afbf-91e2b55a58f9", "value": "T17055AF3747D86B67DC8ED21741EC411C6FC0F98F50D5AA4B9CFB6C2BEC96844627222A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353498, "uuid": "476f30ff-fec8-4b4e-810b-0df2fd517095", "value": "24576:NrMU8CvDagXSKXs//+8UrYk+1HrLojx1LTgcF:rse8SYk+1HrLojvDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353498, "uuid": "b94384c8-708b-48e4-817b-1fdc5554a058", "value": 1390923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353498, "uuid": "a58d593b-0c4e-4797-bfdc-486da310b46b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353498, "uuid": "4e96b69a-fe25-4f66-bba5-511e9d6ec4ae", "value": "Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b7ab2f-27ad-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774376356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376356, "uuid": "fa09c1ce-dc6d-4f27-ab69-18e04991093a", "comment": "Malware payload (SpyNote)", "value": "e2192a941121eecf8ad8921ac8b6be05", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376356, "uuid": "ef549437-5d4c-4b5b-886c-db6bc69e3995", "comment": "Malware payload (SpyNote)", "value": "0172d6141fc03c2e152caf35dce6c90cc0cec4f303de270f09136b93f1e99bcf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376356, "uuid": "1729258b-b46a-4ea0-882e-f54b6ae068ac", "comment": "Malware payload (SpyNote)", "value": "1ca6463e5a59fdf8accbca0c8bcf0df1b0666924", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376356, "uuid": "51afe71c-620a-4a38-8dd9-56d063fcf9d7", "comment": "Malware payload (SpyNote)", "value": "73711edf5b49a58d009ba4064dd433adbf27264fdbe34e241ece92bc93019eb9ffc583705971b98a7ea48cd9200ce146", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376356, "uuid": "1f67fe91-bf4f-49fd-b9a0-46704084ab73", "value": "T1C406E043FB4ADADBD9B9C3B12B730D991A170F08C642AAD745147A3D2E770C64EC5A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376356, "uuid": "4b5e8c3f-2229-403b-8a1a-d7a873d0a1bd", "value": "98304:rn4M9OM/9wXO3YQ1v4xo9mZwmz/zB0Tu0tECsz:rYx/VZPzuVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376356, "uuid": "ac411d9e-3b0d-4bbe-98b0-0b98dd720e5d", "value": 3919308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376356, "uuid": "da6be03a-dfdf-40b3-aed7-23fb27c4d023", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376356, "uuid": "ad0ad695-c3bc-4455-aef6-623348f1c5bd", "value": "SecurityPatch5.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f0aa69-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1774342897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342897, "uuid": "84ea2dad-8ac1-41fd-80d2-d0f7fed4702b", "comment": "Malware payload (VIPKeylogger)", "value": "c68d9bf1cc55f6acdc7ec9b3dd168452", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342897, "uuid": "9abb8242-8506-4c69-94d1-de9de68d29ac", "comment": "Malware payload (VIPKeylogger)", "value": "018cd4a29701bd7eb25c3b6891f2745b347d1f8b98e4cd6d1fbc8157fd671fb9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342897, "uuid": "a6fe1731-67e3-4feb-a1d4-17601d97d503", "comment": "Malware payload (VIPKeylogger)", "value": "ef774af262df7b74ea3136deaa050e58e0dc89e8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342897, "uuid": "120896e7-0415-416a-8cdd-61c9c9ad9eea", "comment": "Malware payload (VIPKeylogger)", "value": "01843d195ed656c7fabba15469227fdeb19e2abf28e25592778c6cf2aa7fbcb23c1d3f2dfd12ce84a8a9823bb6f9a35a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342897, "uuid": "98a9c198-e154-4b70-bc66-c0746ca9fcc4", "value": "T14DB50F7D716D26327E18E528C51FFC9A9CFD4004AB5B2C8346B629FEB4043E2ADD16E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342897, "uuid": "9b8d5981-ae68-46df-9167-6c221cd280d9", "value": "96:eAsOnu0S+51drEy2HbqdMbWibJdxnbrqb1MyvbAXwWdVKBgTegbSbabtBbzbHpjH:Q4N1q3QXaWC1C1Wj8jCvD0Tmn5J85iUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342897, "uuid": "80d94022-cf0b-4a09-8202-f69e00bc0987", "value": 2432331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342897, "uuid": "de236bed-e9a1-4ed0-a313-be3e189f96c2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342897, "uuid": "43324263-fbb8-401e-bf42-da560c21b4f7", "value": "c68d9bf1cc55f6acdc7ec9b3dd168452.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bebd3b-2791-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774364005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364005, "uuid": "1c35b75d-c8c7-445d-974c-39cee98dee48", "comment": "Malware payload (Heodo)", "value": "8e95a4938a85207f04052566b2151de8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364005, "uuid": "d1f0487e-875f-4d77-8cd9-d21a30c8d6b1", "comment": "Malware payload (Heodo)", "value": "02b283f8f67578c289c8ad4f95fd764cca9519206d122b99146ccba25e5e6b06", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364005, "uuid": "85aec051-4f6d-4748-96be-9dbf9c8d2a2c", "comment": "Malware payload (Heodo)", "value": "401929fd6fe95d70603617b0366045dc6314b9dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364005, "uuid": "0f19f307-d0c6-4ca2-b226-eb881244034a", "comment": "Malware payload (Heodo)", "value": "533424729407de4666fa4e08a7f1ef126bf8480f5611b8abbd7376859a3738e8f41fbd2bbd0abe439d7490d7c375f259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364005, "uuid": "6168cd55-13ca-4c19-a34b-ed9506f40ea5", "value": "T1BA432A03BB81D8B7DC5E95B952CA95992E67EE7003071AC383B334B31DB2DEC54B4989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364005, "uuid": "f2cba061-e417-445e-ae23-253b5a7ce713", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364005, "uuid": "2b065ae8-221e-44c8-b151-990d15fdbab6", "value": "1536:qnWi+MPwg0GwVdaT1mgojaAhB3w7EHEFkb3iRPd0bc:BGhBmge30p2Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364005, "uuid": "18029ff8-9437-4328-a4bb-2bb79350bb58", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364005, "uuid": "6e2f9ef4-b23e-431b-a004-b564c4b8293b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364005, "uuid": "a57572e0-8c7b-4338-9af6-ceea25336353", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d91960-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383847, "uuid": "ca4de213-d3b8-4826-bb34-1656f9446dcb", "comment": "Malware payload", "value": "59f38af1c8b089076b270c5bf48b5565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383847, "uuid": "6fc6122f-b69a-4d45-b955-c8847db69cfd", "comment": "Malware payload", "value": "02cbc77d52e12aea6a6c9db36c07d2eccd1af9d39b88b3802b40cb10d088b30c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383847, "uuid": "64294bfd-1429-4649-9906-55e6407fbad7", "comment": "Malware payload", "value": "13ac35ab448647262fdf5487034afa9303c2ba4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383847, "uuid": "977adebd-8db7-41d5-9cd3-f4b8eaba0dea", "comment": "Malware payload", "value": "8e93b3cfb1a3117e374fd4ee47ad15e9eef68d8658d19f1f73e7cf4a02ce0c29cc1c87118a0a47082e427d61da12f0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383847, "uuid": "ad9d24ea-bb7e-48d8-bea0-579162f9cc9e", "value": "T136563302F7DB2431F8E56A3AA4A188846CD7F8DD19F5D8063C79CE0C497A9DA5D3BB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383847, "uuid": "973abd32-aa74-4697-9dbb-2a543bf912bd", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383847, "uuid": "d22bec6f-dfde-4b75-95ae-8c437c6f5544", "value": "98304:D/mjrOV+i5z2Ry/lJMEVLOfOnr6q7uDQIRzua9xVsDI2UseyqUgSB3u54E:D/yr++i5KOlJLOfOnrt7usS9xVs0RseB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383847, "uuid": "62e153ad-162b-4b6f-8865-8c93ff5139d4", "value": 5886968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383847, "uuid": "09da3f22-582c-4671-abaf-bc1a6b595e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383847, "uuid": "1cbd805f-8023-4b71-a38c-e9ed882ca539", "value": "C__Users_user_AppData_Local_Temp_cszfr2y4.aax_SettlePay_-_Billing_Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663be977-2730-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774322425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322425, "uuid": "1b6e8318-1ced-4cf4-918e-a9063783de9a", "comment": "Malware payload (Mirai)", "value": "8b0bd8ea1893b90106f8388d6c23a43f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322425, "uuid": "6c3cb402-95ad-4f67-af2e-fd0d7ea7e91a", "comment": "Malware payload (Mirai)", "value": "03096b594d91f602f7ace0f16dca473e38af6f43ee33e7c2b713e169c70eff73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322425, "uuid": "f4fc806c-d216-4f47-94e2-e88e24fa3695", "comment": "Malware payload (Mirai)", "value": "79ba1f1dfab9056a6a3abdea107f80f0e4ac1e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322425, "uuid": "a05a5175-a00a-48df-99d3-98bb0b27b73f", "comment": "Malware payload (Mirai)", "value": "c7f082fbd086a2fd58d0d7164889fb60c20ce64be8c6ac44cd8b8c3df699becb9fc9e310e4e0ef008adfbac563afd6f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774322425, "uuid": "9604a64e-419c-4e64-9bf5-24b02b4239c2", "value": "T1C71308B42515F7ACEEE10079F04331E629530A1C36DCE3D3B1A34266EEB4B4C7999E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774322425, "uuid": "44acacd7-0916-4232-89f3-b5ceab51a837", "value": "768:3e4TKdmtcP+5Fe7BMVGLD0PqSAJ6ba7A5aTlw:3e2S+4tmGf0PqlEa7A5aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774322425, "uuid": "92039cea-286e-47b6-a28a-03ddb02b1eef", "value": 42776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774322425, "uuid": "2f93607b-3416-4487-b430-a92d4de667af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774322425, "uuid": "b88f2107-c9da-448e-aa4e-4597b8e81beb", "value": "tux.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da3b665-278b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774361548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361548, "uuid": "aab626a2-26d1-41d9-8bc8-ac9d7fc6adfb", "comment": "Malware payload (Formbook)", "value": "89ab302d083d0394d78c47075b6d659b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361548, "uuid": "7738614c-4027-4a12-9112-9e69504d6ee8", "comment": "Malware payload (Formbook)", "value": "0309d60cd7a0911ec64fa72e33ce9143d88f8c85ad8758c3e4b6100cd455010a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361548, "uuid": "a5bc758e-08ee-4e15-81e9-4045fb22ecfd", "comment": "Malware payload (Formbook)", "value": "3e712d0969044166a02191fc684cc4626c271c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361548, "uuid": "511a9e60-2867-4aa3-8858-901a70ec07d6", "comment": "Malware payload (Formbook)", "value": "869129ff0a7558ed1842d4b00b91404e5af24f9f84c2bd60ae39f125a0e0689aa3b1144ed6ad96e7320410be70a733ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361548, "uuid": "e9f7490b-22e1-4f5c-98a8-46495c7adcc4", "value": "T12A3501582699E902C4E26FF45D71E37827B49E5CA411C303CEFEEDE7B52974A38442A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361548, "uuid": "df16bbdc-9029-4960-b55a-a0192433c058", "value": "24576:xNcia28ZjqUw1Y3xgG/4jFsO5CGkpV34cXWInK4P7M9rcBuY//vu9Nkln:Xc/jjw1YGy4jFjC5VIcGInK5WAY/3u9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361548, "uuid": "a3581f80-c8ef-4ace-8ae1-bd53a6b0914d", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361548, "uuid": "2ee68340-c60f-4d56-86c6-c8a17aa75b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361548, "uuid": "d94824e8-2a26-4541-b1e4-3dff7ba303f1", "value": "NH CREATION SAUDI PF 52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82606af0-2797-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366710, "uuid": "0f414498-ee2e-45c7-89b4-f47e54f43240", "comment": "Malware payload (Mirai)", "value": "0dd3dd4e938044ed0a965786a31cf0a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366710, "uuid": "c822a4a8-dae7-4b79-860b-6ad9619a17b8", "comment": "Malware payload (Mirai)", "value": "0351b05a8edcf28fef1f9f8865c445f06202cf0c9aa4de49981e971eebf9d0d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366710, "uuid": "1e7b0d93-6b88-4ce2-80e6-240e70b407e7", "comment": "Malware payload (Mirai)", "value": "ecb951509fccdbbbd85cc662e1487f67d1678742", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366710, "uuid": "c0d976c1-e555-46af-bf22-dae037d6fb9b", "comment": "Malware payload (Mirai)", "value": "d6a11e897bac0570a9bdee6034e4b3ade471463fce1b317d04caefe3fd63e499d0be9c760d941d4e4d311426d05257ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366710, "uuid": "16a68a54-c2af-4722-a217-616aad3ea76c", "value": "T13F536BC5EB83D8F5E81705755133E7378732E43A106AEA93C7A8EA37AC52601EA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366710, "uuid": "9cad57e8-ac3d-42a4-af84-7dc0cd1638e0", "value": "1536:rB5Yx+3CcxUoU3GnGN+ETURab3PCHPls1lV8rZbC:d2xCLxUok+EIab36HNszk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366710, "uuid": "04231e03-5ad0-49de-881a-e82a1bc66988", "value": 62548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366710, "uuid": "7a96649b-f5ae-46f4-b360-99627b5d3482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366710, "uuid": "8542b671-2db0-4298-ba13-09c3298e2f84", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8156d4d2-2796-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774366279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366279, "uuid": "798bab3e-5546-416b-9774-9289307d00c0", "comment": "Malware payload", "value": "aac9a89fab496fea9970898be48b8c95", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366279, "uuid": "79a6d994-482d-486a-9188-6937d7b41dbf", "comment": "Malware payload", "value": "03c3787f4718db16b3d08eba3ad8e4eb235ef3f243682c02e1e0018891726646", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366279, "uuid": "b2cb1604-b776-40ca-b312-12bfced6085b", "comment": "Malware payload", "value": "207135d59597c2b1c8f0251fda00fa23ce594492", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366279, "uuid": "e16ab1cd-9467-46e0-ae04-bb08e29b9e15", "comment": "Malware payload", "value": "d94ad6458efa5d8c01c6b259c6cd70caf81d85a4e6ae0c9d8033514a8e4803e6275ba9de5862ef465df67e7722b1e190", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366279, "uuid": "264beeaf-d0b1-446c-bb7d-132195a2a4a7", "value": "T120F5339873BC66B3C17F9AB2A4D5024257B497879A3AE70F8E8672DC1CA5BC1550330F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366279, "uuid": "96ed145b-2ac9-436b-a182-4a4ddebd2e76", "value": "98304:WF4hX9TRnpdSiFln8oEct2AgGQ9GrBQ2DeRbxVER:O4xnzSalnQctYqS2q1QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366279, "uuid": "3b0b0cd5-8b2f-440e-bbbd-1cb33d586fab", "value": 3342848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366279, "uuid": "56995282-e951-4d27-8731-dc1313047cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366279, "uuid": "3bcc4be1-e12a-4768-a2c3-341aba7e34f5", "value": "03c3787f4718db16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe48046-277d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774355720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355720, "uuid": "1e96fb7b-5716-4564-a9ff-7b76074e0eb8", "comment": "Malware payload", "value": "1923b26d75e7be87fcd330714c76d2aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355720, "uuid": "bf28f9ef-db56-491e-b8e3-3c6dc7cbaac6", "comment": "Malware payload", "value": "03d48d476d5fed2076dfa7fae52ab64310f0442bbd84e32e5a53d5ca9093a1c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355720, "uuid": "efd5c229-5c6d-46fa-8cad-e536d4670938", "comment": "Malware payload", "value": "09a86c3e63693b773e5442f7dfef94dad0189d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355720, "uuid": "d126e46b-624d-4e63-ba3b-2b2e32636124", "comment": "Malware payload", "value": "846c54ebfba8a2ad7e79556197a39339ebe1b0a903091b691340bd85a4f74e900dc3fd0b8fcb1d19da5fb2e77f7f4355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355720, "uuid": "39ce7952-9a17-41b5-8b59-69b89736e83c", "value": "T10E845B0693F9951CF1F74F88AA7A40615A77BE961D3AC02C12AC240D5AF3E18C9B57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355720, "uuid": "99abdd4e-c452-4e85-bfe4-a3e7d3edc335", "value": "6144:kOSFo86DeBBmsyy2K69d5jctPgrvboTyPsIyBJ/vdl4f09XS+/eRNveesMVh2j8Z:kOkz6yBBm669d5SPgTymyr/vdg09Z/Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774355720, "uuid": "2e3d4837-4c11-477e-843e-174c2fae4ad9", "value": 378094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774355720, "uuid": "9a2fa399-8a39-484f-8f06-b63f0ca3a49d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355720, "uuid": "40eb618e-58a0-4155-af5f-a5da68f66491", "value": "NEW ORDER-SUNNY 1000591600.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1334acb1-275e-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774342042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342042, "uuid": "0b95742c-8f3d-44d1-9d3e-3b52b5fefdd4", "comment": "Malware payload (NirCmd)", "value": "c613550b1167c20454751ce1a421c241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342042, "uuid": "9e9d6596-b208-4828-b980-4701c5aff9c0", "comment": "Malware payload (NirCmd)", "value": "04044bec6d1ac30e8b6777ffc8404b57417ababdb5cbcb24dcca8cbac40b261e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342042, "uuid": "17da8721-9d65-4d97-9f9d-4ff70a0b2fc5", "comment": "Malware payload (NirCmd)", "value": "75d26d278c098d6d327c8c3708348b6fcdba4f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342042, "uuid": "0dd33d8e-28f3-499d-b8ad-1d54e031673c", "comment": "Malware payload (NirCmd)", "value": "6ccf6238347551c5251cc716a1dc9124884cfbce58d7b62dece0de06f7cb990169e14849eb2d6b728954e6f6bb8a0ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342042, "uuid": "10f43451-124e-4626-8856-3406fb501f4e", "value": "T1B6A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342042, "uuid": "f85471b0-427e-4ae0-b5cb-6438240e278e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342042, "uuid": "6466b2dc-4017-4a16-bcb4-6f30498cb576", "value": "49152:ABRhTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a3TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342042, "uuid": "edb39d92-372b-4189-b8f0-d2407103b366", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342042, "uuid": "dfdece04-5093-4418-b5ba-b5b058925d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342042, "uuid": "b57311d1-7540-44e1-9d57-01eb437354a8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9404ef-2795-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774365732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365732, "uuid": "ff2c2a01-8802-4e2c-b127-400a69fdbcad", "comment": "Malware payload (Heodo)", "value": "bb1bc8e7ae4e31eee7b117a825b576e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365732, "uuid": "9bff04cd-d4af-44a4-a08f-e5b035ae871b", "comment": "Malware payload (Heodo)", "value": "0452908a27eb9abf853e8d1b099322a77f2ecb4096be26499457f844de273377", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365732, "uuid": "d5283edd-39c8-4554-97d2-4c6b07cbe81c", "comment": "Malware payload (Heodo)", "value": "14c731995693366a2aee2afbbf20474e61943d89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365732, "uuid": "a578079a-1040-49a1-ae43-cd3833484a61", "comment": "Malware payload (Heodo)", "value": "93cfa7005d9965e73984ecf4b0b3c625bc5233a45f6ce7fcf156bf69ffd22dcde3898f44291dfe901c1b6c8838577549", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365732, "uuid": "2d068432-f0db-4051-8c29-d191e4f9d795", "value": "T1BCC3AF437584C4FBFC8849746CFAB6A60A2AD53183434ED76373384B4CB9AF668B045D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365732, "uuid": "ea7a1849-5de2-4c86-96dd-b0e91e6f5aef", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365732, "uuid": "993b4fae-58e2-4a2f-a86f-9297149ccd40", "value": "3072:IDpJoj/4imrRBF/pstBaDqwONnct43rBl3N2U:wp6745F/p/uwONct43T92U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365732, "uuid": "8f8986d9-ba62-4586-b0eb-c3a8125dfcb7", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365732, "uuid": "4775680c-4892-4a87-bf24-6f4b529a43ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365732, "uuid": "4f06d5e0-1084-4d8c-80fb-b8ab83940e16", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77435363-2787-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774359820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359820, "uuid": "b273caf8-eb2a-4853-95f8-6a63ccc579b4", "comment": "Malware payload (AgentTesla)", "value": "1eebdc429d5541caf060f7c3b6452213", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359820, "uuid": "2840df99-8f19-484c-9e78-379bd5706ae7", "comment": "Malware payload (AgentTesla)", "value": "057dd07c9fe02bf1560249258a6bbe88a39f8d02a1a754ff655ad83f99341669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359820, "uuid": "dabd552e-9b6e-4fe7-a359-d4e48f55cdda", "comment": "Malware payload (AgentTesla)", "value": "f6d6e0aff56c46e97d519942d20c88104c9728d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359820, "uuid": "a78a4940-b66e-45a5-a04e-76f8a30ea037", "comment": "Malware payload (AgentTesla)", "value": "06caed94d12c24cb6e1a47ea9f11bfce906c4ad068ad275792f57ff6fcc8f79a7a598a6e13eceda32b48f88a71df0113", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359820, "uuid": "9312413c-ec3c-43eb-ac0f-ade7fdc8f679", "value": "T14F2501553658DD03D8FB2EF81962E2B413B66DAED422C7868ECE2DDF35E1B01150A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359820, "uuid": "1c0e14c6-dd41-4284-ad94-5e9897a78896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359820, "uuid": "728e4046-3378-4563-a4a3-288d5e883f1e", "value": "24576:pMJXqq9VJf1WIH1KfMCXTO2eEeWd1OgmSCj:pMJJ9v1KI2ehgmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774359820, "uuid": "8d8b5cfd-9bf0-4f21-ac6e-f10c97c6cf1c", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774359820, "uuid": "4947acea-9ec9-4696-9aae-4b90c54e7ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359820, "uuid": "50505fd4-94a4-4f6c-83b7-5c9a5348b63d", "value": "Unpacked PE Image: 32-bit DLL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727ceb7f-2737-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774325452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325452, "uuid": "24bfa15b-fad1-472d-9980-9e7a4fe09c9a", "comment": "Malware payload (Mirai)", "value": "d3762ceffa02c5f1b9573a2a154ef288", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325452, "uuid": "a4fdc5bc-024a-475a-b032-ff3894e26526", "comment": "Malware payload (Mirai)", "value": "0588790ffddd8154f1d1ea6bd11464fa8ab1116f5418c11b5e5c82a923379b63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325452, "uuid": "59d47c7f-e1eb-4a3c-a029-df22579870ca", "comment": "Malware payload (Mirai)", "value": "fb12081bd6436672d0fea4a07c63d5379fcb8064", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325452, "uuid": "da5a55b2-b3ee-4c85-87e8-dc0248cef39b", "comment": "Malware payload (Mirai)", "value": "0ddbbad858f8e2fcf9a98a62fdf5ee02ae802fdbe9354810a6bcfc51a44898505e3c5266d2e1c41ef445c9d5e9549e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325452, "uuid": "8d15cd39-c856-46d0-8efe-42acf4470765", "value": "T145733A65BC815A13C6D112BBFB2E428C372613F8D2EB3203DD25AF11378692B0D6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325452, "uuid": "6a70f5fb-362a-451e-9ca6-e7a8899fb8c0", "value": "1536:iOl5kza01lp3eF/x9MkdD/xlFG6sgE+R3SwiFou0VL9M1vFaP:iOl5kTpQnD5lFT5Swru8AG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774325452, "uuid": "682e2c0c-520d-42f4-a261-fd562547d39a", "value": 75200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774325452, "uuid": "9cf07da0-7ff8-42f4-acb0-f2fc29028f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325452, "uuid": "4cdc3224-334c-4232-ba14-52c9dfd9c63e", "value": "tux.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcc5394-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366974, "uuid": "bb5999ab-4240-4a3f-ad6e-b41d54255b34", "comment": "Malware payload (Mirai)", "value": "fa30b566cb84a7a541fdcc207400dafd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366974, "uuid": "7af651b2-fe1c-4e1d-bcb1-289ad24dcd87", "comment": "Malware payload (Mirai)", "value": "058ab1e6b979b3a446f203e079ec8bfc00357b913cb2c263bb12482710ff0f9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366974, "uuid": "6c736546-380a-4b4e-b7a5-621ca6f307f2", "comment": "Malware payload (Mirai)", "value": "ac96c8da399b3afc08ddf97983b30d1e1e3242be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366974, "uuid": "c8fe0848-8ef3-43eb-a0de-b9de9918e50d", "comment": "Malware payload (Mirai)", "value": "b618317e8ea9c1f91b7eeed343088fa91e2846e36eb8178fd0c1c9e3ba611db2056d26c666e29a7fd3d5acab950b1560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366974, "uuid": "51d2486c-0eef-40a3-b6e6-4df2e9cb38c0", "value": "T13463951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366974, "uuid": "120f5038-3792-42b4-9742-37da20da4a49", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAl:UnN4ZH2SyOyuIq8LMeIUq+cvtpvXzcL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366974, "uuid": "6aa714a5-f41c-45b0-927f-63de789de3c6", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366974, "uuid": "8f2bab7d-3ed8-489e-8872-027862ed1b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366974, "uuid": "9ba2472d-f0aa-4272-bd03-2d2b0f050a35", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7751ea9-27b3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774378932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378932, "uuid": "58fb5c9e-7765-4601-ba0b-787327f6aade", "comment": "Malware payload (AsyncRAT)", "value": "87928a11d9612291ee0cd86e0e093a7e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378932, "uuid": "d5aa5b9f-c32a-4a48-bd01-660aba8643e0", "comment": "Malware payload (AsyncRAT)", "value": "05bd9f83a216503de08da33f08da06b9ef72f767556e941eb16d8bc6224e1584", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378932, "uuid": "2097183d-aa79-45e1-9dc2-8bffa92d204e", "comment": "Malware payload (AsyncRAT)", "value": "da0d43978f02152ddd2fde83b710da4b08399760", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378932, "uuid": "2758c945-dbe7-4084-b51e-d0b0b316fa5c", "comment": "Malware payload (AsyncRAT)", "value": "d5e66b191cbd72759866596ed36de2ca75d5bb109142c40b81717a525b2325d429c9ed30ac219622e9599f432209dcc5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378932, "uuid": "49f33b65-7c11-4079-942b-eb7d0a49c80e", "value": "T1CE234B487BD44521E5FEABB06D72A9070332E6438D13E75E08E4979B1F6B7C08E817E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378932, "uuid": "12b608eb-af9b-4f7b-b5b0-a94524cbbd74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378932, "uuid": "bec9d440-9917-4432-9e05-6a7c3b282dd4", "value": "768:WgwDt3/U3T+8KkuR8llUbaG8lXuHFEPr9y7OCh2zjybB:W1t3rrR8Pga5kFM9y7OCA2bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774378932, "uuid": "e27b0353-973b-4f99-b23f-1c11f62e8611", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774378932, "uuid": "745f0c6d-cf0a-4c32-85f0-7675fabaedb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378932, "uuid": "3a43081b-5f01-487f-89e6-bc7992ab2553", "value": "DriverNetwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07085b36-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366933, "uuid": "99bff857-cb35-43b6-8fa3-8608f03f5a3a", "comment": "Malware payload (Mirai)", "value": "ef2e22bc9f8969b42aca2b82a8f84545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366933, "uuid": "d16ba1b6-fef6-4f4a-901f-0f1645b1ac9f", "comment": "Malware payload (Mirai)", "value": "068f47d1c67aef2ca4a4301fc1f0a4bc27bb3ee6dd0e6dceac3984656cd7babc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366933, "uuid": "69c7f03d-b8da-49fc-844a-2ba6e36a0a64", "comment": "Malware payload (Mirai)", "value": "edf0b81f07d1fd1e0a956a34830537a28be355ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366933, "uuid": "2cec622d-5069-41d0-8387-aee551d696f8", "comment": "Malware payload (Mirai)", "value": "ef44f2448cf4bfdc283672dc6a13dacc4e976e7faacfc907611a1e39d27a038dc43a21a7634461d81f899261b6a51395", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366933, "uuid": "6ce4833e-0414-4565-9645-210e24341b33", "value": "T1ABB2D0681B062EE9DE06C07E55E90B5135701FB11581AC0FF276FAE6CE5B0D8B8927E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366933, "uuid": "be401beb-92b6-4d1b-813d-6ea9d28140bc", "value": "384:neD8ZSH2LLZUYyGZbsOiTNsxCSF74+pU+NB/pVzbN7zp3mdzJgGlzDpH7uNj1JAk:neD8ZSWvZHZbs1NsxCSV1BN9dlizJgGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366933, "uuid": "511d1a35-07a8-4705-937d-3c206d3f5f3e", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366933, "uuid": "98bf64fe-8b08-4219-a1bd-e4b697137603", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366933, "uuid": "77e91701-ec93-4b94-b3c9-66468f38129f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ed2729-2773-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774351360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351360, "uuid": "c6940808-65f8-492b-8c4f-ae099a900ef2", "comment": "Malware payload (ConnectWise)", "value": "953ff92984b8598799ea163f73a1f84a", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351360, "uuid": "1c91835b-fed8-4138-bdee-3548a88cdea2", "comment": "Malware payload (ConnectWise)", "value": "0708a518ef644a3911a717220706190fbd5e5246c533845887c5fbd967953799", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351360, "uuid": "dfc4d52f-521b-47a8-b0ee-2032d5ffc730", "comment": "Malware payload (ConnectWise)", "value": "4ba8397e9a1de711a0ed6ed34d305e98c2d9f9f1", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351360, "uuid": "e4b8073c-f2f2-4096-8d36-6a80c619e9a3", "comment": "Malware payload (ConnectWise)", "value": "d02e873fe4f309b06a137a92bc322af656774b4b49e278350610500a46ffae1f5857b5bd3c2bf29879c0fc4bfd1ea218", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351360, "uuid": "812a32b8-7867-4d3f-bc90-f8d76788ff75", "value": "T16FD623116BF89278F0F22A35E87AA071A53B7D515E23D12E2324791E2C75EC0C9A3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351360, "uuid": "88ac08f3-0201-4591-8beb-8f6bcb7d1dc4", "value": "196608:xHxcp9ym3+ltDUJVnHxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym3DHk:jGpopAGpGGp6GplGpRGptGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351360, "uuid": "f75cfdb0-4037-472d-b35a-3aeee0897c99", "value": 13447168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351360, "uuid": "d71849fd-b6e2-4ea6-9d51-e9fd1853c5be", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351360, "uuid": "156e6e5e-6dcd-46b9-96bb-bb583ab2e780", "value": "0708a518ef644a3911a717220706190fbd5e5246c533845887c5fbd967953799(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b80c8d-27cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774389050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389050, "uuid": "e0a05035-4b43-4d7a-9a3e-99e297f9c78a", "comment": "Malware payload", "value": "284f2ae1d8aaf3f4038cd097cb7c5c6a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389050, "uuid": "6a209915-fd05-424b-841d-2c1c4e3371d0", "comment": "Malware payload", "value": "073f3e7f0b4594cfbcf759bc7075219060cf91f2c237cc34bb52b79978d72632", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389050, "uuid": "2ef56b09-5072-4aed-b270-a279efae9c30", "comment": "Malware payload", "value": "8ede18e561355be337c97789669d8c2b379f04c1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389050, "uuid": "54444518-b0f8-4eb5-977f-2ada04632367", "comment": "Malware payload", "value": "8c01e73e87cbbe2d63b83f33fcae0499c55fef43a7b7bcabace3359d9c26efd7ea8093d5d85388a025d226089406965c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774389050, "uuid": "28cbb01f-f6be-42c8-b147-b7eb4f8e9894", "value": "T158D50122B387C626C69D02B16599EA5E1178FDB3473480E7B7D8392F98F04C1A739F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774389050, "uuid": "a3b5e9fa-c5c1-4415-9033-9af674d70542", "value": "49152:Q+J27jizoL5laI3xVBkpu7MSE7XzM1GXMh4ikrvfvltgzhTwtFT5GJh07:60cySmXCGQ4ikDf8dwt9cJh07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774389050, "uuid": "deb191bf-b4d2-4616-8d3c-87ba429db112", "value": 2814464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774389050, "uuid": "4beba31e-860d-4490-a319-21b199787de6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774389050, "uuid": "b1bcdb25-d756-4ae9-a1da-63312b99c199", "value": "Update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f68ec6-275d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774341804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341804, "uuid": "3d35801e-b03a-47ae-8930-02db80d8a20c", "comment": "Malware payload", "value": "7f4967ac746a552f650411fe928d353a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341804, "uuid": "331f890a-c112-4260-b6f4-89113fc8e716", "comment": "Malware payload", "value": "076690774391f4d46a325e97df0a60b8dff87be9a8e99452d9ca07576c6aa9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341804, "uuid": "0c35b8bc-1c52-4048-9962-b3b372c8c6a0", "comment": "Malware payload", "value": "fd042a64be0229e092edb3deac87391ab2b491b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341804, "uuid": "68d0307d-c420-4a26-8663-0222eff1021c", "comment": "Malware payload", "value": "fb67872187be84b848eb09dda00b559796bf39d0e7ea25b86e6f65f02317ecff26ad345ababde51e8b650be1e1c8ecf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341804, "uuid": "ff774487-85f4-4739-9869-76f8db55cd20", "value": "T191068D87B2BA53A9D4B3C13482E3951BE6727C02CF605ADF1258B7191A736F05E3B358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341804, "uuid": "5a715736-6d49-4167-8533-57cfda35cdd9", "value": "5731ec60317e1bce6ec090a2386239f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341804, "uuid": "5483c836-8e4d-4cc8-9f9c-d0c02fd98ebb", "value": "49152:DcuqG6MfU4ySS+KENeQBri+J89H7we2UReXi8cJsv6tWKFdu9C6PTvG7cpHFhh6l:gnMGhNSKJsv6tWKFdu9C6i8di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774341804, "uuid": "c27d9fc1-d216-4ee3-b313-50dfa00d1e6c", "value": 3717120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774341804, "uuid": "3c81e35a-e301-4454-b1ed-dfcecc37d74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341804, "uuid": "378727d1-51d0-4c5a-9170-9163fb8be841", "value": "2026-03-24-----\u6700 \u65b0 \u540d \u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e4ae60-2784-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774358688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358688, "uuid": "e736de8a-8a75-4362-95f7-1e9b1962bfb4", "comment": "Malware payload (AgentTesla)", "value": "080fe4f402c5bd03cb0b2b5ba2fc09dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358688, "uuid": "0529ef37-28e8-4d48-a652-a6596cb09898", "comment": "Malware payload (AgentTesla)", "value": "07a5b0d2674ff173dcf166d5a5174714f17e1b2d4da935c39381290dd5228ab8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358688, "uuid": "a2623613-e349-4b0a-81d4-ceda3b7df481", "comment": "Malware payload (AgentTesla)", "value": "396e86d5e4936b587530ea0417277beb5077e7b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358688, "uuid": "57b1e4a1-1da9-4381-a871-99d6814b730d", "comment": "Malware payload (AgentTesla)", "value": "7cc8d1ea09ce38469381148a4f217f7697c031e5d57e62b661dd76c4ee879e77e59ca314ec11ed7c26114510a1d24488", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358688, "uuid": "93e3f1f4-7640-418f-ac95-ac4948efd373", "value": "T1437384DD7AC2B470821230631E2AA09DE22D5DC2254DA06CEAD5BCDCBCE5B2DD635DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358688, "uuid": "6c8d274b-6de9-439b-94c3-a3d11224b0e4", "value": "1536:y2c05Bw2x5LK/yCT7DJKC+oAlKVqAmi3oZLjiOey5fbq8O23YW:yVyVQaQBAIN3oAWbq8O23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358688, "uuid": "0cff4f9d-9564-4c94-87f5-90a4d5326ec6", "value": 74975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358688, "uuid": "01c6fe2a-365c-4fef-ba78-2f74a3387e37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358688, "uuid": "364d961d-7913-470c-aa39-e154da59c5a5", "value": "Neworder.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b601c325-277d-11f1-a769-42010a9c0008", "comment": "Malware payload (GenesisStealer)", "timestamp": 1774355630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355630, "uuid": "3adc5270-ebc3-4140-8a25-5e5dcf674706", "comment": "Malware payload (GenesisStealer)", "value": "4b1a917019acb1e7f14ec8bdd2351ffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355630, "uuid": "452b0896-2979-47d5-86a3-39e504275e25", "comment": "Malware payload (GenesisStealer)", "value": "080d71eaff2082b9c10ff0a2414ed2371eb0eb700b71f975de595d7bbc409590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355630, "uuid": "becfd6ca-02a7-433a-80ae-fa799059c4e0", "comment": "Malware payload (GenesisStealer)", "value": "d4e93e6e495bfa793d130a10b90051ed8094f87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355630, "uuid": "54d705ac-1081-458f-a637-9e91b32645f4", "comment": "Malware payload (GenesisStealer)", "value": "de886602dcf41cae64f60c28041d4f3894d6e7ba15d7e2a04cf730e68654b9825f9e1e79d7c85ee9d00df36f80fc1dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355630, "uuid": "92291360-fdc4-49ff-ada6-cb4056ea1626", "value": "T1AE1833277EE9FD5EC48A623E3BB1157928F4C4816BA7173F0202D4AEB57CAC15B12643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355630, "uuid": "2d849357-e1de-4c31-9226-644c6f8ce002", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355630, "uuid": "b5c3edf9-073d-47d4-afb0-c156a2c71469", "value": "1572864:1s+BWMFDe45kChU6hDRVOs7PMqjJTlLMOJD2Z13nYcxWqQ0OQh+7oG:19BFle45zhfhDRV37RjLwSab3YFQ8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774355630, "uuid": "b58c062e-7a72-4564-aa01-db774cabde18", "value": 88636951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774355630, "uuid": "03d3bff2-c449-46f1-beb0-cb3271a114a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355630, "uuid": "fcd274cf-80ff-446c-92ab-bb99fa0fc63b", "value": "Polyaris Setup-2.4.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacb8139-2740-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774329492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774329492, "uuid": "c5c02d53-01ee-424d-b7f1-642d67db7d97", "comment": "Malware payload (LummaStealer)", "value": "c4af3cb79fe35c36d853145b4407d81b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774329492, "uuid": "8b66b0b3-adc9-4e25-9bd9-7678d48e5e3b", "comment": "Malware payload (LummaStealer)", "value": "08273bf415b3bcb8e6298dbc827cec736475d0f40f9edd394993af3c4593e096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774329492, "uuid": "491139c7-4c23-4484-be65-068455b4e603", "comment": "Malware payload (LummaStealer)", "value": "eff2fd0ff08de2f8a591878720f98431d007cc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774329492, "uuid": "d5e78ba3-cab6-4593-8dfb-585766ce37af", "comment": "Malware payload (LummaStealer)", "value": "a3a54a16afc1bba4efe551df94428ccc557716abd68cab777845423175a6a3d58ed54cb3824b8e6392653004b9d951fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774329492, "uuid": "77816629-2490-476a-b0cd-35f30d56f228", "value": "T1AC948C55E3AA55E5D94B163810E27B3F8D24BA2003349ED39AC4EACF7D6E9D3053C722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774329492, "uuid": "41c320d3-34ca-44d2-b290-4b1b5b5aba78", "value": "496046d609f73a916cb58e4ab99756dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774329492, "uuid": "ed6ed3de-ecce-42c4-beff-4ff3fa1a6f0d", "value": "6144:0O0dkDl5i6k4Ft6Afvbt9V0ENK5ZM/TIbpKA8mrx/KDRrJWJEJLJEJzJEJMJEJY:0O0dW5i4r6AXjKEKSEpKA8m1/KDRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774329492, "uuid": "252fd559-1971-4475-9f24-a9d3ba04e49c", "value": 443652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774329492, "uuid": "e883041f-ae4b-468f-9aa1-f9ae16f541e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774329492, "uuid": "45b8e301-869e-4d17-b3b8-2ff06a8daab1", "value": "08273bf415b3bcb8e6298dbc827cec736475d0f40f9edd394993af3c4593e096.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b754e2-27a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774372167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372167, "uuid": "18b0b507-9e71-41e1-ba6d-075edb61670f", "comment": "Malware payload", "value": "76e5b079efab86038a04698493b536fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372167, "uuid": "5a4bc810-15e6-4894-ba20-183d33f24744", "comment": "Malware payload", "value": "09b365f767803f55168c63c903002995836a1b5b1ddf6163c6db6793a21f8cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372167, "uuid": "da78c67d-c3b4-42f1-85bf-2afef0843229", "comment": "Malware payload", "value": "c906331c0486f55364d3fc4bf06d156fcb497e1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372167, "uuid": "b54146fc-3f55-4ec4-8d9a-809be0c9fc2e", "comment": "Malware payload", "value": "60571777bc6f5dd9b2231faa7949f98df3a494657e92579a57b830bfdfbd2385fca4103373067103a632781780a13f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372167, "uuid": "367adbe2-0d03-4d2e-8017-9ff1ae554466", "value": "T10CC34A08BA6CC52BDA9F0E7D6892195116B6876B1103CB967DCC34EEFFA33508611B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372167, "uuid": "0dfd9ad9-dfdb-41fe-8131-6ccec3cc1b95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372167, "uuid": "40267b5b-7337-4b8d-8df1-7f98f5c4b984", "value": "1536:10lYU0lYKmef9kZZlUgr++QhQxQrwSbnWx:10lYU0lYKmef9ml3rR0p6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774372167, "uuid": "988ac97f-d7ca-4601-bfe3-d729be74a771", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774372167, "uuid": "26fc1620-8ec6-4211-a3ec-a900e4503c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372167, "uuid": "088deaaf-54ca-4f59-af6a-d75f86b2d80d", "value": "unpacked_2d40d1451168527bfc31d965658b5afc6cb76593b4b38ec7b9b1bd85e5416662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72b8414-2799-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774367658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367658, "uuid": "884f5153-770d-443a-a2df-c8d23dd06f6b", "comment": "Malware payload", "value": "54eebe50f785ac7404ae5845a5d70437", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367658, "uuid": "63fd562e-86e8-44d1-9716-baa97777cbf3", "comment": "Malware payload", "value": "0a1695b7623ec2ce82101a1d5c47e9a2d39d4d6db61f34b8b3051db5ecf7b119", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367658, "uuid": "07b559f8-ff8a-4a60-945c-1cd00c6301aa", "comment": "Malware payload", "value": "094d83180d4128fbe9135195503cb56bc3bba535", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367658, "uuid": "888a27e7-9695-4ac4-87cf-ea8fab37932f", "comment": "Malware payload", "value": "3abe6866b8ac4e2ee9a377929c51a5aa79d616d36a05f5045f6743bebead7d53cee0cb14c6ae808f9100c08174605106", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367658, "uuid": "bbd24831-181c-441e-9d7e-898356f46772", "value": "T190D6AE2435986607ED7E9BFEF997B8540F6AA6E2E7C2D0FC1852028D4591F00F91392F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367658, "uuid": "eef8929b-e932-480e-88ee-729727dc10b2", "value": "196608:5Su1H1CpD1DB1iHGTfVa3pCc7qFA6qZHHuAkwXaxFdUCFuzjN:h1cpD1rTfVaZCc7gA6qhrXqIpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367658, "uuid": "e41f9e50-57a7-4d3a-8bd5-1d9633cddbae", "value": 12690944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367658, "uuid": "c5e8f140-82a2-4214-bd7c-eb5dd8fb68fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367658, "uuid": "1b81793a-6cd7-45f5-b93d-c6f523b25903", "value": "0a1695b7623ec2ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7fef92-279b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774368227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368227, "uuid": "10d1b0b7-25e4-4bd3-8ade-a22607e941aa", "comment": "Malware payload", "value": "54aa51008b093699d0bf1b6388565e02", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368227, "uuid": "56bd3df3-8172-4fdc-84b3-9cd1de26ef38", "comment": "Malware payload", "value": "0aa01c247e284eb7875e2076e12a8bc7a4a2b497ed67c9c086ac9ff1cfd29e03", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368227, "uuid": "4ec2bd71-b2ff-4b49-9b82-77850d1ecacc", "comment": "Malware payload", "value": "3ebc5ee4089d602fc16c440f7006f242f6af10bb", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368227, "uuid": "7f0273ad-e0cc-446a-be15-eef8c8ae231d", "comment": "Malware payload", "value": "9f3ac56528d6bd51f8a44ba7441c84e2ccef4158501930455ce8993c7bbe9f6b856624bb43dec4c0f19042fe823dfc9a", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368227, "uuid": "e33000c3-196c-41ca-9d8a-dafda30e03aa", "value": "T1F6D6AE203589660BED7E9BFEF997B8940F6AA2E2D7C2D4FD1852028D45D1F00B91352F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368227, "uuid": "000c16c5-f568-4e1c-b8dd-a6a4d1051e55", "value": "196608:ZS+oOmcjp+5c+O05ZRpP04tvyxNY/B+dr9:rmqIc+OMZUOvyxNYZ+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774368227, "uuid": "3370ebaa-c818-4096-9a45-be1252cbaeb5", "value": 12690944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774368227, "uuid": "0ec469ed-56b9-4d25-9f7d-b9f4fe59a0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368227, "uuid": "01b9a5f8-80e5-4f2b-9750-27b82b2890eb", "value": "0aa01c247e284eb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e855caa2-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343259, "uuid": "a5587f51-febe-4ce7-b1c1-a980da97dad1", "comment": "Malware payload (AgentTesla)", "value": "6435882646c7d48a8bddb25bd97bf799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343259, "uuid": "912cb28a-f400-4ff6-a9cc-440900a14df4", "comment": "Malware payload (AgentTesla)", "value": "0b806b753f15c9b2a6e644070fe6bb3bc7eabb95b3683a124e2f9b2a81f4e32c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343259, "uuid": "0d1f7edb-dba4-4910-b756-b96c3a2f29ed", "comment": "Malware payload (AgentTesla)", "value": "16790289a8db909688fd783d8b8a407eabc88956", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343259, "uuid": "b5ff498f-a4b7-44d2-a284-b18a76402f7d", "comment": "Malware payload (AgentTesla)", "value": "5b77f24fd8500f4192f9071d7eff68dcb46cb09ad223ca776eaef379944ee87bc2f847950a9aa00960d4bd3f9eac548e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343259, "uuid": "4073ee4a-c48f-48e6-8131-c94f9c5c8996", "value": "T16365BEEE60CEA0A9CD2C840DC9781619C3F416AC79B2B419EF1F6E1FB6FB11991027D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343259, "uuid": "297adc7e-d350-4a99-a29a-f4118c31a638", "value": "24576:FHQA8SLKX4Bes0rW7uz3/le5YRv5bvmt+EV4EFj:FHQA8SYS0rbVdmXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343259, "uuid": "230da727-ca0f-45fe-8a22-e0f1f9e29cf8", "value": 1546983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343259, "uuid": "d16bdfe6-c90c-45d0-b349-85f817448429", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343259, "uuid": "0792b312-87ea-49c7-8b00-c8183dfa4dd8", "value": "6435882646c7d48a8bddb25bd97bf799.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1208574-2774-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774351729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351729, "uuid": "280f2a65-94c0-4c72-9bc6-8ced07898b03", "comment": "Malware payload (ConnectWise)", "value": "708d6e291ebbbe6718a6ec29aae3c7c2", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351729, "uuid": "e279befc-8012-4a04-835a-328b5dfe8359", "comment": "Malware payload (ConnectWise)", "value": "0b92b60be728961d4af818290880d0f1178314bee94482facedb89b6168cc783", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351729, "uuid": "ba27aaf9-d0c5-40e6-8c96-1520fec95db2", "comment": "Malware payload (ConnectWise)", "value": "90a733256ff0e095c9fbc615d0df48a190ee3f53", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351729, "uuid": "12ed5632-7576-4c38-be7c-e570ef1426d9", "comment": "Malware payload (ConnectWise)", "value": "ff6af0af21c1b5b5eedb180249d1ad13826dbb8f803f9125b12338fcf12b6edc14dfa4e3d3df5da34031427427cf8a34", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351729, "uuid": "95877c9f-5596-4a2c-8d1f-f5bfcb7cb6f6", "value": "T179D623116BF89678F0F22A35E87AA071A53B7D115E23D12E2324791E2C75EC0C9A3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351729, "uuid": "a08b1e3f-6975-46c3-a2e0-c3f9b58db861", "value": "196608:rHxcp9ym3nltDUJVJHxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym3sHk:1Gplp6GpGGp6GplGpRGpKGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351729, "uuid": "0af0838c-ba96-4cec-a01a-6b5c95575075", "value": 13447168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351729, "uuid": "1b244d13-086b-4301-a109-6861f43e16a9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351729, "uuid": "74d56b65-8eb7-4d97-b6cb-32b388432054", "value": "0b92b60be728961d4af818290880d0f1178314bee94482facedb89b6168cc783.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb827945-275f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342862, "uuid": "d04a7e7b-aa16-4840-bbd6-83c701e7e795", "comment": "Malware payload", "value": "a988e12bfbf2605648070bffebe7f388", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342862, "uuid": "d50088fe-7786-4a0b-b33f-1e966f714a62", "comment": "Malware payload", "value": "0c3ada1096af34a86055b2fe45f6ccf9dc91c67e39df73456772b132b0a29639", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342862, "uuid": "b0ef39b4-1a5d-4212-ad0e-6b7f1095e777", "comment": "Malware payload", "value": "757257523bd51afaf04fae88af85c1993755c2c8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342862, "uuid": "a0c62047-d1a6-4364-913c-495f8636ca3d", "comment": "Malware payload", "value": "e331d74ea03af075741fb6e2d43558baaf4ba3cbe4480a709994c9d12db8a40df9cf8d98248154c2e092d4fc820e5776", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342862, "uuid": "373c5667-99f1-4fcc-85e4-10b5d8526122", "value": "T1DEB503EA34F2E0EBD0A0A63E8D44F8B8E12417B1939556690DE7DF4F6C49E910CD3867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342862, "uuid": "31a06096-3d5c-4a48-bb98-d6fe66690bc4", "value": "192:38ymU7IKJGZAlaHOEcOcq1CLRVXGXyyy7Cat5ZyyyXdJDaqoCOfQ4/vpebGilyZ9:35zIe53+D2uavce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342862, "uuid": "c3820051-243d-481c-8cfb-5556b6c1e856", "value": 2332685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342862, "uuid": "1fb7bf9a-6e03-4961-b959-f7e0c68f2fa1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342862, "uuid": "bb681e33-9abd-4598-89d0-c1447bc33e17", "value": "a988e12bfbf2605648070bffebe7f388.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5216f9-2788-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774360259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360259, "uuid": "0a07f765-6808-4264-9e9c-61e8e14477e1", "comment": "Malware payload (AgentTesla)", "value": "a31d2676f8b5da6e4b4f4962aa0aec3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360259, "uuid": "639797a1-fa09-47bc-b2de-ef45d7ee7673", "comment": "Malware payload (AgentTesla)", "value": "0c720fd7c7f4eb066df35497ae0e43207880cbfd0f6b55f3f05288641dbd860a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360259, "uuid": "5353339d-21bd-469f-aa54-1a710162a47b", "comment": "Malware payload (AgentTesla)", "value": "67e325c3170f3381f347e31c650e3ff1ba2e78ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360259, "uuid": "00f6c991-aa70-4dec-bba9-6f2f0b099926", "comment": "Malware payload (AgentTesla)", "value": "3bd47dfd93cacbb55ca12c39343ed551c62efc92eed2685791b4a821a33dce37f50ead8a6910635ce481eb1403228054", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360259, "uuid": "243931a5-a051-4492-93a1-c04d52a6b242", "value": "T1BB3473037E848B39D1A93E3A82EF692413F2B4C60773D70F9F4927A518612D69C5E739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360259, "uuid": "50b00f3c-40ca-4056-9a89-8edd35f00654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360259, "uuid": "32d9761c-cb37-4297-ab82-be566509f4b5", "value": "6144:CU9EE4/y+6SYOKAMJwMA4W8I3QwzV9fdvU:l934/y+zYJA0wMA4W8I3LHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360259, "uuid": "0c5a0b44-f1d9-402c-9f75-121ba9228464", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360259, "uuid": "66ea6cfa-a21d-4160-81e1-bb36c317b453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360259, "uuid": "2e42d4f8-00c4-485a-9f68-32c2bb37ef3b", "value": "Unpacked PE Image: 32-bit DLL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061b25de-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1774342879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342879, "uuid": "770e52e1-18ee-4aa8-82e8-c71caa2b06be", "comment": "Malware payload (VIPKeylogger)", "value": "c29854a024dcb0c70b0d703a845b837b", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342879, "uuid": "2cedf34a-1b37-4c87-a6fd-94bc8533f08c", "comment": "Malware payload (VIPKeylogger)", "value": "0c80210953d457c5164395625ac6d4bc247442881473c3566e02c4a6735f050d", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342879, "uuid": "ade4d8c5-08b4-4cbb-aa1f-e183fbb3c4fe", "comment": "Malware payload (VIPKeylogger)", "value": "a8d63b1016b5307c55676d9d88770bcd246f88d1", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342879, "uuid": "97173eb2-7e82-4b70-8d38-d94d60fe8079", "comment": "Malware payload (VIPKeylogger)", "value": "897dcdcc5b8c2260b81251b0c30e56639010b067d641de23d73c12d201b208fc5d4d269bada1e0eb4cb4545d8f5f2fea", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342879, "uuid": "0c55984c-1e97-4485-9363-f72c91e3435d", "value": "T1ED75AEE282040A75DACD726D40BE090EF1F14BA6765317CC9972BF1E1F95F1A990B2BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342879, "uuid": "800929f2-1e99-4d0f-b26f-86cc6a1454ed", "value": "24576:ubuQo8XqiBpSa4J4ZXuV+HXeEdUMBhmp2yxOIQIUuX54KmuT:vepSa4J4BJHuEdUMBhmpROD3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342879, "uuid": "942c7b7a-7519-4bb1-982b-78bfd79ec321", "value": 1655540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342879, "uuid": "b6c58d2d-8ca8-4168-a0bc-68e7b5c44242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342879, "uuid": "17cdd429-ff3d-4932-9525-52af1cea0116", "value": "c29854a024dcb0c70b0d703a845b837b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a76f31-27c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1774386761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386761, "uuid": "b1ad5b57-7f7a-4e0b-a03d-8250c752c97b", "comment": "Malware payload (Efimer)", "value": "f302de94cadbc05d1a3b759c9675f311", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386761, "uuid": "84c9b6df-debf-4816-be60-b4e1ed697579", "comment": "Malware payload (Efimer)", "value": "0ce28fc97d971ad4cd0900360599b33359f3c3dd9557b433130d97254fffc0cf", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386761, "uuid": "8c17ed2a-0138-405f-b0ba-da36d02903b8", "comment": "Malware payload (Efimer)", "value": "f882d43b7b8956d6cada1af5fb641b96e4b23de3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386761, "uuid": "a891ddbc-1684-4a6b-9412-b970ee7eb87d", "comment": "Malware payload (Efimer)", "value": "68f34bae8b3d0b5993aa3033464a5d439c7603f03b486cb7525f44015872fdfa39131f2aecc69e409bf7cb1d2fc02f4e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386761, "uuid": "5ec1fc79-3697-484b-8747-a26050eda8c2", "value": "T15CD6332C54C325FEC7B3C6B8ADE91AF1F465B4241239DE3BAAC4D371596B040EB29193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386761, "uuid": "a7b4eef4-9ee3-4910-95e8-e312a5d51b2f", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386761, "uuid": "b3fdf436-d65e-4ff2-8c9c-705fbcc8d5ac", "value": "393216:Ic/+QqkTBFP9XmpayXMCHWUjXxcuI3/PGTAI:IcVqkTBDXmpXXMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386761, "uuid": "f2a385c2-35ac-4435-9ae3-13b2f5919373", "value": 12633321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386761, "uuid": "8938f5d2-6e04-4c3b-9867-277caab1c8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386761, "uuid": "0ee79040-cc34-42e8-a83c-af4a4580259b", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b405568-278c-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774361866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361866, "uuid": "191c388c-63fe-4c20-875f-2e8359169cc9", "comment": "Malware payload (Heodo)", "value": "d03bf3268f96aae74facc150cd24ffd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361866, "uuid": "f589bcb9-486d-4d68-a49f-6ea80f390cd5", "comment": "Malware payload (Heodo)", "value": "0d4382170cd8e23611d31dc57a73c77af0d386031c907e10097ab6fd5554b642", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361866, "uuid": "3af81233-5357-44b2-bd93-0c33fb9aa5dd", "comment": "Malware payload (Heodo)", "value": "e8e315bcb8213ffdea06a73d85fec3ff76a373a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361866, "uuid": "088d9e9a-4aac-4d74-a516-b2d6243af8ef", "comment": "Malware payload (Heodo)", "value": "5535762c5859c7c6a2fc343d0831839b0afc240eef7b0b34892f568955a7dd21f9422041c593e652b55e1242d34d115d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361866, "uuid": "3f60d7b3-46b4-4cf4-9112-00f6c6d14cfc", "value": "T1C44317037782D8B6FC9E14B5619A7627496BDF30430F9ED383F6309259219E85DF814E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361866, "uuid": "0d0e9098-4e54-408a-9abb-1b741a295a33", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361866, "uuid": "0de841bf-02fc-41c9-b71d-22cced7a9344", "value": "768:WLo2dWDLnukzBniY0O5aX5ATwOoOZz7sXzJsOZcTuWqXMCCanWef5saSBq:UnWCOUX5e7sXlZcTfqXM5aWg5ABq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361866, "uuid": "98d5e199-e496-43bb-9023-e0150774b030", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361866, "uuid": "d6b386ef-483a-4b2a-ab31-13c3a503b3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361866, "uuid": "c26ec795-2eeb-493f-95f1-86004049fd13", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563046b8-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1774343443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343443, "uuid": "22b98a05-b862-4489-ae5c-eae51ef979f0", "comment": "Malware payload (Vjw0rm)", "value": "2aff14f5d7fd4b8f8e175b883e599892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343443, "uuid": "9d30ac1f-78a2-4c8e-86fd-e2ee2e6e61c5", "comment": "Malware payload (Vjw0rm)", "value": "0d71fc311273db677f158b99e76fbedeb71dc5e6632d10f146ec1422024c3095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343443, "uuid": "1d0c7dcc-46cc-4332-a284-e6a1efa5bef5", "comment": "Malware payload (Vjw0rm)", "value": "1f33b416ca0f24aa85690156c42298d01ee795a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343443, "uuid": "dd199e0f-2499-459c-99bd-44eab35fb69a", "comment": "Malware payload (Vjw0rm)", "value": "168567b2c3642c7eb426abc4363ec79d7de825ca404f1e9c3147c17a191b7c922499326c0f07960fbe1249b40ec8f62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343443, "uuid": "10025a5d-66a4-49c1-a743-b84182010a41", "value": "T10CC6332382DC58BDE9CF3B7126A8BD84E1B2D93D4439C68773548F5D3A208D06F74AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343443, "uuid": "969cbd54-5665-4343-9ec2-c5be2769ade5", "value": "93ff054b805e17efd7f7ae1730680391", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343443, "uuid": "40cbea12-2211-4b69-a2cf-51dc206de8a9", "value": "196608:pILwD+TLCUzOpuX4uJ7WU4TbaP7Eagb0EQ3NQ9EscE/nfVbAAxGMFYKpzBO:+LgJeOOJwPaAwF9Gf5ISzBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343443, "uuid": "989536d7-8af5-4a7c-8883-157efbb76c9c", "value": 12086563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343443, "uuid": "6aad6945-3515-4fbe-a73f-195b7e5ce71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343443, "uuid": "fa02a2e2-922c-4e58-8912-b02c6e3677d9", "value": "2aff14f5d7fd4b8f8e175b883e599892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea45e07c-2757-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774339397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339397, "uuid": "9fb46f3b-54e4-4271-a364-8965bdef863b", "comment": "Malware payload (SheetRAT)", "value": "00f78bc0958c821c38b47fc19ce1c2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339397, "uuid": "d9f636f5-f147-4e49-bc72-83656217880c", "comment": "Malware payload (SheetRAT)", "value": "0dade8670a52841beb1631acef826a6053723a7818bca5e02b7053559bea2f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339397, "uuid": "bea891d7-419b-4f7d-9337-63b8db2c92f0", "comment": "Malware payload (SheetRAT)", "value": "1ca3e74bb13c25fcfa4a453dabd89eb03c1c6d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339397, "uuid": "a689da00-d93c-402b-b549-988b41d34efe", "comment": "Malware payload (SheetRAT)", "value": "f5a1480124548de93af34de379c5f3540efdefb656019933d845febd4112e003e01b221f6263bc80d062e42d24f1cf65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339397, "uuid": "66ec08c6-9c08-422a-ae7c-2342a8de5e11", "value": "T107B4C302274D791FCE411F3FFE964932226518AE3317E5A616F1AADF2918149DBC33E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339397, "uuid": "eaae0430-a78a-46c3-a8e0-16c32efd3647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339397, "uuid": "393c76e7-78e0-4188-a8e4-6d1d930fdf18", "value": "6144:ESM2eNhBFh0CTgUm48ZiebkqDgIA7hnc3wwe8:teNhBzo4dGDgZ7628", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774339397, "uuid": "d88ed070-e637-4041-9d5b-94bcec45cc16", "value": 516456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774339397, "uuid": "0500f762-1113-4d2b-b693-6cbc4a72f167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339397, "uuid": "4142b9d7-3d95-485d-a095-89a516935dad", "value": "00f78bc0958c821c38b47fc19ce1c2f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4be04c3-279d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774369345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369345, "uuid": "49378960-b93f-4a50-a127-a7743d347ef0", "comment": "Malware payload (AgentTesla)", "value": "0979e1bc39524814f7315d140c281490", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369345, "uuid": "d6c668cc-512d-40c2-896b-21fe0fda122d", "comment": "Malware payload (AgentTesla)", "value": "0e04f973cfb197781075135134d8cc96f12cf42bf04c3da9abfc0e0a83bd345c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369345, "uuid": "a34a57bb-9b13-4f1f-aead-181ddeff31c8", "comment": "Malware payload (AgentTesla)", "value": "a7e148b848858305feee957c38adadc12ebe8eab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369345, "uuid": "b7bf0bb8-8d3e-493d-9607-7880be97c852", "comment": "Malware payload (AgentTesla)", "value": "425dbd887a2002ac421849d879f2e933fb1f0943c307e8d43867d10f0b8634ac5b0a977e5ae4df694b6e6f293b452120", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369345, "uuid": "7f0e4a36-1d6c-47b2-8326-8679bd10ad8f", "value": "T18D2501493755E843C5A24FF44970E3B427B49D986521C393CEFAECE7BA3A70A6901393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369345, "uuid": "18f9054f-250d-4770-a7ef-ec2ab414826a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369345, "uuid": "f9153bcb-8663-4953-8c80-31c6eb5e28ab", "value": "24576:cciabCZaBE1Z/BuTgIdWoJ6Qc+z6BlKvWs+yyH++q:ccykEvBuMIdWoJzzbuTyyH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774369345, "uuid": "741d0078-c4f9-4b40-be0c-aa178ccfd652", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774369345, "uuid": "b3ad28c1-ea3a-4a22-98fa-8b4be160609d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369345, "uuid": "cc4aa411-52b4-457e-bc86-3804b9c24517", "value": "0e04f973cfb19778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e416d3-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774342871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342871, "uuid": "b0f5478c-ca96-4afb-a6d2-e93816fd1d8b", "comment": "Malware payload (a310Logger)", "value": "41fd637615706c1f8411f85303cc7299", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342871, "uuid": "1efcbbfb-3d0f-47b1-9225-be0276e27cd2", "comment": "Malware payload (a310Logger)", "value": "0e93f201f380868893fc4305abaa26fe6544737f5741769b07e5dd79d78b12a7", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342871, "uuid": "15bfd190-f7a7-4763-a775-da74fe5e0234", "comment": "Malware payload (a310Logger)", "value": "05f3c2a0f0a43a39f7be9496bdf6532c487fbdd5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342871, "uuid": "ba4ead5b-3803-45d7-901a-138853b51e74", "comment": "Malware payload (a310Logger)", "value": "2da23036aecad0a1113df180197a9f85cfe77aeec5a287d21a92c1e6109c58e09a03339b07a9a98248102304fa411870", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342871, "uuid": "f74303a7-1a35-4c8c-b223-8dba6253cebd", "value": "T162D59E0077455F6DEE9C631E20FD8A4AB3D18E8FE11B936AD5566F401B893B21D3B0E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342871, "uuid": "6dbb03ef-9eb1-4124-b7a9-399d008e46ad", "value": "24576:G84ttsDafFJ8HnRf6p8hKyjQro/sZG3t6zZVDsUCy4WYTGtGUom0YpCGvSp70ugX:w7qd62tl9NDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342871, "uuid": "fac18060-8042-44ac-b348-93e03feae612", "value": 2751700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342871, "uuid": "9e7dc5f5-7971-4a0d-8b20-3e8052b49521", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342871, "uuid": "22794b63-c98e-4a93-81e5-5a7c09ec0255", "value": "41fd637615706c1f8411f85303cc7299.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25233fc8-2750-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774336059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336059, "uuid": "0c1b051d-a08a-4a2a-a451-faebb7b9c1c9", "comment": "Malware payload", "value": "e9b357b7019dfab30fbf227b2436372e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336059, "uuid": "3a637e09-7263-41a2-a6b7-949e3f6d99b8", "comment": "Malware payload", "value": "0f8d4a0977917b1f6af608578f5f34245df3b6dc0014b11942330f20915f475d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336059, "uuid": "32970fc9-c007-42d7-9fd0-da547c46f667", "comment": "Malware payload", "value": "3df67cc68a846b96b11ff11f3ab688908984fdec", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336059, "uuid": "c9f56c95-0c18-42e7-a543-ac20fb29dba5", "comment": "Malware payload", "value": "61144774f35b80536449a562cbeacd1770c79c8d8e14827b1ce7dfc59bcbf64b47689c9f4fa66b27b662513a93a3bd8e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336059, "uuid": "f0f2a594-9035-4e71-80bc-aca56b6a4cc6", "value": "T1A9545DE467F02CF4F826113BF841912DF7E27C1A8B50D56B8366E55A2F235D128BAB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336059, "uuid": "ffee6e76-8ef7-4370-89fa-46257cee844f", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336059, "uuid": "394f40f2-6680-4b98-8878-5cff97101729", "value": "6144:OBfaB/yttqQ0XWhGF9HIkHyUVdA31Wy3:efwKttq5XWhGF9HIkH33+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774336059, "uuid": "a4c27299-6207-4157-b489-f9a934bf33a6", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774336059, "uuid": "8ea13a80-bfcd-40f8-8f73-53b778c0d2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336059, "uuid": "9404d1f0-4043-4428-b107-f556b73e385a", "value": "smqdservice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68022f55-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1774343473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343473, "uuid": "652e6b77-1ab3-48e5-a893-ab94e3a2578c", "comment": "Malware payload (Socks5Systemz)", "value": "1d21d1bb95f6069c84ae83ed8c066d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343473, "uuid": "39ef53ca-a430-44e0-b001-391546c75b39", "comment": "Malware payload (Socks5Systemz)", "value": "0fe12c8fe792f41b240a807cdd0526b0c23bcb37178b0a0beffcfdae532e6b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343473, "uuid": "e92f4a75-b32e-49f3-9e4f-32af8217467a", "comment": "Malware payload (Socks5Systemz)", "value": "fa98f881e29cfb95dae6a0fbc2fe210302c89e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343473, "uuid": "555a9783-3a2f-4f42-bd74-88e4b552d534", "comment": "Malware payload (Socks5Systemz)", "value": "1c1a9c3eea8c949a46ebd484e247717b823b16b69bc7137fb8d4a6cf9c289531d9d97e36ba7ed2a497144db974d98e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343473, "uuid": "4bdaa8b2-29d5-40b6-8908-1e5aaa45993d", "value": "T1D7263350A561C174C3481D3E616BC4886D12302F69BF7BB41274469EAFFBBD7B84EB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343473, "uuid": "57dafe12-bba7-440c-a18e-46c41d26396b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343473, "uuid": "40b2ed3d-fdc2-4939-8447-806d1abb3d8e", "value": "98304:+KQLeJvckVJF/uf7x6cpfunDti+XYKZGeKo+bbBQRQd2OXeRMUP2OAeoWd1Zq:weJFi1/unhi+XYK4egQweRMUP2BWXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343473, "uuid": "9339f134-5053-4ea6-a4fe-7ed3759000f1", "value": 4833141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343473, "uuid": "3df54096-e9db-4e28-913a-57d409801ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343473, "uuid": "46c9c3a5-c8ca-43b1-bae5-8aaaf2d8cca4", "value": "1d21d1bb95f6069c84ae83ed8c066d47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7de6295-2766-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774345862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345862, "uuid": "88abc42c-f929-4ab0-b058-75c0b5ae4104", "comment": "Malware payload (AgentTesla)", "value": "a4a77cc699f8e155d93fb4d35696ea78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345862, "uuid": "2212a790-56f1-45be-b9fd-3cafc78ecd6e", "comment": "Malware payload (AgentTesla)", "value": "1079c14f69f1dac1d28b8aea2d9700d699058a6b5005f2b0c609d758549bb74b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345862, "uuid": "b780720e-a0c4-412d-a111-f1d94be80808", "comment": "Malware payload (AgentTesla)", "value": "783577520daa2bd986dbcab821013abe527dd9c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345862, "uuid": "14e5b85b-9f46-432c-8662-72248eb122ff", "comment": "Malware payload (AgentTesla)", "value": "e90348ba96dba3e50b134e0b3b92c0e3a25d30a8fec595c0b22de36a01c655597abb0876335866aae316cc44b01ff36d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345862, "uuid": "a823e382-45d0-4a41-8ab1-8afa37c856f3", "value": "T1A92502193388DE47D9AF57F46628E17403B46E8EE522D7064FE4ADEB3C63B242909743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345862, "uuid": "4db60734-1e31-4c9d-9f26-914cd13f7a49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345862, "uuid": "0e115f53-b18a-475d-9548-3fe67f561dd3", "value": "12288:d+itRCxMhveMWuArAiDkHg4rx237OPCle0aC3XIoifAIU5g3sutPOcWdQUZnITRj:QBMJeMaArHPGIC7nIoifAL5E4nIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774345862, "uuid": "b3956ff3-f144-472e-897f-017d95c097a2", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774345862, "uuid": "64bbf0c0-1fbb-4e0b-9c48-5415ffd890fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345862, "uuid": "68b3c5be-09d3-4421-befb-b175bb03a5d1", "value": "Purchase Order-1322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df5147e-2734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774324102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324102, "uuid": "93ecddd8-97fa-4f3c-9554-47f57e4ca78f", "comment": "Malware payload", "value": "906643fda63e9f3facd4b9dd0ed5324d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324102, "uuid": "8cefa74f-64ff-4824-b22b-e371c4ca635d", "comment": "Malware payload", "value": "12d21a05761d45451811d19a624fdbdd9e046ff01bb44c3e117149a6ab15ea4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324102, "uuid": "97881432-d9e6-4327-8b93-89c74ba78935", "comment": "Malware payload", "value": "d78854e47ce242d159f8d401c92a5edbee2eb74f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324102, "uuid": "4847b5a1-fdf2-480e-8ed6-2abd94f56215", "comment": "Malware payload", "value": "d1c1b9d6fa98d491bb318a66bf976bf17be163e1ed1c08f8d3a183243402318c77e1869888c04e1353202a1987eb261d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324102, "uuid": "29c7ccf9-bf54-42b5-bbf3-84fbd33f6c3a", "value": "T15A011BDF01A11F71D30CCF8CBB6548245056A9E0F6633A88994B447A4DC478AB725FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324102, "uuid": "3982ea33-1305-4e70-aaa5-1feec2ad32a7", "value": "12:xyx9weZNIjlT8KCiKl2PF5At99UFG109f6ChJKJjhsjBMln:4xCiNIpBKl9fo6KsEiln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324102, "uuid": "4b9d4978-49d0-4472-a026-a20f47800049", "value": 813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324102, "uuid": "eeb7a399-e6e7-46a7-81fe-4e9b55a13b8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324102, "uuid": "7007f283-78fb-4860-99db-ebb98dd45b21", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcf4fe1-278a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774361015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361015, "uuid": "ad77ee72-8087-43d8-bceb-0f4cb16e92da", "comment": "Malware payload (RedLineStealer)", "value": "b230edd9606542f4021ddef3e7a00257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361015, "uuid": "c9e3e54d-ff42-4709-81c0-f4648246f2d7", "comment": "Malware payload (RedLineStealer)", "value": "136fcb59b2e12f3bd5c5a943737731f7c9a808fbf550b9b729b06c5bb36556b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361015, "uuid": "fa154942-cd12-4b5c-bf2f-b7b299169973", "comment": "Malware payload (RedLineStealer)", "value": "0571e16fce157b34cf18ce313df29256a16333ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361015, "uuid": "09a81f1d-c113-4757-abb5-466c69806770", "comment": "Malware payload (RedLineStealer)", "value": "09627cc90d6236de4c8d1b9c16dc1b009e7bd8bd8be948774694ae9f850b959880d11ae15f9925546e6e22117b2a14df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361015, "uuid": "1fe3eff0-e1f6-4c02-8303-0d2e5fee61ae", "value": "T138547C4477E81515D67E8B38E461D2B152B5ED63E627E3476FC0AC6F3C32B41EA00AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361015, "uuid": "340e4108-c205-4025-aa9e-b670cbf7232c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361015, "uuid": "64b8ddac-f32d-4a3f-ae5c-77ac7e6f0089", "value": "6144:McZqf7DIAgdHnQN8O1v0n1GxKAKkBYxyBL:McUzs3dHnQN8Op0niYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361015, "uuid": "3d220f01-bcbd-407d-8fe5-05d005417121", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361015, "uuid": "22b97cc4-4a2d-4407-bbf0-e592aa046115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361015, "uuid": "6c240b0a-170a-432a-8afb-70333f6dfe9c", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d19bac1-2769-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774346864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346864, "uuid": "e2d8be61-5d3d-4f85-b4a8-ec5650e5975e", "comment": "Malware payload (Gafgyt)", "value": "2ff43e6dc35900703e552e521ec5c3eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346864, "uuid": "e1352d34-1678-450c-b85a-b1f08e0bc58a", "comment": "Malware payload (Gafgyt)", "value": "14fd849bcc64d1acd189dca7dae01578c115002e474dc1b42abeeb970c73f3d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346864, "uuid": "e1d9cc85-b9ec-422a-9342-b76d3de1f6e7", "comment": "Malware payload (Gafgyt)", "value": "2db409cb08193be3faa8414d387492190b48207a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346864, "uuid": "835b07ff-5842-497b-be75-9f37d0689131", "comment": "Malware payload (Gafgyt)", "value": "24a976463d2e0df5db09efbac58f05054f20181e4909e307ad348650b17fdd4b557a0ff075e47706c12fbcfa748cfd8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346864, "uuid": "f3062f62-9748-4a2c-b6eb-8791b4c149d9", "value": "T1AE34175B6E328F4DF671C63582B74861E3A833D766D2C685C5ACFA101E2064F642FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346864, "uuid": "4de1ea1f-bb7e-4993-b701-adfb2ecbb43c", "value": "3072:+/YPSLsRsBO0DJdOLmyn9cCbiz+P/8kWAJ75yBmoayReqE2:CoL6BO0DJdOLNcciz2/P9ycIReqE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774346864, "uuid": "a74f1b80-4f7e-4b00-8194-04c650b85798", "value": 243132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774346864, "uuid": "6e33acf9-0032-4561-8215-9d905cae8fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346864, "uuid": "c2e9b701-390c-40ca-a6c8-e3595a5024eb", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcbc09f-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (FatalRAT)", "timestamp": 1774343483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343483, "uuid": "89e45b3e-1207-43d4-908e-3bc07e5f9078", "comment": "Malware payload (FatalRAT)", "value": "013d0d5a9f0748c6b3cc325799a46ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343483, "uuid": "049801d7-68db-471c-8701-3da1cfc881aa", "comment": "Malware payload (FatalRAT)", "value": "15582577479f182cc373f67436ca607fc39138762894adae4da0c2136aeac496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343483, "uuid": "c5dc1892-72f8-4565-8442-885d73f0cf86", "comment": "Malware payload (FatalRAT)", "value": "0986e579c1271f77ac71b71a1f14b125586442cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343483, "uuid": "bac9711c-a8b4-4663-a77b-b91a0c272d4f", "comment": "Malware payload (FatalRAT)", "value": "fb8339e4968c4290e8099971f31ed552667f875fd35b6a7fff47c1653d052ea1f56e5bd75a7b912d5c0dbbc490bf9abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343483, "uuid": "0e14ab86-3278-446e-a292-528b62a8313d", "value": "T1FC14AE8628964779DCCD02B1E03D9A6C119E49E0AA71F8EE572E686B47313D7F1E3307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343483, "uuid": "33fb8e2d-b6d2-40df-b3c4-418efe86e9a6", "value": "6c306e45fa9f977a2f45c8a08df084d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343483, "uuid": "98b9865a-270c-4e87-941a-26456150dc66", "value": "3072:T1ltd5LZseWDzoPZ6WS6BLfvgaSlpcD+05f:NSzkPDNGEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343483, "uuid": "c20c6295-13ce-4c20-9ecb-e83456e7f059", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343483, "uuid": "cb2d3e74-3f23-4323-b389-069f54dddb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343483, "uuid": "565341b7-d1c6-4872-ad1f-eb87862a4a30", "value": "013d0d5a9f0748c6b3cc325799a46ce2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359f449f-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774367011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367011, "uuid": "6c89d9a7-3434-4ea8-b3b2-98a664a622ad", "comment": "Malware payload (Mirai)", "value": "920b591519de8ccf0643b31607c2eeba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367011, "uuid": "a17f3b00-5736-49fe-be7a-38bcbcb2c6ad", "comment": "Malware payload (Mirai)", "value": "156ecc5c35a5679268ed524fa13dcba27aa14979901206a498047c3d1c5296df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367011, "uuid": "15daaec2-0fb2-452c-a956-0b17ed9be5c9", "comment": "Malware payload (Mirai)", "value": "aec495dc849acdab238464c73f37f4d6b398d62c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367011, "uuid": "ed3761ff-14e6-4b14-b932-fd67b86c6b2f", "comment": "Malware payload (Mirai)", "value": "882f3666c9b7cbfa95485a296dab5880cbfb9712759fa18afa313da37a979a27c43c3dbe72a0dca5bf2a257d3cce2a57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367011, "uuid": "2ee4ec3c-2dee-4ca4-adb5-8e243f8c03a4", "value": "T120C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367011, "uuid": "3082b619-1a75-4b60-9ce5-dfc9921faf3f", "value": "3072:cowpuQyNSG28Ra1styK9flTQPHo9rScVM/9OAvjik:cowpuQyNSG2ma1styKdlTuI9rSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367011, "uuid": "3591c308-4b2c-4e69-b32f-e1ac85923702", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367011, "uuid": "c9e8c764-e323-4c83-b7ef-1f78f85e20b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367011, "uuid": "04b032c2-060b-471b-bfef-5a0d700f5f88", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7142f64-272a-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1774320064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320064, "uuid": "3bb6e1d4-8a05-4353-b778-fffe1078d307", "comment": "Malware payload (Joker)", "value": "daab1d979143bbb21b1bad7af11d75ff", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320064, "uuid": "60ea9826-128e-431c-8a73-8de68a9dab3a", "comment": "Malware payload (Joker)", "value": "15892457638a37a0794793f17723b3dcd32adbdb676a2227430b0e9e76e7315f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320064, "uuid": "06f869d3-5f5e-4894-826f-1e22680c2c08", "comment": "Malware payload (Joker)", "value": "16b518bfd921e2f1a90a8fb1cd6e154f76f77cbc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320064, "uuid": "3d33b7d7-728a-45ca-bf20-e8affc39c8bc", "comment": "Malware payload (Joker)", "value": "ffc08216e1ff38db0ae5a9165149753e8d4a965a3950c8e43970f6eb7816c7bdd99d8bfd3ed844625098f214eea9ea11", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774320064, "uuid": "8102bf33-e66a-46ff-a36c-29a0f92ca130", "value": "T16C2812C2A3955CDDC813B6368C7E0D9686E7D707CE658247D73845CF0FABA88AE43261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774320064, "uuid": "43611824-6b2d-4f4a-aaa7-dda2036e6295", "value": "1572864:uaR37ohw41DlbHhrjmDsQL62vsb61G/aPkqhZqvVePGFY9q3YW5wJRyk5:uckh7DlbBriIQDnTvZqvQPGFyWGO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774320064, "uuid": "a40684a9-2971-4701-a36d-73fed586765d", "value": 96101830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774320064, "uuid": "b2daeb52-db0e-4a05-affd-a1dd919797f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774320064, "uuid": "c098fae2-ac36-48f0-b845-6d082ee86974", "value": "Cool Keyboard_1.0.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d476ae8-2750-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774336073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336073, "uuid": "a54aa908-5d92-4279-85ba-a087ba554a72", "comment": "Malware payload", "value": "fe7fbfa171bb84394e02d6b5f91db600", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336073, "uuid": "990afdc8-f9cb-46f5-bd68-aa009827f732", "comment": "Malware payload", "value": "164274e07226d14c2baf4ed0ff2bb5e77b13e96d31141e8f13d1b4cfebd446b7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336073, "uuid": "ec9d8623-5797-465b-9873-65a072311466", "comment": "Malware payload", "value": "609b3e8e4ea147b946d78f2a38bbe7e45358a4fd", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336073, "uuid": "4be44a46-910d-4fd0-b8b2-b9ce3d50883c", "comment": "Malware payload", "value": "04a451deb34403f80a9e9ff947902ec256cb0221e5e8b06414762b23ecc49902165b75463ee167410d190cf8b5a959a8", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336073, "uuid": "e8587e06-ba98-4a88-a43a-69913ea79f10", "value": "T1F8545DE467F02CF4F826113BF841912DF7E27C1A8B50D56B8366E55A2F235D128BAB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336073, "uuid": "42589b6c-3a49-42e1-8553-dfa296edd4be", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336073, "uuid": "dccd16c3-c758-4a56-9723-051a35976e79", "value": "6144:iBfaB/yttqQ0XWhGF9HIkHyUVdA31Wu7:yfwKttq5XWhGF9HIkH33A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774336073, "uuid": "ff8b00ac-5121-4cd2-aa40-42d089bc4535", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774336073, "uuid": "3c7ae2c8-2408-4dcf-a3b9-b0b3b7f5f713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336073, "uuid": "05bb5e8e-9037-4c22-9dec-ff608bd16b4f", "value": "dhctservices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e6ae89-2773-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774351365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351365, "uuid": "0e6936ff-db63-4622-8b9d-58d008f6afdc", "comment": "Malware payload (ConnectWise)", "value": "7b6ce5c231eece3fb985a7e2e85ba94e", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351365, "uuid": "73e09316-dc18-4c25-9761-5377bb97828f", "comment": "Malware payload (ConnectWise)", "value": "1794e4b1d961bc7fde7b60f4d90e54162e641ec2433574194118a84953e3bc6c", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351365, "uuid": "12eaa6c7-8ba7-45e8-877f-188e522d9fdc", "comment": "Malware payload (ConnectWise)", "value": "1c1b70a6a3e12dca28c74acd2b67de4c8746f1a2", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351365, "uuid": "6772315a-409d-486f-a91d-e17d69bd8c6f", "comment": "Malware payload (ConnectWise)", "value": "ac5fa122558e0003af8e8362ca1337092acfeff20a6ee469766d6f028c017171ce5bc233b59d2cf8be5c5ae62ad6c855", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351365, "uuid": "f2beb2ba-3fc7-4644-8af7-d1f27f9f1f38", "value": "T13CD623116BF89678F0F22A35E87AA071A53B7D115E23D12E2324791E2C75EC0C9A3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351365, "uuid": "a60736b8-a93c-4788-a7ab-0e1b3de705b8", "value": "196608:rHxcp9ym3nltDUJV0Hxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym3oHk:1GplpPGpGGp6GplGpRGp2Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351365, "uuid": "7fad19e2-6552-42ea-97b4-3fabc476ed68", "value": 13447168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351365, "uuid": "ec4f59ae-151a-4f26-88cd-05292130f42f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351365, "uuid": "0f1cdf2b-9c77-4038-a0eb-4b0c1504a32a", "value": "1794e4b1d961bc7fde7b60f4d90e54162e641ec2433574194118a84953e3bc6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba4a7e7-2761-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774343318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343318, "uuid": "034647a6-d8be-4815-928b-fe189ee0f054", "comment": "Malware payload", "value": "69f87adb5ec10d20aa957aa97136cea0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343318, "uuid": "3cc94909-cae8-4998-a579-d92841c49d45", "comment": "Malware payload", "value": "179a4ca6a9dfe66b461e07bff3fa572bf90ed1428352c584b896ebe06e7c4f24", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343318, "uuid": "e14feca5-2511-489d-967c-eb5a8de5b675", "comment": "Malware payload", "value": "365dfd10c94bcdde002f854efc4dc8d2eea6a9d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343318, "uuid": "e0242020-3ecc-4c67-b1de-42fb2c179620", "comment": "Malware payload", "value": "e4f630b83a8d7a39c96ab4a64724bb38707fbf3fca87e45edbf4ddd0e402384132bd7369898702a3b5fa83a23e2be092", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343318, "uuid": "51a0d3b7-a567-4634-9bf1-3e10c4a3a217", "value": "T10A65131126EA2C4D7033BE49DADEF5A5DF5FB772161E634A13B9038B01D58028E8B637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343318, "uuid": "29a4dacd-23dd-40e8-90bf-0c38e6117690", "value": "384:HfKRgsfKRgKfKRg/fKRgcfKRgSfKRgDfKRgrfKRgCfKRgIfKRgtfKRgKHnfKRgsN:X3oJ50J+bYJ3vGQiFS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343318, "uuid": "eeef63ea-14f1-4c58-b253-0b9721954743", "value": 1500906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343318, "uuid": "556092e6-e2df-4fad-acca-2ce66f40b77d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343318, "uuid": "465f9f2e-7d21-47c6-89fa-d676515721eb", "value": "69f87adb5ec10d20aa957aa97136cea0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5022a5c-27c2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774385263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385263, "uuid": "6b60e8dc-d1db-4f87-8994-2a78f4856d01", "comment": "Malware payload (njrat)", "value": "16d42c5f70699b0891e86330f799cd37", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385263, "uuid": "5029d433-6024-4ef3-8548-a4c6db2b8e2d", "comment": "Malware payload (njrat)", "value": "18c5b7a39be2f4a4b2fd45f0f273874f5efcc8751d4e592e5f2bcf6dbf781277", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385263, "uuid": "a5efa71b-ed87-4ec3-b10e-c64eda6b02cb", "comment": "Malware payload (njrat)", "value": "4bc1627fcd87b85316ea4e9ec66df39f6bdd87fe", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385263, "uuid": "7320c015-c68e-4be5-bbc3-193061d611b5", "comment": "Malware payload (njrat)", "value": "46b2ad2d8e4f9626b517d32a15fb738e92a57c1bd2f0bf6be0a8f48964db3c746bab785524a604ff6b8f2e3ddf5ccf55", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385263, "uuid": "5a12595c-5288-4d9d-8e98-affe749cf112", "value": "T12045338A06108260D90B0F30829AE6ABBD3D7E57751B468561DEB7C81DF7B8187DF0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385263, "uuid": "60604b4b-8b8a-4b18-85b3-d7e8bc5ccd20", "value": "24576:tYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnk:aQSadD+RwsLdaCPNj96gGKbBm1mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385263, "uuid": "014be15a-73ab-4ba3-9dfb-cc65a0a8aad5", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385263, "uuid": "e0844a0f-81f3-4d1c-8fa5-445f928578a1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385263, "uuid": "21b4c4ed-dd92-4124-901c-525c3d0bf16e", "value": "MTSetup_v15.3.7191.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be421906-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774359080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359080, "uuid": "85747f11-95e4-4dc0-9b7c-21559f6fd0fb", "comment": "Malware payload", "value": "5197a446f3285018d922585e7e90c12b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359080, "uuid": "0fc8daa0-1402-40c5-a9fe-f4bcb2cd8d06", "comment": "Malware payload", "value": "19230b70e3cca8adf3e3c05d51d83a20e0b0cdda71f3d83fc0ece32deb88fd21", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359080, "uuid": "94a2ba0f-81a2-40e1-9d51-149094ad9ea4", "comment": "Malware payload", "value": "ac5cc4ed18d5e3056c13fd1de2f74c01931d9834", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359080, "uuid": "bd66e354-1f14-4b48-bb1d-be36d024cabd", "comment": "Malware payload", "value": "c228f71f928d9440824c1b20737f6be82b76681c7ed4f27258b82f7220224ea3a6288718868f355aabb3414e7cc2cddb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359080, "uuid": "47df4fc4-8d97-4208-be72-97184c54e660", "value": "T118158F98CD77AE053C0CEA7049BFCDB8981361F678ACC7A487C405B71F449B4A6179BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359080, "uuid": "e483e48b-53e2-4ca3-9500-17f04da8ed2b", "value": "768:AnRbr21q6YiVLovrq6YiVLovrq6YiVLovMJPP0VojuiOgAshfmI:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774359080, "uuid": "14ab1231-4096-41e4-97cd-38b884b13186", "value": 937860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774359080, "uuid": "2f587550-44e3-44a7-af9d-65b101f19d3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359080, "uuid": "616e2fd5-b3a0-408d-acbd-060a9c3e160b", "value": "rTechnicalParameters.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed3f2d-2789-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774360906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360906, "uuid": "26d662df-e3a1-4f1f-a602-5e78472fd1c1", "comment": "Malware payload (RedLineStealer)", "value": "237dc89a3815ab2d849f7c54f3d71a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360906, "uuid": "4c89d972-6de8-429d-afe1-739ec2268d3c", "comment": "Malware payload (RedLineStealer)", "value": "1941cbf3b6e705550f373990b5702220b2c1db0dceaf252ded42cdaff295c54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360906, "uuid": "f28abac4-7e8c-482e-a416-07d7f1d33c33", "comment": "Malware payload (RedLineStealer)", "value": "ab69f2c8c30bbca9787dab26f3c3050b900a86fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360906, "uuid": "41939ca7-1c17-4ab5-9b24-27038a313640", "comment": "Malware payload (RedLineStealer)", "value": "d967f96c88d6ac9d280b31fc7cf10e3398734be393babd3c0554a115b8cee54b8240c54a1b1550dd2d13b6a6043d9b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360906, "uuid": "2226e63d-ea81-4ffe-bb35-a7cb4a81cc83", "value": "T11A546C5873E85619D6BE8B75E4A0D6B092B0EC53E613DB074EC46C7B3D72740EA10AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360906, "uuid": "5eabbdd1-d1ec-4aa0-ab25-8b3d8edbea29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360906, "uuid": "41c4ed6b-0fde-4386-8ea8-5fcac1c0405b", "value": "3072:hcZqf7D346+dQpnAX5IuK2D2E5vN6SfKo5OqUEKVqOEiY3xQeqiOL2bBOW:hcZqf7DItfzvvN6E9UEKVvm4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360906, "uuid": "8ce1afd4-eea6-4782-96a9-c75be2cbe91b", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360906, "uuid": "d7d5175c-83c5-447c-9386-5060cfd4deb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360906, "uuid": "d80304a4-38ab-4470-b76a-aae4f40d2e31", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e29c50-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383763, "uuid": "24adb9cb-199d-4487-ab36-9d5f2fc26f7e", "comment": "Malware payload", "value": "8d85040f696a995091ea490fc95001f6", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383763, "uuid": "a7f73ec0-5b6d-4a89-a7f0-1719ee48bbba", "comment": "Malware payload", "value": "1997409c429dcc0a21011ca52121a8bbaf2a39bacaad31f9cf7a160a89c361aa", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383763, "uuid": "11aa0ee8-ba4d-41ee-bde0-1ab79a1dd5a6", "comment": "Malware payload", "value": "8656c8da2fc6f9794fec2aa60180acd4f846138b", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383763, "uuid": "01d0e000-ad37-4bcd-8430-be8f4617c2d2", "comment": "Malware payload", "value": "4447c8b723edf15f71ed8ba5e5abca9209a65db4f95525e0538ec50e73fb674cf7dadd72b84b735f7aeaf08c4620fca3", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383763, "uuid": "c97f94c0-8f30-4a1c-ae85-0fefece6bf08", "value": "T16D558E6D87A32291DA7AA70432AA391D833E4C5F14F227497F0D2FDD1F14A7A17B819C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383763, "uuid": "63580008-7b55-4bea-b33e-9d58fbebcae4", "value": "24576:Frr7yxKk0/u/MjMRR+Athg+T14bWum07yxKk0/u/MjMRR+Athg+T14bWumb:FrlC03vC03y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383763, "uuid": "70e7d51d-edaf-4a71-ba51-fbdb5b5fb378", "value": 1301182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383763, "uuid": "e23fdadc-3f50-402f-a553-0c7c2f306bb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383763, "uuid": "32bee30d-84c3-437c-92cf-a428844daea8", "value": "Aq9U_darwin.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4dba05-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774337759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337759, "uuid": "669dcdcc-0dbc-4a37-b4c4-6e007e51ef8e", "comment": "Malware payload (ACRStealer)", "value": "33ae8c5d073176a50440e3b2180453b5", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337759, "uuid": "b119046f-cdd4-4a67-8057-9b31114d9240", "comment": "Malware payload (ACRStealer)", "value": "1aa37210eec50b88d055fb1485594770d51c5c53f337d7f10a15ae745b513752", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337759, "uuid": "cd36ef5c-6fc6-4a56-9cae-e14f44fdf25e", "comment": "Malware payload (ACRStealer)", "value": "b99ed19f8f395cdf39f17c53e74a4792756453e1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337759, "uuid": "80e19424-5e66-42b4-b882-ee4cfc52193f", "comment": "Malware payload (ACRStealer)", "value": "5c6f83ebcd9aa40ea8b245f6b6b5cb13746f2d102292efd1d23f78c549af2182a3667aae9bdd3940b02c36603e4614a3", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337759, "uuid": "576a806d-192c-4913-b5c2-c2d4590db67f", "value": "T1B7755C41FDDB24B1E902063648BB62BF6334A9190F35EFC7DA446B79BC736A00D22759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337759, "uuid": "74070094-a8ad-46e3-b9af-076e6b6a866a", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337759, "uuid": "3e274b02-0993-43eb-bdd8-a3ae48dd8e92", "value": "24576:7C7F3WzFOMNRkSSOPUfZbXMzshPCsHPGrYK17c:ASBs5CRYK1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337759, "uuid": "a441240e-9915-4a62-b15b-de8d5faceb7e", "value": 1680896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337759, "uuid": "2186b736-7c2f-478b-877f-ee3133bbb2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337759, "uuid": "ad85a285-8559-4560-ae38-ca6d127e71c1", "value": "33ae8c5d073176a50440e3b2180453b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11322777-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366950, "uuid": "9b369605-ed8b-483a-b55b-b2f0cb03a571", "comment": "Malware payload (Mirai)", "value": "1ef6850c316cf7f18cde855635dceb96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366950, "uuid": "a5a6faac-3fad-4131-afca-5e6f0c066a25", "comment": "Malware payload (Mirai)", "value": "1ab59d6ab09cb478a0a5fb713e7a3f6c85a99626c6654083da4fba67dbfbbab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366950, "uuid": "0b7e6a8f-13f1-42cd-98d3-0df94ae5b1b5", "comment": "Malware payload (Mirai)", "value": "0b35d0dba39d59948a216e81ea1af6c4945045ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366950, "uuid": "54b7006b-e865-4760-976e-684d08c50f8c", "comment": "Malware payload (Mirai)", "value": "c061797741b4837e11670d4fea5d9d0a071028ab2d4ca92e5eaab810e98f318cbee9ba0b5606926c8c3ca64853858698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366950, "uuid": "51ce57dd-18e2-4136-b672-acde5a3ea4e5", "value": "T1E8A2E128E2403E88EFFDDD28869391C1BBBD4BDB72D4C6A713C64F116042056B649FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366950, "uuid": "fd744899-177e-458a-ad92-11e427fb9f49", "value": "384:m/JywWc84Tp2YshxqlDQ31J4TZ/zKqCgS8AqM4uVcqgw05VxJ9o:mRxsSVsMDF9JCgSlx4uVcqgw09Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366950, "uuid": "1aa1756f-4da5-4f22-bc89-d6943a21b94b", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366950, "uuid": "adf95ef5-9de9-49bf-b688-238f7ed98c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366950, "uuid": "f19a6fb9-765e-4bd2-ad3c-d0a2148e38b4", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531601a0-2791-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1774364054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364054, "uuid": "880e65f2-385d-4f57-892e-540c97b04813", "comment": "Malware payload (DattoRMM)", "value": "df662bafeda838b96833cb023e0eab61", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364054, "uuid": "3906f0b2-8033-455c-915d-28f3b33e078e", "comment": "Malware payload (DattoRMM)", "value": "1ace2e60f36788064721606e6eedaf3324e19d66704a48340e3eedc1f33f0d10", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364054, "uuid": "1654ca77-ddb1-4d16-8c5a-ab71ffe0a2a3", "comment": "Malware payload (DattoRMM)", "value": "cb874d9fa5cea60e8075097d4493fa2254f61b79", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364054, "uuid": "2027dea4-0f54-47d4-905c-92c93f0b4998", "comment": "Malware payload (DattoRMM)", "value": "facb123cca8298d6e78f3c0cf2de36ba9a5d6c5ea94bcd94f1772d7affb0af551f390f3cd4ce4cc2b7864318bbac5491", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364054, "uuid": "2c58ac60-d442-4520-aa47-cfdc0301cc1d", "value": "T1B3B63347D9778DF0CA330B3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364054, "uuid": "a632a220-d440-4c23-be44-3a7312d001cf", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364054, "uuid": "d135d38d-3765-4168-b71d-0ef68a7a51d1", "value": "196608:aaZk+wdP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:wnAmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364054, "uuid": "d4b4b7c7-70bc-4a69-aa57-e624cbd3d62a", "value": 11056112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364054, "uuid": "5b154cac-5111-4ce7-b7ac-1daab9f49faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364054, "uuid": "46700015-e8b0-4867-ad44-c25c9787c2dd", "value": "guest_sign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7825afc6-275f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774342641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342641, "uuid": "0f2fd217-4bcf-40ec-ad1f-9b101c801b88", "comment": "Malware payload (Formbook)", "value": "711589249711ddef5429bd38e2e9b0ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342641, "uuid": "f75ef4d2-7401-473a-b68b-dc12581dcbaa", "comment": "Malware payload (Formbook)", "value": "1bcd11b5fab82bc9a8049c0c9feb8b315a5698cc9e5211263d02dcd8012f966a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342641, "uuid": "a97edc05-e69b-4347-a173-40f62958cf39", "comment": "Malware payload (Formbook)", "value": "13588c92767801254505b1e1011af521a2de416c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342641, "uuid": "fa7ca90a-5df7-41b4-a77b-9d936c2c7b3e", "comment": "Malware payload (Formbook)", "value": "140ea118292f482a18ecf20cb4fe686614325ff6d560ff547c64d1b982b063b54edd782e1f5ce8fc63196e9e09bec444", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342641, "uuid": "4666eda4-0ef7-4084-99e1-c1bc78419bf7", "value": "T1FB95D048CEB2877ED28A681942FDBD4662F12BCBA16D2F8FFF537C29DE179851004584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342641, "uuid": "6708cf23-788f-43e6-bfbe-077cee19430a", "value": "49152:vnFUWVDYjfeH0+xwn2cFXrjetNySr8fGFYwCF:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342641, "uuid": "62377135-aa73-49af-b610-b3380b7c4a19", "value": 2010391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342641, "uuid": "4e06db65-fec9-4386-9482-9ba97392ca51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342641, "uuid": "a6e94e25-d30b-4c5d-bb73-b7b48b5d6e4c", "value": "Ziraat Esenyurt 02403026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9d7f27-274e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774335241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335241, "uuid": "c9b4fd55-8204-46f3-98d8-bd64b397d90b", "comment": "Malware payload (RemcosRAT)", "value": "328304e2838ce66f491c65218c12d3b4", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stilldontknowhyisdifficultforworldtounde-duckdns-org", "colour": "#C69C07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335241, "uuid": "845b21f4-61e0-4ec9-a235-1f293275f2bc", "comment": "Malware payload (RemcosRAT)", "value": "1c698e81e5ed96948457ff4dd29cae521fb6106c191d52f4a7e208c54eae525b", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stilldontknowhyisdifficultforworldtounde-duckdns-org", "colour": "#C69C07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335241, "uuid": "fb82568b-424c-4b2a-bbc6-c11997632763", "comment": "Malware payload (RemcosRAT)", "value": "36b0c93872faa2956e7b7039d9204d89d37ec0b3", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stilldontknowhyisdifficultforworldtounde-duckdns-org", "colour": "#C69C07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335241, "uuid": "3c6e4198-0506-4801-8a9e-ce99996d815f", "comment": "Malware payload (RemcosRAT)", "value": "91298d65cc88164324c382f11d52a4a188d523067d4ac62c5a9696f232a4106e2be43d1a1a853a4925d6bbe45285a095", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stilldontknowhyisdifficultforworldtounde-duckdns-org", "colour": "#C69C07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335241, "uuid": "0943ce18-6e20-49cf-acba-4e137a996517", "value": "T1CAF2F26E0102C2AE79E6047C137625B98B08C5A3C2B311C69339B5257EAD4D9EF1EC3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335241, "uuid": "d4b9b003-b088-4de5-9338-0dd88020c787", "value": "768:yJHVBcAvK3Jp8aJsS0Tf+RC2C5iRF9A3DJr5:yJ1BugS0TaZUiRFi3DJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335241, "uuid": "6be9e976-41bc-43ea-9b16-db76e160c089", "value": 37095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335241, "uuid": "044906bd-03f9-4863-99e1-44d90098f86c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335241, "uuid": "be01c825-b12d-4f5f-be2c-3eb36870c0e4", "value": "1c698e81e5ed96948457ff4dd29cae521fb6106c191d52f4a7e208c54eae525b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3f636c-278b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361492, "uuid": "bf059008-819d-4892-a03c-84a528e869b2", "comment": "Malware payload", "value": "2052851267c099a0b09e16e657a13b23", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361492, "uuid": "ce24457a-5d58-4c4e-90d0-0fef9474747a", "comment": "Malware payload", "value": "1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361492, "uuid": "78a55322-5c20-4b83-b26c-8d311f6f748e", "comment": "Malware payload", "value": "382af7c00fcb0021d0e8175757be69f454236ecc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361492, "uuid": "8bc5bc8b-589f-46a6-8760-e37448605c39", "comment": "Malware payload", "value": "bc91505d044e7f801b44a5464cb67e697ec8c8041d2449ea0195779c77ff012a6149fb43b1a1a9bd6903758f15b32d71", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361492, "uuid": "fa6c616d-f3a1-448c-b893-26baea7958c8", "value": "T143D59E21F682D0B2E4E701B156BFABF64D787631172594CBF3C01E6958206C27B3AB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361492, "uuid": "5d4a155d-abc3-4459-8094-dfdb867a00ca", "value": "433a5293c6b4d50375bf4bba0bdbc866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361492, "uuid": "343ea915-8222-47dc-829f-5af280a0acbb", "value": "49152:8sUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUeDU63XYWVCT3e:sabwR0b5R2EoVUQB3G+VUkJ7g6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361492, "uuid": "acd48e0e-3b8a-4569-b87f-e296aa0510ee", "value": 2747904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361492, "uuid": "926237e6-957e-4aec-a9ae-f8e0bcfdcb8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361492, "uuid": "4e80d3dd-df08-40b6-b443-56c5f5a3a619", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e833231-2789-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774360691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360691, "uuid": "0b8a014b-2bcc-4d5b-9178-e6c62a0c846b", "comment": "Malware payload (RedLineStealer)", "value": "7662d22e0bd3c9b23dfaf65acd04d967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360691, "uuid": "5f911ec3-29bf-4559-a0c6-41f18e506cbc", "comment": "Malware payload (RedLineStealer)", "value": "1ecb6cebc56983fcbee15fc018ff1a1d2553ae9a95a0c4f000c4fd42d3b4af76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360691, "uuid": "ad6b63a9-2caa-47b7-9764-8c0a53207f96", "comment": "Malware payload (RedLineStealer)", "value": "8c8e84a016f6a6121596c7280fd00897814b97f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360691, "uuid": "6ab3069d-9907-4e16-b1dd-f4308241a9ad", "comment": "Malware payload (RedLineStealer)", "value": "0e0a0eba60beaf3afcb841806196a9f5873e2a7a379cb3988351db50158eca4710d2e2b364f7b17192ba6019f2d6c22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360691, "uuid": "e310bb78-7118-4423-86e9-83df7d018e9d", "value": "T164546C0877EC4616D27F4B74A4A0E6B087B4DC56EA22D34B4DC02DBB3E22751FA11A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360691, "uuid": "c6e9c124-eea8-4704-9400-4750f09b70ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360691, "uuid": "85fcc4ec-dfcf-4840-99e6-2eacb4669181", "value": "6144:CcZqf7DIEuhACzymwP8aVE2BUEKC26LL:CcUzsvwP8J2U6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360691, "uuid": "d5fb3820-befe-48b2-ae91-ec6ad4fc886d", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360691, "uuid": "a6236653-83af-4001-b17f-bfbeb018ef25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360691, "uuid": "3b9cc55c-fe7c-44f2-b08f-3409c30f7db5", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfdb289-27c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774385841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385841, "uuid": "c5cbf52e-9742-4c63-93ce-e7c383e63598", "comment": "Malware payload", "value": "79eeabb203e133b8edf3fdc8c736e129", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385841, "uuid": "2473fd85-9a62-4902-b945-1f482d40b0de", "comment": "Malware payload", "value": "1f53eec8ea89975348a0b26777b889566a040dfad847f22c6952b3f680e055cd", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385841, "uuid": "89a482c6-2315-47c1-a0c1-2da636d97736", "comment": "Malware payload", "value": "5dcecfa71263c4b505f84661a854b532a5b661cd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385841, "uuid": "976a6cf1-c72f-4a2a-9ed5-9d4d58cde326", "comment": "Malware payload", "value": "e0621cb1ed1699c937624c3d21f1a3aec880cec1f1143f45c500e2f19b9e9e1bc9b975d5a2f3583d5212763e4c803e1e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385841, "uuid": "9777920b-9496-4b2b-aea1-870b6314d0e6", "value": "T1DD4733C9635C76BDA47EDC13D5BA96D28AE56101F0E304CAF434E09E91BB3943B8CB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385841, "uuid": "8e49f477-d961-4281-b793-78d597bade80", "value": "393216:OFVifnNHIjqrzf130GkqPJ1MGVqd2jzimbuW+PFJInipSeXDyvPDvOv5lCnzimbW:I4f9R1EmM72nbUnxNXD6DG5leWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385841, "uuid": "ab8169cc-d1c2-442e-a579-91970b6b625f", "value": 26178647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385841, "uuid": "6b7754fe-dc02-4523-82a7-a2d001a057ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385841, "uuid": "2cddf488-a843-44b2-ae28-48aadaae5d02", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14feb6c-279c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774368909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368909, "uuid": "139de7b5-5839-4c64-a468-52a9acacbfc9", "comment": "Malware payload", "value": "11aa9969a26c1e0ebf4a158db3721f81", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368909, "uuid": "103e7a81-a23f-41c4-8bf4-2fc4bfa7dbc5", "comment": "Malware payload", "value": "1f8d9f0d540b72978adcd392060baf94f50b94231e4adf9d9dfa427fcb0bf3f9", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368909, "uuid": "9bf58e8a-94c0-4e5d-907c-4109937edfee", "comment": "Malware payload", "value": "28726025ed73e29c61849fd91667af45424d885b", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368909, "uuid": "ed885632-1cfa-44e3-978a-86f6003ddb77", "comment": "Malware payload", "value": "f6b99490d01cb1fbe5ea2554ecbc191504ee098501980aa10eb47ba81804a1b04af10fb1b9bd5eac91af55588e01870e", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368909, "uuid": "494f155b-bb43-4629-bb22-1a20ac769281", "value": "T117954A2031678105D86907B45C32C1EE1A363FDABA17C75E3486775EBA336538B23AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368909, "uuid": "c5bb17fb-4053-486a-a631-9cae4407a76c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368909, "uuid": "2e90335f-dfdd-402d-8e16-85689798f676", "value": "24576:DKyOd3yqpKeJjeD8nVwYNgBv689kIc7fz3ZP958nVWjyFoB+kA6m:lOd3wY4tc5PMnVFaB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774368909, "uuid": "e72cddd8-5bab-4aa5-ad29-88ea6ae54e4a", "value": 1996288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774368909, "uuid": "104d456c-51ba-440c-ae67-2acc49bff30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368909, "uuid": "6bcb70ce-957e-4484-bda2-f44f1337ca6e", "value": "1f8d9f0d540b7297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1f074d-278b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774361551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361551, "uuid": "59978cb6-6afd-4c93-b0ac-221fab103918", "comment": "Malware payload (GuLoader)", "value": "ee84041334c9ad09d3f170b21cc2bf91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361551, "uuid": "b5df6e72-657e-4f67-8e24-6e14d8c496cc", "comment": "Malware payload (GuLoader)", "value": "1fa1f6771fb7bd651620defede366815a60327188fb632db13263e259e84387c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361551, "uuid": "f9c45438-7cd0-4300-867b-f92f0c67cf27", "comment": "Malware payload (GuLoader)", "value": "8c7962dbed70a85a1896980501da1623e4a519c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361551, "uuid": "9a2f68c4-4ba6-4e38-b545-81cd25e5f924", "comment": "Malware payload (GuLoader)", "value": "75bcda1ae279b140c4396a834f4ee6d9e50d4b8338ea68b2274654968063205f565243370054afea98b07b7868df2e97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361551, "uuid": "b89ca22d-bf4a-4853-b008-25ae6948c873", "value": "T1AE7412A137C4CA5BD7625FB05C5B4F7E4EE6CC60D1886E1323909E56BC92386EC1DB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361551, "uuid": "9e2ecf09-5f82-4718-bcd7-8076690ecff5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361551, "uuid": "46d21b11-c2ed-46d3-9472-11eae9aa706d", "value": "6144:9pkXGhH0MbGaruHjzdMPTyoF+t84uxnG2SNVLr6jMVNtk5aJd7JRoFxtBbRSHs6E:0E0Mb1rMzEW+BSNh6j4n3ixtGHbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361551, "uuid": "acc810b3-36ee-4e93-96a7-30317b078e4d", "value": 369114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361551, "uuid": "2c25479a-c7d4-431e-aef9-4cfa25790721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361551, "uuid": "bc1ea7f5-dd71-45ff-99fe-1c0b85a0aa11", "value": "Nuevo pedido 4839349.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f69bde7-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366947, "uuid": "c771c20d-7881-4516-b672-37d8c6851ea2", "comment": "Malware payload (Mirai)", "value": "65a2c69aec3e0aa3e4eaecc2d1bc2ae4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366947, "uuid": "090054ea-fc58-40f7-9c78-34a6a4e6bd5b", "comment": "Malware payload (Mirai)", "value": "1ff0e11c9d4ca267555210703fcad5d7c062990c406fcbbd6c0ff4d77049e9a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366947, "uuid": "00fa1237-a6c3-41ed-b763-f5ac43cda24f", "comment": "Malware payload (Mirai)", "value": "44818799a0c50619f8a5c287eae035d35fc59c00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366947, "uuid": "e8447a3c-dcca-4066-88cb-f743fd0aa0fc", "comment": "Malware payload (Mirai)", "value": "1fa21edd73537d16db96859e33702e99fca71f0c553b466b6b8a2a4c463fe7303f596a2127f28fa9b9ba555c70b9b04a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366947, "uuid": "ca2902e5-3fb9-477d-94b4-13b2b5985511", "value": "T1C623F174D417DDE0D8203431FF688AC27622BEB7D9FB2113631192686E49AA66BC9706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366947, "uuid": "a184837e-b608-4dc7-878e-5cb438664b93", "value": "768:D/TYCoIxdE//AnTZbi94/AHkhvG6tah9q3UELbUXfi6nVMQHI4vcGpvr:DECF4/uwqoHkpG6tZLRQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366947, "uuid": "766275c0-a1ca-4f0a-bb3a-be3a5b4b7878", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366947, "uuid": "5a96f898-7bd5-4671-8999-f29f5b5270b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366947, "uuid": "857769a4-9350-4afc-b2d2-691b761cbf99", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8190f1-274d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774335137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335137, "uuid": "c330e526-019e-4030-817b-7d632813ab5c", "comment": "Malware payload", "value": "abbe3b0569fb4d1bbacb228281d36b16", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335137, "uuid": "2e9e9af2-42be-44f1-91e4-b4147410d9f9", "comment": "Malware payload", "value": "211cffac17c11e4ecd5bb815e75418b5dbbe0d90ec34d8453548ec713603fa5e", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335137, "uuid": "41288723-ac2d-427c-a134-8838ed527b8d", "comment": "Malware payload", "value": "bb64856db746fe93456bebb0f746c3e616519a44", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335137, "uuid": "30a3756f-933b-4426-ade7-2cf5de8addfe", "comment": "Malware payload", "value": "d5646ab1ec6e4487b39d41399b474940f9ce6e75a15057f395918fcb52c38d7267ad7e5846bd317850dbabe889a05ee8", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335137, "uuid": "4a5eea2a-76e4-4912-8da0-93ab83910b81", "value": "T1CDB63359B1AB9A47432BD50D4AF291334974AD29B2BDE3FF5493C8A072050F9C2DFE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335137, "uuid": "25647ea8-4185-4677-8b42-6c61c8b97646", "value": "196608:e5i1RVYVyPYoJ5i1RVYVyPt5i1RVYVymh5i1RVYVyPI5i1RVYVypQ/evVy/x/f:ecaV8DJcaV8tcaVXcaV8IcaVCQWvo/9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335137, "uuid": "38b2b446-69b0-4cc1-a545-0387f0e40e72", "value": 11357070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335137, "uuid": "874b6574-947b-4cb6-936b-a55e189a6e66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335137, "uuid": "cc8e0691-59e7-41e4-ad43-c86e8487b948", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6ad22a-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342915, "uuid": "1f9bf6e0-e13d-44fa-8284-6c842d794b7a", "comment": "Malware payload", "value": "8d1203b1ad22bb0f024b8743290e4862", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342915, "uuid": "69636ab2-5f73-42b9-969f-c3e8d26ee22d", "comment": "Malware payload", "value": "2130b936eba818149ae16517427cde3e7704ec246465aecd60be02aaa6cb5b71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342915, "uuid": "03651c0a-267f-43fa-8f51-fd54f5859120", "comment": "Malware payload", "value": "26609bdd8528012f64575d34da7c3b8b4587d838", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342915, "uuid": "6f9b6ff7-5da1-4b40-9677-def1ed45f3e7", "comment": "Malware payload", "value": "de1c6b646f4820792e4f38f3e1108a2147f4ae1181e5de62d77085554e0c30d5d8565e97f42dba4d06a5a2badb7384f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342915, "uuid": "045cdca4-b74c-4cfa-a88e-f8e562c28e8f", "value": "T173646B0753F95588F5F34F88AA7B50A14E77BE861E79C05D01AC140E5BF3AA488A63F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342915, "uuid": "29631112-f8cb-492d-a9d3-6ca54daa981e", "value": "6144:7mpK5+MN7ghoWVciqrFAKBThh+mQ9+FLrbo23Vfgg9nPaAwZih:D9N3WVcmKBThYF9mLr823VfgAnCF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342915, "uuid": "0d5db0b7-11bc-4335-8131-9b604429757c", "value": 317232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342915, "uuid": "855b7456-ce28-467d-8bda-5254638c5a66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342915, "uuid": "517bc5c3-2137-487d-ae94-223aa7d3aadf", "value": "8d1203b1ad22bb0f024b8743290e4862.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d29cf9-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774343463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "a98982fd-a680-4d8b-98d8-ceee91909a89", "comment": "Malware payload (Mirai)", "value": "0ca72bbcb6d1ed1f9c441b1ca85f78f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "922585ea-a4c7-4df1-975b-dc5e9ea24650", "comment": "Malware payload (Mirai)", "value": "213953a9708138e9fd462e87d5de4196f35d6f2ddbf34dec5554a5cab5994fe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "9c57eefd-dbff-4ca6-8e3a-2f3d13826901", "comment": "Malware payload (Mirai)", "value": "5e4a2b8e319532d24000854ce1325fa4f24bacae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "dca1687d-a585-425d-9f06-774636842428", "comment": "Malware payload (Mirai)", "value": "5dd18049d7b11de981303df5f6fdb4a4004fc66c492876441e6925380cdf042b4245f7641d9334bd8226e13850ccbb47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "2f4cddba-156b-4a36-93d1-5f0a9dc700b8", "value": "T1F9D32A45F8514B23C6C212BBFB5E428D3B2A57E8D3EE720399215F25378B85B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "907c344b-82a6-4517-b952-fe2f821e8cc2", "value": "3072:7dfWtsuHLbKW4sBRS4M0LOo0wcBcrNbAN:7d+tfrx7DS4MgOoFcoNbAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343463, "uuid": "d7fa6df4-a409-4f24-b764-27b0376aad82", "value": 141280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343463, "uuid": "2c5a07f0-6791-4dce-941c-8426a51063b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "ccdd3710-ca13-4d51-9ecd-0885d9445e98", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d8f016-2779-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774353784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353784, "uuid": "3f2124d9-210b-4ddb-ba53-4d3f2f12d919", "comment": "Malware payload (RustyStealer)", "value": "5b3f36f15838ad75e24b0b6a4ada1876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PCLocked", "colour": "#AABF1B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353784, "uuid": "52cd68bc-05c7-414c-bb1e-e0c130f622a8", "comment": "Malware payload (RustyStealer)", "value": "214aef60ec3145deea73c796bd025967cda84182041a0c76b56ce6c61304a64e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PCLocked", "colour": "#AABF1B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353784, "uuid": "337e60f6-1c31-4550-95aa-0b1c44fc3978", "comment": "Malware payload (RustyStealer)", "value": "83f949e3adc2228f441eb087bd164755b1673677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PCLocked", "colour": "#AABF1B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353784, "uuid": "6db375b1-be57-4e86-b637-68582d68fd4b", "comment": "Malware payload (RustyStealer)", "value": "09661a1b14ccb8c0a48a57842d4ae0b9e549f7219215c8066922f526db8b6e32415abbc6a920e859d8ae307c1ebbd0b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PCLocked", "colour": "#AABF1B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353784, "uuid": "38d10978-605d-4cb3-9b94-52207f8e15f2", "value": "T182F44C25FE965AACC15AC474834746726A7270CA1F31AAFF02C541393F6AEF61F3C258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353784, "uuid": "19018801-5b59-478f-8007-bdcb0b8be70e", "value": "0cc76de9d55e7b43542e5f9378f32ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353784, "uuid": "807d6f71-73e2-4c10-8b0f-b692f7aff7f7", "value": "6144:/RL4qkzGPLuX1Dl9o0Vee8vcyYCfFMr0FYV6nvZEG6ekV0cxUkZwfZNexKYSjNdl:/TLsZ6yr50vGa7ZndNNr9fUXuqs832", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353784, "uuid": "42038edf-d929-448a-b174-57aa5ef96746", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353784, "uuid": "7bd7f465-75db-4ffc-ba37-185507bf8a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353784, "uuid": "85291a33-95cb-404c-aced-ac146d5c1f24", "value": "PCLocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c58e68a-2774-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351587, "uuid": "8b249657-87e3-45c7-ad20-a420fe844020", "comment": "Malware payload", "value": "5d3569401837f0ffa3a69ff02131b3b2", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351587, "uuid": "42ce75ca-1cbc-478e-bed6-93e273db29eb", "comment": "Malware payload", "value": "21d9ed48d51a5b5edae7eb7f99d1648a3ce7d419bc46234143c37dec4638c60d", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351587, "uuid": "65c81a6d-ba81-4d95-81a5-54a39b29e471", "comment": "Malware payload", "value": "fe3b3127c4328adb4489e84d7fc4c6decc2169ad", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351587, "uuid": "ac9acf57-8eb5-4ec8-adac-b9adc92ebec8", "comment": "Malware payload", "value": "9868fc38b70442bb2bcca4b355333b2fb3e3ac23c721ceac0fc6fca4def8e500013ac7f5b9009c94e81b3e62835eabe1", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351587, "uuid": "e48f9ca5-62ea-421c-81d7-1bed294e66a8", "value": "T12646F162DAD9D528ED3305BBE5C64A96363F01D9EC0B407D03F869CAC779C0A1FA1768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351587, "uuid": "1a909339-9a3e-4ac0-839c-03950cce5c9c", "value": "98304:BHFAzbLUqZ/saQ2Mv68haJBP4lz6HVCDzPk96Tcly1i0GN/lpmz6u5zlUZe2vD:BlAzHUBao6/BgwcDzM/oQ0e/c6u3UZeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351587, "uuid": "9ace22ba-6a56-4ed2-aa07-b14c71ca92a8", "value": 5380934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351587, "uuid": "53457335-5ece-41a5-ba8d-662f0d9aeea3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351587, "uuid": "b25c07b9-eb01-47eb-b039-db27fbb17b9f", "value": "21d9ed48d51a5b5edae7eb7f99d1648a3ce7d419bc46234143c37dec4638c60d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22428a2f-2779-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774353664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353664, "uuid": "6ad83d95-b567-4b59-823d-de46421c1ddc", "comment": "Malware payload", "value": "b57299c00a0991036a96ab4bf5928134", "object_relation": "md5", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353664, "uuid": "6817aa41-2faa-4168-9839-1816469f63f0", "comment": "Malware payload", "value": "2270ddf7d7c4fda14d9ab3eee18466b4ce802dab3d5ddbc09ecb4db0f935a9d9", "object_relation": "sha256", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353664, "uuid": "fdd87c5e-1a80-4f05-8c9e-5f461e1eed70", "comment": "Malware payload", "value": "ec597c6943df8fb754ac8c30a936ccb71f0319ec", "object_relation": "sha1", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353664, "uuid": "8cef1127-ea79-4f54-894a-0f5627caf5eb", "comment": "Malware payload", "value": "e62100b5eb751931a6fb03b903ddd0616aa5f1ada7d97c12c30f10092a36ba9ca812bdc31a5819b6a6eac5f19c27d9ed", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353664, "uuid": "27a7b8df-b25b-4802-9f7b-227095466265", "value": "T193F3E116A698DD2BD29E1D7CF052C9364278EF421A11D7D60ECC5EDF29E3B00CB5229B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353664, "uuid": "b1fc02ad-d447-4d59-9e5a-2ba87045f213", "value": "3072:2A7Nfe/HR3beLBe71dYHkK7Xnxg9nNgF8scJJSfYyBWPkdsiagnItm:1evR3bs6qkAx7LcJCn5Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353664, "uuid": "7eb845d7-1261-4ff4-b0d7-917df6b033f9", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353664, "uuid": "84fcacf2-bd25-45a9-9000-ee026bcb7114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353664, "uuid": "2ce0a115-f862-4ed5-8e74-fe974eaa07f7", "value": "2270ddf7d7c4fda14d9ab3eee18466b4ce802dab3d5ddbc09ecb4db0f935a9d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3dd9ea-2749-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774333124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774333124, "uuid": "f4fc732e-4c2c-4c55-bd07-8d6d2be52109", "comment": "Malware payload (ValleyRAT)", "value": "4ea73573a6d370aa121d475f33ddb4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774333124, "uuid": "e5ba4bfd-5b6f-45c9-8263-e12fa9e73b64", "comment": "Malware payload (ValleyRAT)", "value": "229e38d5c7989e3dfa2ccd5b3a4ea9412ec35038d6571943945a9ad68ef229ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774333124, "uuid": "2211b543-da55-4960-ba17-c86fd2621de7", "comment": "Malware payload (ValleyRAT)", "value": "8e490af3e5a1baec70172ff637b67ee607a85cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774333124, "uuid": "f43b09c3-be27-4d03-8d1d-97281f73967b", "comment": "Malware payload (ValleyRAT)", "value": "60ba511b5127e0c47c98a482b0accc26bbee33f8ff15d32aeac6e0d40c1a39e4d4e3e7fa64a9e9c61c5e82e9830adfc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostRat", "colour": "#66C979", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/GhostRat.HB!MTB", "colour": "#3C19A1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774333124, "uuid": "2976a60f-bb38-4b69-a67b-1fd880fb801a", "value": "T174D38D3176A0C036C4E21531D9B9E77259BEB86223B891CBF7940B7E2F603C19A75F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774333124, "uuid": "dbecb99d-5384-4e4e-a0fb-05a50c71f17a", "value": "3072:Frtpu0mdn67quyNG3R1H8qiOa2gkjXEPxmeN:FrtPmdn67kMB1HY8AZme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774333124, "uuid": "4e2692f2-403e-486c-ba9c-a63c523a685c", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774333124, "uuid": "a1a50672-8fc5-4209-b10d-e6d57001a9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774333124, "uuid": "bcdd4261-aea8-4309-a3cf-87c71c77930c", "value": "GameRepair.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ef69b0-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366929, "uuid": "8cf22b67-a4d9-4a26-bb62-6f490c2f6500", "comment": "Malware payload (Mirai)", "value": "1f3c86c775a1c5c5146721a2110ff685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366929, "uuid": "5a944596-b9a6-4c1b-bf72-819fa5c315c1", "comment": "Malware payload (Mirai)", "value": "249eeb6bea3f938ee02fad14552d23859b8c60dc162e01837762557d263e0005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366929, "uuid": "836934cf-716b-4483-9678-3849aa8e15bc", "comment": "Malware payload (Mirai)", "value": "6bdce57b8ad774bb441ea11e327e09f6288b3dfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366929, "uuid": "da3d5b50-f26c-4193-847b-09c8d834a182", "comment": "Malware payload (Mirai)", "value": "8ff0454a09b612bb371141dcf8ffb90377184bbefbe3c389e162780f0b216aa77a3032dcf6d28372801cc09fa25b6e38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366929, "uuid": "cef83972-2d21-4625-9706-57a3be153ecc", "value": "T19B330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366929, "uuid": "863a48bd-427a-41d7-8b4f-443f449983dc", "value": "768:gduPBFnHooqR8qOCKq2CH4Fje+TK806MMUVjzMfQXOtHud2oGj:r/hqaJ2cjeqK806MHdMfQXoHuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366929, "uuid": "b630c8bf-e7bb-4502-8394-6e4999d09537", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366929, "uuid": "9da0e48a-5860-48e8-bf57-11dc9319b3e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366929, "uuid": "c35445a5-5056-438b-ae68-f1a9e0909ee9", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e5383e-2759-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774339906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339906, "uuid": "24c5d89e-50c8-4a8f-b430-053edec1a34d", "comment": "Malware payload", "value": "4eda16c959d421f3e5215f262547a1ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339906, "uuid": "09d5d24d-a711-455c-a1e0-8aa069de9704", "comment": "Malware payload", "value": "24a4a81c4ec9e2b81441b2df60e86244e85c2256c92650279ba416d45a1249f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339906, "uuid": "c95d8277-73c0-4c74-9337-5dcaf27d0b83", "comment": "Malware payload", "value": "be0197c0a04154507f38da59bf3605adad97e273", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339906, "uuid": "dd2b7923-784a-409a-a7eb-1dc2befc7666", "comment": "Malware payload", "value": "ab2f1b3f0b4b27a682ee19b5f0a93ba5dce389748f15d1f8fe7bbbffccdc58a89a35654d7a0ba7a3b358e70067ef468a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339906, "uuid": "0bdb2af3-e7bf-4bc8-97d1-4d03f0a658c4", "value": "T1DE53A7C83DC2B47C125E69372E2F3086FA3ECFA4650CC259E166AC96B85C71DD63946C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339906, "uuid": "6d220a12-3d9f-42e6-aef7-219a0a4cdf56", "value": "1536:u522TEhHfxxOrIbGR4NWt+F2Mhr9PGiAm5A:i2nhp4Mm4kt+F2sPzlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774339906, "uuid": "3361631f-29da-4c65-9ec0-3a9bc4cd92ad", "value": 65124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774339906, "uuid": "f5879c55-755c-4e26-97aa-2182584bfe7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339906, "uuid": "a3c755b9-1fbe-4153-a461-ff8ea2e8c816", "value": "DOC09121233-_-13443.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eba2fea-279a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774367992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367992, "uuid": "e9aea0c1-2024-4e22-89dd-d3ac7d6efd0e", "comment": "Malware payload (QuasarRAT)", "value": "5aed7c09f4ef529ce51ea745e73f4fe7", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367992, "uuid": "6944f374-af3b-426b-a290-22c2b195806f", "comment": "Malware payload (QuasarRAT)", "value": "251a6c33016820c3bd13af1744d0427e1450d88108edf65e4350d9c1d5bab1d3", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367992, "uuid": "cc555f05-7f69-41b3-8a6e-e3e33a1adbff", "comment": "Malware payload (QuasarRAT)", "value": "0fdc037d45e506d50b5613aa0078c6081c741d53", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367992, "uuid": "98c60c17-e8fc-4fa3-9179-fbe77b016c91", "comment": "Malware payload (QuasarRAT)", "value": "7425507f7c4e9d088b93731b4a78e3c892a7b1e9bb882f25d244a23e624506dfd48140da859d19248a3a3a440a753b9b", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367992, "uuid": "f2541140-d25a-43ac-8fab-6c369474416c", "value": "T116C5F11177F6810AE3BF1AB9ABB6545D1BB7F903E67AD39E1848609D0FA37409D00363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367992, "uuid": "534f00d4-17e7-4f55-9259-1e3a10729f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367992, "uuid": "494fa98a-2d97-4f15-8767-5afc0b7f5bc9", "value": "49152:hxD0fiNgLmnc/N+ZZXZQOLHW7oRHirm2NnPVKKSL7L3wip6saBS:TD0KNgScVIxpLlwZNnwKSL7L3w0Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367992, "uuid": "48716c9e-f171-45a7-b0dc-11e1568bfc58", "value": 2701824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367992, "uuid": "d698f990-e114-4288-b7bd-9547a36a7a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367992, "uuid": "7f3dea7e-3de5-41ae-a549-8b75ca86baff", "value": "251a6c33016820c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c3f951-278f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774363198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363198, "uuid": "4d50ce5e-498d-445f-bfb6-8fe9b2a9197c", "comment": "Malware payload", "value": "6868fe39b5f40d1581454b7d5cb63be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit executable", "colour": "#C5129A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363198, "uuid": "ec8b6c8c-0ce6-4339-a3d9-058233196836", "comment": "Malware payload", "value": "276a2846a2610487a78cc7a19fa6af54dd270465a3165d22590519e25fe95d99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit executable", "colour": "#C5129A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363198, "uuid": "1a3bf926-0bba-4f68-aa82-3f70547a002a", "comment": "Malware payload", "value": "97510e594b247e01eb19a7826046c5f871a7c359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit executable", "colour": "#C5129A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363198, "uuid": "1bb828bc-0feb-4a89-8522-faeed978f963", "comment": "Malware payload", "value": "dfdb4470f416bdd2e7423b6e0d6c03f22843d10b7985c624fad89ee2b2d5fa9fc8065ecf4a53b6a849990b68ed68a0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit executable", "colour": "#C5129A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363198, "uuid": "12bfbee0-40a0-4aa8-b2f7-7c7dfdffd841", "value": "T1C1925318A122A2E4E51BC47399B0F7CEF854318D87D5D8AE0ED469FE6C54E9313192CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363198, "uuid": "bfa7376a-61c9-43e3-813a-81fcc5031d41", "value": "70f35a2ef78247ca47a32c07cf455d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363198, "uuid": "6b0e4d4f-1d2b-4162-b348-fb810e131bb3", "value": "192:Dj1Q85aBXaBjD63FVxHoB3NgxkPD7iHH+uIQD+vNsro1RtyF2g3X31SGBfAUs:FGQB6VVxHQdakLNGozOFSGBfAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774363198, "uuid": "7f7c7aaa-12de-4edf-9505-2d7a01c8df31", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774363198, "uuid": "63f023e2-d614-4204-bcb0-741a94c84e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363198, "uuid": "9d7c347a-1f42-4b5a-9684-af67d9b42f1f", "value": "Unpacked PE Image: 64-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d834b4-2785-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774358983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358983, "uuid": "19cb10a5-f2d0-459c-b68e-d284fd62c288", "comment": "Malware payload (RemcosRAT)", "value": "d8759087c527c1c2815a4eddf492d7bd", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358983, "uuid": "81030a37-1590-4bd8-bc20-0c27d20fcba4", "comment": "Malware payload (RemcosRAT)", "value": "281a51a03eb13cc37ba96c5bebf409b3b459ba3c530dcb6ad09443fd5aa6667a", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358983, "uuid": "dbcadca1-a24c-46b2-8b0d-58d5bf06d1c7", "comment": "Malware payload (RemcosRAT)", "value": "dd24b8185cadd03a8a1f2eda03489c079ee41cdb", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358983, "uuid": "21d419ab-fd0e-4e22-bfd5-b7da9d97a520", "comment": "Malware payload (RemcosRAT)", "value": "60bb56baab494766ee8c63b7c32025f2c5c16e81f0cc60d9911d59340ba7f0b386ca7aafd243a69ea1939cfc52eb0408", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358983, "uuid": "f6fd94e4-f58d-4270-b42a-c12ca1a02c9b", "value": "T1F0C26A6432A5C552E54189BA0CC8D3DB2725FCA3FE664B0B73C17B0F693E490D9A731A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358983, "uuid": "fb4cde8f-58e6-495d-b056-e3b93cbdb436", "value": "384:uUQDPNrNqhRZ6AWxNW2gdan1n2fiepskjszvqaknqTVNcgeNX0:iDPNYhBgs2UoHepvjMvIq7cgeB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358983, "uuid": "9bacdb68-eaa0-44bf-8a6a-1dd6da9b6aac", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358983, "uuid": "0986253f-c7b5-43d6-b589-eca94d754b7d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358983, "uuid": "5a309ca8-814e-4cfd-92ad-5d90009be52d", "value": "d8759087c527c1c2815a4eddf492d7bd.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8359ac67-2797-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774366712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366712, "uuid": "41226b37-f9b1-4db0-94f6-ab119a72d2c0", "comment": "Malware payload", "value": "11ad68c446c8e359a6963f228dcd8d8b", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366712, "uuid": "3d2a5f90-9050-47a2-9099-b6689b4b5fc0", "comment": "Malware payload", "value": "28f8813d88616342b0f64afefcd9dd5df8820853720d673586ebd0fcd35bbce4", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366712, "uuid": "f2827a80-f064-4225-8668-ac877f08d020", "comment": "Malware payload", "value": "5dd4d2a41ce9308e575ae73677159fd041795c32", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366712, "uuid": "7af0bb59-6a22-43a4-8dc2-563334fec8b3", "comment": "Malware payload", "value": "937bcb2782d699d6d610555eeca47d6234615ea510eb7d6a73774add60c283e63df8f49fcc022f69f1928eff21e75cb7", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366712, "uuid": "1706e3a6-450b-4862-bdbd-53aa86cd9a8e", "value": "T1C9659E22ED409462F8DE45BAD3F91FBF1C3C8605132991E3A6D658A64E706E3773D382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366712, "uuid": "b9294bbc-9983-4ced-bdd3-bc36809b1b8a", "value": "8d6bd108b80b10b5fef10967be22f401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366712, "uuid": "4f52c293-dba0-4632-b34e-13e41c70fc57", "value": "24576:AOLQ6wmWFH7Z1FLijZprcaTLqsdBzV480Z7TaYHcByzanswkS+KpPVcoDBopJVLQ:A4wVF111KprcSN0Z7ecy/xDapJP9LAkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366712, "uuid": "2e27f600-82cd-49bd-b909-5ab923b3ff44", "value": 1410048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366712, "uuid": "5b66df2d-481a-4879-a946-f1b9b6ad878a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366712, "uuid": "e6d4c08a-e8f3-459f-a22f-8631cf5056bb", "value": "dakg2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e1c0a4-27d4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774392910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392910, "uuid": "45a01013-9d5d-49ed-8112-147e3bd6f7ec", "comment": "Malware payload (RemcosRAT)", "value": "7d35e2e3649729fcc784723a040e0f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392910, "uuid": "b52098c7-69fd-43be-873e-1aa470b09ea8", "comment": "Malware payload (RemcosRAT)", "value": "293ce7787dac8259ee3212aa8c41b2d6f959a7f6e6bc7eb1dd0b6b32821c80c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392910, "uuid": "06555480-91f1-4138-98a3-aa0e7a94f5ba", "comment": "Malware payload (RemcosRAT)", "value": "5215616c5ef6389c002d4fcb17c4e8b1b36bc863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392910, "uuid": "c0a55230-961a-4109-b5b7-75c8449a972b", "comment": "Malware payload (RemcosRAT)", "value": "354fb5c262254ec100022c06c111e9f73890109232b082e6a37c32b135fa69db01c091b416c8352bb85496d431b6940e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392910, "uuid": "756e23fd-6de2-44c7-a26b-fb5711450db7", "value": "T19B46B8A616DC49D7E48F1B3C25B26A3B8D80FB740476562229C4E8CF5E8DDDB061C7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392910, "uuid": "42a2f56d-23a1-4309-a561-a8c464a20147", "value": "7bf61b3f912ae750453e408d90900b9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392910, "uuid": "9e20177d-9fcc-4715-a561-d718501741bf", "value": "12288:RX7tPMK8ctGe4Dzl4h2QnuPs/Z5vcvTIwT:3X8ctGeQQnuyZ+I+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774392910, "uuid": "3551b630-5421-4313-a9ac-b9132537b848", "value": 5581544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774392910, "uuid": "24f657a6-bf5c-49b5-babb-0fcf1ded051c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392910, "uuid": "e483bcaa-1ccb-4270-a54d-328741e31d5b", "value": "293ce7787dac8259ee3212aa8c41b2d6f959a7f6e6bc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f9cf14-27c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774385877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385877, "uuid": "f83dd09f-c4c3-44d2-a8e1-94cafeeab41b", "comment": "Malware payload", "value": "b946fea347ae1add38678f11524043b9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385877, "uuid": "ef31b5b7-f1fc-43a7-b49e-ae56ee525d13", "comment": "Malware payload", "value": "299619b6a0eea4046543792f73c51ee6496e135e392513869580f972f6009e63", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385877, "uuid": "159b9da1-77a9-4618-b6af-9f7daa88680d", "comment": "Malware payload", "value": "c6a96017370a54fbafa87793ff3a1b0606ded49c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385877, "uuid": "73bdefde-b443-4158-9272-3fe20e4a77e5", "comment": "Malware payload", "value": "453c529b0c4c4528623e22011410c2b912f4dd638241ed001a2b7c1cd20deda1291854dc3e3b72b6bde075fef285574c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "b23-denmap-cfd", "colour": "#DB5569", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385877, "uuid": "1e9b0509-316e-4ed7-8dc5-13892a690e7c", "value": "T123A6AD3276459135D9FB21FA56ACB2FA456EFCA00B3640C7218437EED930EC21E7529E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385877, "uuid": "6a5e2a97-e588-44ba-9542-b4ae18d3ce7b", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385877, "uuid": "1a5b6e3a-cd82-4840-bda9-54a2c5703132", "value": "98304:A0Q51GxhiehH7MZcniemf2TCIpz2EBge3JEICRJQU4AiTBBM2F0Zh5Vh7mADkY:ALPIUZUl3JEjJQU41tBMx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385877, "uuid": "4a6c7746-b83b-4008-91e7-5413adae09eb", "value": 9873408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385877, "uuid": "805a71ad-8598-425e-b7c5-8cf1441ce6b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385877, "uuid": "f1333469-41c9-4763-b537-8c1731fe93f5", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0933ba1c-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366936, "uuid": "e3a65228-6986-4966-a0b3-437a3fe075a9", "comment": "Malware payload (Mirai)", "value": "fb866a89e9b66366397925c28c7b3029", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366936, "uuid": "cdd82fb6-717f-4aa3-9548-9e931bee070b", "comment": "Malware payload (Mirai)", "value": "2a2c1d20daef84c679ee0fd3f29c312a08cfb69859d4b6e2cff3a252d3be5d31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366936, "uuid": "c0ef5fc7-62f2-443a-ac82-e3af6fbb8020", "comment": "Malware payload (Mirai)", "value": "5126d6ac1f7053c22ff6bb5195ec9a12f9e12c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366936, "uuid": "28cd5beb-46e6-4c0e-b793-eccdfd3a7b74", "comment": "Malware payload (Mirai)", "value": "3d0ca03eaad17ed72de5c8abb928cdd6f65623af5ac83e45df099a804ed4daf47388647b57ad3da75edfc98ab1061a99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366936, "uuid": "198d605f-8d5f-4eee-b9fa-641a26bc4e55", "value": "T1B5B2D0DE94C87448CDCC2C3E369E93221C5CA1B1F2AA9FBC93208DC957FD949B589478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366936, "uuid": "e75bbb09-5ac7-4cdd-a085-12c3a07ef469", "value": "768:cGrQlS07dEv0UXqUhvQE+CX0lI2/Fj9mpC4ZqUWvi:vQlS07FUXqIYSXY/NApCAq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366936, "uuid": "3fc4b090-00e2-41be-aa45-f96c62b20ea0", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366936, "uuid": "1bd8851f-83ac-4344-98c3-ac75391f8855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366936, "uuid": "2e5382b0-4215-425b-80da-3c2e6309d0da", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7139034-277c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774355309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355309, "uuid": "f71f4d59-1b61-4c41-8962-2432bad408c6", "comment": "Malware payload", "value": "1c044ff2c2068352a2d87a403c8b3e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355309, "uuid": "d5c44c8e-4d61-4324-ab42-d001f774a66c", "comment": "Malware payload", "value": "2ac53d5140f802a856793cd59736fc7e6264ebba0ab3926aad29ca711091287d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355309, "uuid": "fa8fb796-fc38-4fad-95a4-38da1246a935", "comment": "Malware payload", "value": "8640b5a9dc3f90218c4b481d7034f459b0bbd40a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355309, "uuid": "41885739-06ec-4495-bc2b-a8cb73a267c1", "comment": "Malware payload", "value": "14ed4916b8d7f3f2065aa34f9284392ab4aa816c026c2cc609dc7243ab5325d664643080618bd7ae3bbb4e009f64e6a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355309, "uuid": "ce6af550-9585-44f8-b56d-b3affcf4ddd4", "value": "T1B557AF36E38826A8D517DA34C705A232D3B2B956476693CB0E9BF705DF76B904B3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355309, "uuid": "f9d17abe-4271-4650-95b2-3a99caf42a86", "value": "af63cbc772908f32cee893778da73e33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355309, "uuid": "084b96c2-dd95-4c37-891a-3509d359bf73", "value": "98304:uZuvPm3YlAQNH699pLvgnh3ezVOqKWheTCLmVLnvOMJD5:uEz9o9pLg8MmLmVrDJD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774355309, "uuid": "a3d51d79-f491-4ea9-a09d-fdc7005c960e", "value": 29534208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774355309, "uuid": "61e6d953-7f97-4af3-bb6c-48e3f25c2ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355309, "uuid": "209eb156-0afe-4d34-9b9c-00e8d941306d", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e97900-2793-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774365001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365001, "uuid": "6d27c52f-e92d-49aa-a03a-bd6e66bc5d6a", "comment": "Malware payload (Gafgyt)", "value": "83ad9c36c151baed0c922ef0ef91273d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365001, "uuid": "5e20318f-3402-4637-b099-ac449a7e2001", "comment": "Malware payload (Gafgyt)", "value": "2b2c782f7f19304b1ca618eb7b47af5070c3a573047e548f05af8b28ea27b009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365001, "uuid": "9f1404e1-ed43-486e-949b-70ce68c1a6ef", "comment": "Malware payload (Gafgyt)", "value": "7f801c896cc04cd0c6a090c005f2f4ca4fd3ffeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365001, "uuid": "ac0c5acb-657b-4699-92cf-f2a60dfc8813", "comment": "Malware payload (Gafgyt)", "value": "694a0b85498fd74474fb78fadcbf2f43f0419e3df092f3d1d8729c988d8eadf845d2bd4b5c7a533cb4080ea9b6ee13fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365001, "uuid": "dc4bbe5c-4d2a-4f2b-958b-c2a2f428112c", "value": "T1CFE32817B89584FCC496C2784FEEA226DA65F84CA034B12F2B947F167D5CF20AB1D711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365001, "uuid": "bb6db898-c158-4815-9e77-9383f9b43aee", "value": "3072:nwasxuldw2QT5NM+NDQKUtK/7EBsK2gKyS8sJD9LIqwxE:4Amt5NM+NDQKUKQzs3EqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365001, "uuid": "ce8834bc-c582-4ece-a45f-e2482ab74a26", "value": 151584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365001, "uuid": "5ec0642c-1eb5-48d0-8167-2bfcf47f65d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365001, "uuid": "02735ded-f397-4d47-8774-bdce32ad77ce", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b75d19-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774343525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343525, "uuid": "7a606c6a-9d17-47a1-b4c4-d07436b538c0", "comment": "Malware payload (ValleyRAT)", "value": "00ffde939f9aec68ec9d381e35e89b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343525, "uuid": "13b16961-ec4b-4e71-a394-e6bf45f1de2d", "comment": "Malware payload (ValleyRAT)", "value": "2bfa337934fad04b84c9203ee285ce031f7445b69a1212e62cce7d9987de2b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343525, "uuid": "fd67e1b8-498c-461f-a62f-0c61d7fa8db6", "comment": "Malware payload (ValleyRAT)", "value": "77b90e469ae8930e651a9b8a549d761582f1224f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343525, "uuid": "72ec6ace-a33f-4877-806a-e577d211e213", "comment": "Malware payload (ValleyRAT)", "value": "c2fba3b7978a0c42ef391f1faa34aa6baf4b8145045ea2311c2b1c1f5a929f969b30a1a8e4b49e52af1a60a4341dd265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343525, "uuid": "dba4a0c1-f7f4-4040-a14f-4d2d50dd84d5", "value": "T1EAD36C4B33A450F5D4A7C378C9A25A06E7B378661731A7CF13A4866A6F137D0AD3A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343525, "uuid": "55706fcd-10c2-44d3-b5b5-3ef96060e80b", "value": "2f4c92a36f0eb35d81a44e3422e1082b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343525, "uuid": "705d2bb7-f712-425a-914b-e51f41001e92", "value": "3072:wJvr9PP8JYCBwsioRTwQJvMB2OgtEYdZUbdFz56U1e6wD:wJv5UJYU40TwkMB2OgtEsZK9+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343525, "uuid": "7f08ccce-479e-4ed7-b977-ed552a0211e2", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343525, "uuid": "1ee86e94-363f-4d77-bb99-f4908e5c6ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343525, "uuid": "018394f7-67f8-4587-b415-a032b92d6238", "value": "00ffde939f9aec68ec9d381e35e89b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6717f56-27dc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774396406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774396406, "uuid": "c08e33e0-33fd-4c3f-a523-a0e1b33a2e34", "comment": "Malware payload (ConnectWise)", "value": "b29df3b9a56f1960e1949a84086060d2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774396406, "uuid": "4fd3fc60-6d5b-4620-a0b5-ff2dccbacc5f", "comment": "Malware payload (ConnectWise)", "value": "2c0495c4fc64fee3d8a8411b5cc5d1298348b204dcd5c597ea356a1afc9b01d3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774396406, "uuid": "2ae4415e-d576-418e-89eb-c1fba1e94144", "comment": "Malware payload (ConnectWise)", "value": "df448c0a3ca190f553470a403b29b4088febbca1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774396406, "uuid": "57354eb2-9802-4765-84c4-9bcde9afe8c6", "comment": "Malware payload (ConnectWise)", "value": "6ec8a44600bfd6d6ec951dbf7dd7d6a91f5fd0bce0cfdd86e81cdd62ee3fdacebfbd309bd3b298942c279db9dbb25b46", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774396406, "uuid": "b2dd2be4-e5f1-4a82-b615-fc827ca5d344", "value": "T1D5E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774396406, "uuid": "5054dc5e-c9fc-4614-ac9d-a7181ee50786", "value": "49152:CrGLq7FVsLBe+1GVxrKlsuo1g7GenGwfZVkVjOi8ifyXfKVzhc:Crn/TYGVxzN8GBwRVkGuyXOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774396406, "uuid": "1f83cfd0-3233-4174-a0bb-d1b8fb2cc3eb", "value": 3185152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774396406, "uuid": "4186c4ac-16e5-4810-a9f1-521e6d1041c0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774396406, "uuid": "dfb08918-46b7-43b8-9e6b-f82b222aff53", "value": "BackpackDesktopInstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afc1b80-278e-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774362886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362886, "uuid": "2dd43d31-cb8a-4200-9077-b11e4d65ee54", "comment": "Malware payload (Heodo)", "value": "c937b6091e776caf4069155ac8a3c4c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362886, "uuid": "8a5ab03d-f692-434b-8f67-6701c61b686c", "comment": "Malware payload (Heodo)", "value": "2c5bc2c4ec802a3f138a7a94dbcdab2c915e885590d4756685f669a685fc4365", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362886, "uuid": "69ad8732-133d-4db3-9ad5-9b788468e22a", "comment": "Malware payload (Heodo)", "value": "a3640ed7dea7b5857708bc36779f883d49f81d3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362886, "uuid": "e8926302-71d0-4e0e-b62c-c2e092ffee7a", "comment": "Malware payload (Heodo)", "value": "3d76274e55b431740cdfc4df56b514546782e3812ac98f5837ffc5135b7fc5586ea63e54379ff40c5a73c639dc9a0f12", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362886, "uuid": "c37c1eff-58f7-481a-8cdf-ef0950270c47", "value": "T1BB43190FB582E8B6EDA854B573DA123C0867C5314B037ED38BB034F94D729DAA57285B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362886, "uuid": "d4f616d4-2dfa-4b02-92e0-1996347e86b5", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362886, "uuid": "753425ec-f113-42db-ae4b-c8ea2b86c6f9", "value": "1536:AnWWX1fFFbQcYNWvSA8fnGxWw0c6upOR:6X1fFFbQcYMvAGxWw0c6ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774362886, "uuid": "d305af38-5e19-4eb7-9a6f-192d78596d51", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774362886, "uuid": "ff15b88e-f9bd-4997-939b-1a33222bfef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362886, "uuid": "35c93219-818d-4fe3-a1be-b1054fe8c859", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4c3053-2734-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774324346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324346, "uuid": "1c495c40-8d37-41ee-945f-f66d6f42631e", "comment": "Malware payload (Gafgyt)", "value": "ede66a6e6b8618d1a18e7c9e0f8c2aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324346, "uuid": "82145666-541a-4a6c-b2f9-4ccad54565e4", "comment": "Malware payload (Gafgyt)", "value": "2c96e63cb5ff0db1c728009a6b0eb56f0dec5a29f7928eda6c54f78a6141b11f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324346, "uuid": "b1d2e51e-ff8d-4dc8-aac3-1ed8e37295f8", "comment": "Malware payload (Gafgyt)", "value": "570ead10b7014c90e3463940472350e16b350c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324346, "uuid": "aeedd89a-fe74-41a8-bfff-773b28807f3b", "comment": "Malware payload (Gafgyt)", "value": "faa00ecfffb83037b972fba2a2d39d85e8815bfcb94da9660141777cd5a863e8fb8af7c5f36f26f4a9618c7ca2e60643", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324346, "uuid": "0e2baff4-23eb-4682-86cc-d5bd9d70aa81", "value": "T18544070A7F501DB3C86BCD3B46A60A4A30CC645762953B3B7934E624BE1B94F59E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324346, "uuid": "d54758f4-fdd0-4791-927c-aea1cd01b7e4", "value": "3072:J+PMRmkquhPsb+D86gpDD4gHQnU3k/b9nSA/sRHgetuuRjBq5/QtL:J+PMFhPa6glD4CSfbQq+Aetumq5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324346, "uuid": "7c34399c-c136-447b-a49d-76fe837893fc", "value": 272052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324346, "uuid": "0ab22059-23c0-4ae4-bbfd-ec70a79ad70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324346, "uuid": "fc793f17-50c3-4d10-b6bd-ebafb84b87ec", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e20dc1-27a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774371600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371600, "uuid": "4bed4e0d-b3b8-4563-866f-56e8718ab92e", "comment": "Malware payload", "value": "6018b3f5eb4aff5fd78798664e68159a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371600, "uuid": "efe1af4e-1247-4d40-bab0-f5164eab39ff", "comment": "Malware payload", "value": "2d40d1451168527bfc31d965658b5afc6cb76593b4b38ec7b9b1bd85e5416662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371600, "uuid": "9aba736b-0867-456b-af85-7e146bc79938", "comment": "Malware payload", "value": "89fb479a6936625f051d22aae1bab8ce48098ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371600, "uuid": "9e7252d9-bf4a-4b35-ac3b-ea800d921eb4", "comment": "Malware payload", "value": "805b84e9353d9d37730ed235b707dbe974930762ad0e7663daf4cc97fc61c4d8d9a7ae5a2bd71e8cb022fc9bc20057c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371600, "uuid": "9923ce83-8455-4b3d-9076-2f190dd2a281", "value": "T1E9135B087A6CC52AC69F0E3D78D2195112B6C79B0507CB867ECC25EDFFA3350866179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371600, "uuid": "5b6abcae-b297-4855-bf8e-f13b5390815e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371600, "uuid": "6599bcb6-2146-4980-bd51-5eaf63a93a06", "value": "768:JmQZqx1lYcTYbFQnmtkfop+ko4ZlUgr++QhQE8QHLweXbYC1ckWx:J0lYKmef9kZZlUgr++QhQxQrwSbnWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774371600, "uuid": "63d3acf0-c554-4ffa-b2bd-c7ed5ae24cd6", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774371600, "uuid": "4fe28585-5aaf-4694-b34f-8a5d78210e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371600, "uuid": "e5b8d616-d7cd-441a-9b48-2578d7de4ba6", "value": "uppdattte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dc829d-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1774343313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343313, "uuid": "ca3f685c-927e-4136-a176-0b27f98d6cda", "comment": "Malware payload (MassLogger)", "value": "08b04d30c1a06190fef1e3a3a40d7dfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343313, "uuid": "d10c382d-556c-43b9-b080-77d9c0246b4b", "comment": "Malware payload (MassLogger)", "value": "2df35ad4bd0e0ba9d275b038bc95aeb8ae995bffa1cf33dc49f84b35d1ba829f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343313, "uuid": "c76a1938-fb07-42cf-82ac-25fc5ada3175", "comment": "Malware payload (MassLogger)", "value": "033fac182d754f83a79b1193b51a57f5b789619f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343313, "uuid": "98523594-1a60-458d-b438-de89b97edece", "comment": "Malware payload (MassLogger)", "value": "7ce70654dc7b351b9db0e8474a1c7fb2dd48ed04f779f5e543865b4c11186749b641ddbba76c8fe7f5d9b36598684218", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343313, "uuid": "f23f7004-da5b-4831-b0c9-78f3e911101e", "value": "T14E05C005FAE971F8DF90C939E508E02BD3AC0DD12596A96195C37FBCBCE865AF207910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343313, "uuid": "18e8701c-5140-4484-97d4-8fad63064606", "value": "24576:sIRuofJRVq+DD7tAv+LvyNeWRdjLDZbmBzj:sCfcBZgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343313, "uuid": "cdf11bf6-d442-4be8-a766-12d9568c1de1", "value": 796383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343313, "uuid": "781e3664-3dd8-4a86-872b-29294ab0c856", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343313, "uuid": "3d3e75cf-dca1-4c78-ac3e-8e25b1270d5c", "value": "08b04d30c1a06190fef1e3a3a40d7dfd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3e8acf-27b3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774378939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378939, "uuid": "16e67586-6785-43bc-a3f7-5fb40bb19b1f", "comment": "Malware payload (AsyncRAT)", "value": "e76537c6cae93fc70f205ff21d750ba0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378939, "uuid": "3a5e9e43-41fa-41c2-9b1b-d677093bb295", "comment": "Malware payload (AsyncRAT)", "value": "2ea5f1cccb8e5ec25f29202bc0e19204220a0efe9a58b70b4eb20d637265c068", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378939, "uuid": "beb8dd3f-90e7-4765-bb60-a5912fc843af", "comment": "Malware payload (AsyncRAT)", "value": "a22e24ca99d436ec8ad842255496ecb6736b1161", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378939, "uuid": "02a24387-7676-4c42-a067-8150c761a9b8", "comment": "Malware payload (AsyncRAT)", "value": "6b8d63e7a8bb3f15e6fd0fabb1baf4a95c4a7e737a6ff07add0419ba347101ef5d71b1bf7f1b1f10446f668600512cac", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378939, "uuid": "664d02c7-bca7-4aad-947d-546a0db584c4", "value": "T1AFE23B4877E44312C9FEAFF02DF2710A1675E11B9923EF5E0CD8CA962B63AC146507E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378939, "uuid": "1f6d0526-cb56-4284-b198-6373906e0300", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378939, "uuid": "8422552c-5c01-460d-a538-4c54fd5218a6", "value": "768:KxC3fOJ5ywvGFbO752aDFo9jD8Ojh4bC:yCPOew+bO752uFo9jD8Oj22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774378939, "uuid": "a49f3a3c-9329-4cc6-a72e-a2f82d7f8289", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774378939, "uuid": "f0ee567e-fa86-4791-ad5e-842ef17b0707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378939, "uuid": "6cac561d-7ec1-4a78-ae0c-576b70a1047f", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34b0263-27ad-11f1-a769-42010a9c0008", "comment": "Malware payload (MoqHao)", "timestamp": 1774376348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376348, "uuid": "8ecace11-c4c5-4663-900c-9bcef8f0e3f5", "comment": "Malware payload (MoqHao)", "value": "affd708b133f0e189ae911172b127c36", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MoqHao", "colour": "#8684DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376348, "uuid": "345c6128-eb15-4a68-a14e-f68b90506ca7", "comment": "Malware payload (MoqHao)", "value": "2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MoqHao", "colour": "#8684DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376348, "uuid": "e2226789-211d-458f-a627-c06d1089251b", "comment": "Malware payload (MoqHao)", "value": "f1a8d2d55aeed8a3cbb1cf8bdd078e7fdc0f343d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MoqHao", "colour": "#8684DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376348, "uuid": "3ddfb717-d843-49e1-8cc5-b491f94113b1", "comment": "Malware payload (MoqHao)", "value": "06a61cab43a9b7cf54ea3a48a6f79c691016c7bb8f9b77a205ae04b9af541375f2e56fb6806eace1f4d0d89da18432d4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MoqHao", "colour": "#8684DC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376348, "uuid": "6afac3d5-70ac-4662-adfd-be939db56b36", "value": "T14CD50144FB999F5EC8F353360D396636147AD827C703C283D9382679284BAF40F866E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376348, "uuid": "cd56b49d-a5e5-48bc-be91-e9a0ef4fffb8", "value": "49152:SWhfGorQy2IIRwtEgsFZ9hLjJ4Rgha/Gjp/pOP9gPoUJ3QxjrffKHt:SSuAsfRiEgK/LjedOl/pOPWNpMjrnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376348, "uuid": "98173c88-a64e-496c-8cb2-cc6562be7f10", "value": 3003919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376348, "uuid": "c2fb0ce3-b9d8-4ca4-bf79-abaa7be30f06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376348, "uuid": "1f868b00-4404-4ec7-8100-a8e286ef4949", "value": "sagawa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81aa71d-279d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774369458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369458, "uuid": "736f54fe-5746-41e7-bd42-746d4988490d", "comment": "Malware payload (AgentTesla)", "value": "3d4d52addfbd6b89c611ec15816d4c27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369458, "uuid": "c74a75f8-7619-45c5-904a-9aba53a45c1f", "comment": "Malware payload (AgentTesla)", "value": "301f45ab43a8e2bb80c54b6f4b5ba7b45b528b0b786a64fe40e8c3b4945baf3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369458, "uuid": "a45dc537-02cd-4c2c-a682-a842b6fd8070", "comment": "Malware payload (AgentTesla)", "value": "bfd03577c23f14492add0ceacdd67bc842f34fe0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369458, "uuid": "544a1937-8b63-4d3c-91de-7b55ea8fdae2", "comment": "Malware payload (AgentTesla)", "value": "2f0c0f65eeeae94ca82f4ac8108e4221011aa4ec98e667c4abd1cab4e08015794e2c258d05094473336a4469ec9725da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369458, "uuid": "e5c8be7b-9ad3-4cbc-b878-0272a93f2322", "value": "T10745121C2756DD47C4A54EB049B0E37815F99E8C6412C3039FFBECEBB969B8A78452C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369458, "uuid": "b9313f56-6368-4358-9da8-8180e660a171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369458, "uuid": "a68f9663-3915-46f7-b0ea-cd4dcd3b21ec", "value": "24576:Cicia3ad1hcgIjIPUsTqGsyit4T5wMG0rTf+MxWuPN:lcEkgKI0Guk6MXrTWeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774369458, "uuid": "2e820a83-316b-43e5-bae6-08ebd727f833", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774369458, "uuid": "f5255b05-3fba-4e42-8c03-354d7ddbb47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369458, "uuid": "3117268e-df2a-4855-a998-dc7ab276306f", "value": "301f45ab43a8e2bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c77f389-2734-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774324099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324099, "uuid": "c28c7135-d93d-4f87-9020-92076aee0fe5", "comment": "Malware payload", "value": "f7543a2af2209c37a1ac7b746ab6b551", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324099, "uuid": "0914a7d6-ce3b-4e00-941b-4958ba126e75", "comment": "Malware payload", "value": "309a02bf084c78dc98627209ab63cff1b436f42bcf083e712b780d4ba63bd0ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324099, "uuid": "2dee4505-27ff-4e1d-ae23-fe137016da0f", "comment": "Malware payload", "value": "6627d21e7d13db56e4b83d09f2a3aed09369a61a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324099, "uuid": "68f7d670-a7d5-48b7-96dc-a38e94b9b74e", "comment": "Malware payload", "value": "bd13a5aaf98b7535768d5af63a0c57f7777f2edfa642eac48ccaa9df32e2e8bcba75637e487cde3f5d8f68569267ef12", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324099, "uuid": "0d589b86-8c7c-44d3-afbf-0eb84a35b847", "value": "T146925DB512896C79FBD1CE39AF3C6F4CADE8C2C42124E3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324099, "uuid": "f99cef17-c372-44b2-832d-5cd2beb9ccd0", "value": "384:mFcuQpWx+BL0SWL0gtzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:mF8i+BL0SI02zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324099, "uuid": "60017592-ce25-4182-8484-3d573ba902fc", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324099, "uuid": "263f49ff-0480-41db-aa78-9513b30b6c7c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324099, "uuid": "6b88a597-afef-471c-a8eb-648437ad7150", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1f74e1-2789-11f1-a769-42010a9c0008", "comment": "Malware payload (PhemedroneStealer)", "timestamp": 1774360583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360583, "uuid": "8e2bca70-e3c4-4a4e-9eab-9551184a117e", "comment": "Malware payload (PhemedroneStealer)", "value": "9543de569e732b57fe100921c207ffa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360583, "uuid": "df2d84de-9562-484e-b406-48e0ea87a0d7", "comment": "Malware payload (PhemedroneStealer)", "value": "3105cdda4905008c7e834f22c2710f7f47263e945a160d7180504eda86a08395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360583, "uuid": "34323df2-02c7-4937-8e14-f4f0b9903dd3", "comment": "Malware payload (PhemedroneStealer)", "value": "4cfb71728c5b9608657262394b8fe056fe9ee74a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360583, "uuid": "b39cca9a-0b10-46af-aaf2-ccc1ade33a31", "comment": "Malware payload (PhemedroneStealer)", "value": "222e0a27d0e639843ef3b772720031274b0e4b506539948dd35f7f1998e8b5c18c72c6e14d0793c0060f1fc0e00b6b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360583, "uuid": "21afaf2f-84a4-45f1-8a19-0c0ec393500a", "value": "T14FB4E181AFCF1602CE4D87FF60271AA95325F1574803BBA70B7DFDF1099D24589C6AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360583, "uuid": "f886c4b2-3db2-4ce9-aa6f-59f97c0dba26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360583, "uuid": "49bccbf0-f5aa-44c1-a0c1-4a3a6bd0d4be", "value": "12288:TCXjum11ikTUkhHMSaYuIl8VTQK2Vv4shR:quK1ikzHMs4QnVvthR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360583, "uuid": "2180de2f-a72b-409e-a33c-c1f16f1f77b0", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360583, "uuid": "68ce50b7-4eda-42ac-9085-89c1a3158fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360583, "uuid": "7e6f4bea-eed6-4663-b695-d28d729767f3", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25001dd2-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774342931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342931, "uuid": "b679f6bc-483a-489e-b6fa-78d2e724ee2b", "comment": "Malware payload (Formbook)", "value": "5a96c495b26450554b7c28edead8270e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342931, "uuid": "a586dc60-fe02-4f29-9451-b9c01bb706a8", "comment": "Malware payload (Formbook)", "value": "3123268357e807f0eb5bb07798d973ecedfed9220467cb26c33cdfafc131a5c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342931, "uuid": "fc07314f-ce5e-4e8b-b5db-035adba9c9c1", "comment": "Malware payload (Formbook)", "value": "269464374184cf77831b480855915e70120483d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342931, "uuid": "b4b5ea36-2b17-404f-b12e-8060601d3f17", "comment": "Malware payload (Formbook)", "value": "99dcaf9e6ee511ecf4f7f84bd899e2624d511e227fd888a928871179e769322a19dbc69b03d392b39db8f5f7d2d6967d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342931, "uuid": "7a1523a2-c180-4d13-9c91-13e31524a2be", "value": "T19A846B60DE70173A0F43179DFDA10A168BBDD114593B50F2FAAA038D61465ACE3FEA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342931, "uuid": "1b297e3c-bca2-463a-ae4f-6a6a1aa0bdaa", "value": "3072:Dlrrlt6ltjltWyltWxltWNBl1ltW+ltWnkdlsltslYlLltWwlhltWCl7ltWnkclo:F0D3I6RnOp93pOvNhOKO2R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342931, "uuid": "9877dc56-6b29-4861-97e5-07e055bc6cc1", "value": 399661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342931, "uuid": "c67a7929-d416-4811-ab44-fce3e3dd73e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342931, "uuid": "39e90478-1c95-4d81-8df5-06b7bdaccdc7", "value": "5a96c495b26450554b7c28edead8270e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd077d46-2788-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1774360366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360366, "uuid": "de290a27-24fd-4791-a11c-d0d9bd99403c", "comment": "Malware payload (Arechclient2)", "value": "7a12f54058c95dc05f0c65bffb7ee914", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360366, "uuid": "58c95979-41a3-4785-bf76-b7a2ae09bbcf", "comment": "Malware payload (Arechclient2)", "value": "31bbac0ede381c40bddd1e69e32911ca18fe1c22f5ea7cf4285c82ad58c11977", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360366, "uuid": "0891e5a4-c145-43bf-b554-fb0ea90c48a1", "comment": "Malware payload (Arechclient2)", "value": "9d059fad78fd98b2f8f072e3b52cbbeec51bafc0", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360366, "uuid": "211a53de-1b7a-432a-b852-356d930c7cc4", "comment": "Malware payload (Arechclient2)", "value": "fdfe72fc8f7e6afb46c68470f9a7d21f23a76b2bd6d5cd16d4bceb37325c04b9c1c89cca9206a898691e22abb915ad27", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360366, "uuid": "b94b1a90-37dd-42c4-b527-0f887452bccf", "value": "T1F3934C746BACDF19E6FD1A75A4B2051403F1E18B90A2EF4E8EC060B62E577429913EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360366, "uuid": "a22d19bc-927a-4de3-9265-2910ffed9c23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360366, "uuid": "e15d0d15-aa9e-44d0-b20d-647b61ccabb8", "value": "1536:yG6ijoigj4l/btFh/AgtOUf3NyGjpDliduODv0ujXyyedSkteulgS6p1:gI8tUf3NXjpDl7O70ujyzdY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360366, "uuid": "879e6b40-4865-40f3-9675-732f9913335e", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360366, "uuid": "259cff58-8d3a-4eaa-8813-6ba45217c1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360366, "uuid": "fc9355f3-c44d-49e2-81be-3ba5b1029a4d", "value": "RedLine Payload: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159c7501-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774343335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343335, "uuid": "c5c09217-450b-487d-9f30-401d583b92a4", "comment": "Malware payload (PhantomStealer)", "value": "b10cedb434e63d1fd59a3a0c81b70061", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343335, "uuid": "c48341a6-e2f8-417d-9bfa-b847bc2a31b2", "comment": "Malware payload (PhantomStealer)", "value": "331e1c3a469fd13c772a5a0a2d6ac92595a327fd45d71bfaffd257cf61c55d9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343335, "uuid": "263eb2f7-4367-418c-a86b-571da492ae04", "comment": "Malware payload (PhantomStealer)", "value": "a8d16c0cb7f25fc6a5e8ec201154af3160d009ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343335, "uuid": "56e1157b-65ae-45b3-ac3c-958482e67ce7", "comment": "Malware payload (PhantomStealer)", "value": "154a6eae875ab89a29b934fdc5066ca47d96aaeba8f1a81c021100d42e912a2d17c6bd06c4a22590e11ebd835d67f1db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343335, "uuid": "65dd19b2-18f2-43d0-b388-5baa7dc23628", "value": "T1454512185ED7D85A40E335ECF926EF48ADC8B518BD25CF397ABFA5800106DCA027E4B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343335, "uuid": "adce15dd-7a48-433c-9c43-d60c944f3d33", "value": "192:t44444444444444444444444444444444444444444444444444444444444444V:1xP7HvpXQ5JQm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343335, "uuid": "a4d1a411-d238-4cfa-9d84-30d5144b18f2", "value": 1168189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343335, "uuid": "369d4894-a330-440e-9e3d-3a656f3a375e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343335, "uuid": "33bc32af-2215-4c5e-b258-a9bfd84b40af", "value": "b10cedb434e63d1fd59a3a0c81b70061.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aaf6c9-27c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774386989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386989, "uuid": "bd1ce4f1-c19f-4174-9d86-3032e05f7ca3", "comment": "Malware payload (Smoke Loader)", "value": "4fc5a3458c4f527ec3ccd6fc72e2b5b9", "object_relation": "md5", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386989, "uuid": "5a3f5181-beb3-4a86-8c1b-14ac1cfb946a", "comment": "Malware payload (Smoke Loader)", "value": "33e2fdcd3a1975cfcf0a29e9ae63c6094fac168be9ed78d5f6d879b63d4263a6", "object_relation": "sha256", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386989, "uuid": "edf680d6-0899-4b15-a96e-3aaa4a61fb71", "comment": "Malware payload (Smoke Loader)", "value": "c0f08649abedecee00c2d413f049dff6c5adcfae", "object_relation": "sha1", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386989, "uuid": "308b48f2-2f9a-4653-a985-7ed8944516c3", "comment": "Malware payload (Smoke Loader)", "value": "7cb66068cfe6c950704896d347a7447ba651827ca686ce926b00cdb8301f74189fdf146c685981bdc1d059af5f549675", "object_relation": "sha3-384", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386989, "uuid": "9075feed-2919-4225-8e40-0cbf95bbe166", "value": "T1DA954A0B7DA418EAD46E97328CB726927B30BC190B3263D72E51BA782F727D05D39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386989, "uuid": "4c8fccaa-728c-4a95-8469-4ac538df5eaa", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386989, "uuid": "7b94545a-3826-46b9-81be-b649e67ecdf8", "value": "24576:DK2WmU1vfxSt9nnwpH+LvQzWxR2tK/tPcj6h6m:DK2fU1vfxStRn5LB2KP6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386989, "uuid": "0fa11fdb-9fcb-4723-95c7-b3d05a39fb50", "value": 1904848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386989, "uuid": "a1d5cce0-c3c8-4497-add7-7bf7b4429ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386989, "uuid": "ea2a0d4a-81bb-49a8-9d53-e9bd7bdc0444", "value": "eoDx9Rkv5FHf3ArVFtiNeHir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733d259e-27a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774371839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371839, "uuid": "a3d41d44-9824-4bab-8b03-d10c4dc95b37", "comment": "Malware payload", "value": "a36b255d269853bfa78280de25f9ebfd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371839, "uuid": "9b69ea56-61d8-4507-bc19-ec2847898085", "comment": "Malware payload", "value": "34d2b9918b28dbe787edd3569489738783346ee0bc84e0a83e96f9e3cbfc12a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371839, "uuid": "b1e7c97f-64f7-456b-b47a-3a58278aea69", "comment": "Malware payload", "value": "6b98aa3f71e6752a6a20b16948c7d14593b7a861", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371839, "uuid": "7bf08b20-0915-46bf-bc93-e75f5df279f9", "comment": "Malware payload", "value": "146f151cea9ca23460e5809cdb9c2775e208b3a728ee82c6e94d9d0d89d72e9c893f6f62334f24cd8de9de81fdc99f96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371839, "uuid": "9bfbf5bc-4b3a-4f3b-bbb5-106b182fdd9f", "value": "T162B40DDD2EC2F15D4F829933F20AF06DE4F558F0936A5C29A0DC2C48F8A56D5ED19239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371839, "uuid": "e5932862-c2fa-4bde-a05c-efa721792f52", "value": "6144:zCYwN7QefIn2BMWxXK5BhNllqLO3s68E+P6t:zCldgn2NxXMfrqS3s37PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774371839, "uuid": "7a4e9603-f7ad-4f36-844f-bba1ec6e02b6", "value": 523165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774371839, "uuid": "895ef086-c32f-4099-97f5-f047bde19943", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371839, "uuid": "d88dbd14-72b2-40f8-a357-0545f05fa48a", "value": "PO 03603.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81909ee-27ae-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774376732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376732, "uuid": "13b84da9-96bb-48e1-a809-518aba637f69", "comment": "Malware payload (LummaStealer)", "value": "f720f3b7f18918dc78dc77fb0fe33eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376732, "uuid": "8fc3724b-f901-40fd-9a10-e1cf5108613c", "comment": "Malware payload (LummaStealer)", "value": "37677a26f8a697e36ed7938076389301461202c1ad87602c4cacd7989c0ef1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376732, "uuid": "fd107fbb-b6cd-4195-8031-d699a326f22b", "comment": "Malware payload (LummaStealer)", "value": "99449d90dacf5e85a95792a67f5b5d359b10be84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376732, "uuid": "b0fb67c0-b7c0-440a-89d4-d4d95ee748f6", "comment": "Malware payload (LummaStealer)", "value": "1f234c9f2335d093e932262676b8c9f7b73e2971b40529604c965cace7f5e0173e8432c20ceacfee6a28783782b1dfcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376732, "uuid": "c9ed472d-a6a6-452c-8218-4b95f8a9a896", "value": "T14FC47BC0BD4260BBC4965C350025A77B7EB81F615329DCEFC11728E0E6B5E7B927292B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376732, "uuid": "9c1b2ac4-e5a7-4cd4-8daa-f7943252c2b1", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376732, "uuid": "d28c4af3-f3fb-4f23-98e9-e1d941944804", "value": "12288:GLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQfXnjoMC0YWIjLgX:Qmv66b32F7wQr7e5BnT6qkzsHMz/IjL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376732, "uuid": "c3e4e16a-cd7a-4b59-97f5-7d345254378c", "value": 563024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376732, "uuid": "90d588b6-3cdd-40b7-89d7-88da76726715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376732, "uuid": "ce2c1235-c1c1-47ff-92f0-decca484607a", "value": "37677a26f8a697e36ed7938076389301461202c1ad87602c4cacd7989c0ef1cb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb3d01e-275e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342035, "uuid": "bf31338f-b71d-473e-8c7d-c3d813d4183d", "comment": "Malware payload", "value": "7b63577de087458449571f6e7b7c23c1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342035, "uuid": "4aca2dcc-dc2e-442b-ab8d-e8aa5a5bf9f0", "comment": "Malware payload", "value": "37849045090315732928183cbc7c1456fc1f3eb2a696c4ddeec8d355159131e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342035, "uuid": "afe4b15f-80ab-48a5-bf47-7c4b3922eb0c", "comment": "Malware payload", "value": "5fda2e12b194dabce87c0322f67fa9427e38c149", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342035, "uuid": "1af180e5-c07b-45eb-aea1-46e2fa9f9d01", "comment": "Malware payload", "value": "777cda49e74ec79f61e81cc19c1602a34d436bb5c25c1615715d05283f1a295113c587ec8e3bcea4594c24d72182564c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342035, "uuid": "4a04b169-8b42-4bc6-b0f0-b4c70f13fb1a", "value": "T17AC5C657E8B940E8C0EED574C736E213BEA13489473837E76FA19A601F56FE0A5B8710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342035, "uuid": "209a4cbe-2894-45bc-8240-26a04b5b9760", "value": "49152:TPeFAnNAmrXguU8sJcsi1KcF0ZNHHMhWvmfesKEvut1Ec:T2tzY+NvvbsKCCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342035, "uuid": "e8b14d02-31b4-4bb6-abea-3ec5b398a3bf", "value": 2623987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342035, "uuid": "9216a6b5-3f5c-494a-bc10-d06643fa6c04", "value": "application/x-ole-storage", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342035, "uuid": "823dc809-8cf2-41c0-b857-84870b2082d2", "value": "5a9e6e0a.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065a12d1-278b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361348, "uuid": "a6075432-d21f-423d-b3ce-56e036e02390", "comment": "Malware payload", "value": "42322fce3e2146996783210633545e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit DLL", "colour": "#82D1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361348, "uuid": "a8962504-eee5-49c8-bbca-d8a53be052bb", "comment": "Malware payload", "value": "3864fcdf59b905a49be827e4a7bdfdfeb26f6f1826f31c4cfaf705f499ba6e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit DLL", "colour": "#82D1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361348, "uuid": "e85f2e13-6a89-49b5-939c-c8ab18e30c78", "comment": "Malware payload", "value": "17c27b053dc0b7a53ebd3851f7c7a3b6591d0398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit DLL", "colour": "#82D1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361348, "uuid": "5a3a95c1-9fed-4105-a3af-1e83e4819fd5", "comment": "Malware payload", "value": "8887d2ca4db240150fb916e00af5cdc588d7dfbb25dec020149d45db4c9e1fda1427825d982eaf9f81bdbfdc6fbb8545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 64-bit DLL", "colour": "#82D1D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361348, "uuid": "6979cfe9-f43e-44ae-9410-87567510ab99", "value": "T144B56B6A2BE54095E1BBC239DAA5A143F6F134501F35ABFF1251064E2F73EE0D939322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361348, "uuid": "b345c67a-3233-4fe1-a703-1ae269ecd38a", "value": "24576:/moOJusJBrKWijlRYGOt9gw4p83Ow/U4zJTxyx2z9arfTp4Is6R1f7Jb4ccw5UQ1:+oWRvrR9nU8ew/XdzThof7JbBcwWQH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361348, "uuid": "186913ef-b953-473b-866d-964651c31e7e", "value": 2364416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361348, "uuid": "6758a478-31b7-4de9-ae69-7290567b6295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361348, "uuid": "0886e8f6-5191-4c46-bdec-bfd478cf10d8", "value": "Unpacked PE Image: 64-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483f330e-2773-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351151, "uuid": "d9d6ab9f-8441-4b91-bdf6-5c0999c65bd7", "comment": "Malware payload", "value": "862763a754b4edfc0af31e14a3b1d691", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351151, "uuid": "9c932fa5-4dd6-49a2-9720-ce8da5fa1236", "comment": "Malware payload", "value": "396eb0e817d90cf366b5648f9a97c51bfb37737af13dc4a9e1a768885a867dc5", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351151, "uuid": "07f7e97d-27b2-4b4b-8bc6-e2abff368f40", "comment": "Malware payload", "value": "ceb69dfdd768aa08b86f1d5628bd3a38c1fe8c1f", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351151, "uuid": "4a5ab61a-b2d7-4825-8479-16824923c68e", "comment": "Malware payload", "value": "21461831ba35fd0c4bac597218b94d382478c4b6210ce9e31ad92cc84831cf0ca1909b84d98fb687118a8f0ab29043cc", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351151, "uuid": "80efa117-9cac-4dea-b2bf-71d8b9ac8acf", "value": "T1CA856C73EA587B97F5020870E3F55E5ECE08A4B15249A6D3CB842DA609BB4CBD05F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351151, "uuid": "9c4441e9-221f-4a42-b2dd-2ca9839530a7", "value": "9f8599309f5565c29869c0253bccc18f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351151, "uuid": "31ec3c83-f7de-4d01-aa97-1a26b6a90fb8", "value": "24576:5Pni53B7fLRuGE5NcjmprVgYayiI1RUTEmLEArEGwNpHP8WCB4PFxZOR:5Pi5lLRxEPAmpr9aa1RUT1EWwfRbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351151, "uuid": "c69f1e74-4a3d-4759-a13e-0b3c871f0868", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351151, "uuid": "0cf91e53-b638-4d67-beec-ac65cddf214d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351151, "uuid": "b7ed75aa-4d1c-4af1-8ddd-1ee9031f6819", "value": "396eb0e817d90cf366b5648f9a97c51bfb37737af13dc4a9e1a768885a867dc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b46c5dc-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383798, "uuid": "7c9ab0cb-1942-498d-8983-056883ebbbe7", "comment": "Malware payload", "value": "713b0108059e62a8bcb524b51c26bf44", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383798, "uuid": "0d01643d-cab5-4644-b863-f1d1796770f9", "comment": "Malware payload", "value": "3a79036ce04c504a193d85ddcc34a4ca5df583a64bfff81fc0b53b03d16de6e9", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383798, "uuid": "9b4e7fff-228f-4275-965b-6995266764ac", "comment": "Malware payload", "value": "eb1eba96c7b22ac37be220ccf9315cb4f97b1673", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383798, "uuid": "71f37d9c-5773-4a12-b42d-c467572e9fbb", "comment": "Malware payload", "value": "002c3beacf9495d8faeed63f8e9854f279547e9d833cac582c9c6721514a87edf9115080e50029161fc1121614ca72b0", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383798, "uuid": "0ba3778a-3e43-4c93-a355-ba288230a197", "value": "T1D3F4B5486EF721559263B07D9F6FA00A7234E40B2909DE087E1C97E05F8963897F5FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383798, "uuid": "a0002b31-2f67-4f2d-ba23-e342d91e856b", "value": "12288:UEkjHaYhu/UwoxFBUvtpuL2Be1AuUhsv6uIFTLCNAuKSFK:IHaYhu/UNxFBwBe1AB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383798, "uuid": "56eed4c2-7429-4ca8-8cea-a362d4b21d69", "value": 747375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383798, "uuid": "2c3767ff-a18d-48e5-8751-709160dd68cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383798, "uuid": "bae6dba6-9166-4f94-bbd6-c292e7de5865", "value": "q6AU_win32.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1f9012-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774343238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343238, "uuid": "f87041f8-990f-4019-8545-3c6073a65d18", "comment": "Malware payload (XWorm)", "value": "c8129b988675353b3e6779e6ce38c51f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343238, "uuid": "e204c7fc-6646-49f0-80ec-8ebfccfd9edc", "comment": "Malware payload (XWorm)", "value": "3b02f53d3047588b4c4d0c693f5dd25e1a0bb441170241510a76e81fb963a583", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343238, "uuid": "f571bc6b-07b0-4b4c-b770-2ba10f697447", "comment": "Malware payload (XWorm)", "value": "02d85d55361210889f305d61f7dc5036e34ce972", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343238, "uuid": "be015661-6b5c-446f-bf4a-8ca764fe5c78", "comment": "Malware payload (XWorm)", "value": "3ce7ad329c66e6f19da6a93ad5f61ed4f7fd7d2d757469c337158607d0deeba6080f09188ca7fb2477f56bd8a54ea7f2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343238, "uuid": "ba13a988-6127-4e0e-a9ff-48a61831b893", "value": "T104A4E15D9EC676DCCA850327B4AF500BFB241849F84F92D5C9B7BD14BE73114B02E8AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343238, "uuid": "1ae1dfa7-c09d-4be2-9e79-f23a1baf4ec8", "value": "12288:qJwsec7w63kgUMRkitWtF2E0abfc22+RqTj:qCy0uOsGSosj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343238, "uuid": "2da67b55-2b0f-43ad-9ffd-e8e450ec35e1", "value": 470723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343238, "uuid": "79f1c557-3705-4733-ba85-f04fa2d1e276", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343238, "uuid": "d922cf85-99a8-47a5-b21c-26b76c782cff", "value": "c8129b988675353b3e6779e6ce38c51f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa0c6ff-276e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774349204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349204, "uuid": "87357c7c-871c-4e47-a315-09e2bd318066", "comment": "Malware payload", "value": "525b0e40d2b4da7facfce744eab8758a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349204, "uuid": "30c92896-04c9-4fdd-b8a8-a0ebd2826bcd", "comment": "Malware payload", "value": "3c461d43492cb5c5b720ccc6e1e1c17397c74433b558b2dac19774805f92b7fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349204, "uuid": "0e7e87df-3850-49d5-9389-0e8426d700dc", "comment": "Malware payload", "value": "07175ccdb5a28a800239641139e70d56154deb92", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349204, "uuid": "34dbaa15-31ac-4c98-a76c-f16a642a3b28", "comment": "Malware payload", "value": "127e1fd2332dcf9d864c5eb45a81a24e4e1320466d83025c1d37d1575adb9c575c96c866504aba8a274b8aa447d999c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349204, "uuid": "feff4298-5169-4612-a761-695eadcca76b", "value": "T1A0269F28FE860733ED7B8634C0D6A62BA731ED03E514CF5AD586B7899C337126445A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349204, "uuid": "2f935f69-45bb-44de-bac4-8fb3ad7539c7", "value": "f11716690dc3b1ac312b344caaf28102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349204, "uuid": "d98104d9-a7b8-421f-96c8-8f629979da6e", "value": "98304:lLq9Q5UsLthxIyiGorVLlBAUZLX6YoCZXX:lLKQ5UsLthxhmnVrSCZXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774349204, "uuid": "6aa07d0e-6150-4ab7-ad7b-a6c46f9ab30e", "value": 4719240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774349204, "uuid": "3ed4c504-e1d4-40d0-ada0-816ec24b1a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349204, "uuid": "98ea1043-24e8-4fc8-b34f-5a7038190635", "value": "3c461d43492cb5c5b720ccc6e1e1c17397c74433b558b2dac19774805f92b7fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc038215-2787-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774360042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360042, "uuid": "65d23da2-9251-4f97-9fcf-cec7c446f23e", "comment": "Malware payload", "value": "66c2a04f9e4c5cfaf2c67092f288c9a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360042, "uuid": "217243b6-4f18-4390-85d7-706a255b1738", "comment": "Malware payload", "value": "3cbdfbcb6ecb5bc2bdf5b8f1ce8c18b8f67c19ccfceb6cc21fb006f3916d4d61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360042, "uuid": "aa5b28f1-a468-4596-a005-84e813d1b778", "comment": "Malware payload", "value": "53e5b740dfdfec36d6faa76979494580fd06e8a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360042, "uuid": "a5c5e2b6-8d87-478e-b203-0850764a46e6", "comment": "Malware payload", "value": "b78ca61488e2d5cf7305cd0772277dcef465dfabff348fd2994f14697512b2b85bd07a6537ce650612a33c2e67394548", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360042, "uuid": "47dce24d-1a5e-4cda-b220-5b3eb3e0cb2f", "value": "T10D052A223BE9DFD3D94D8F31C0A1DE143E64D34826ABA70B547929AD9C2A3D0DF53942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360042, "uuid": "09aedd48-7cdd-4354-8555-79f9519b9ac7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360042, "uuid": "de598c6b-abe6-4baf-a18d-06e8636f6d4e", "value": "12288:Ym3WLyIQaKaO6CapE/6vCkkcEUxyhno0elrPrZPtSI8HwbH:YmmLHQaRCapE/6vKRUxytbeNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360042, "uuid": "97dc0ac7-ea59-4487-96fb-290ae9daded4", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360042, "uuid": "d6ac0612-9c2c-483a-8162-b45c66a0cd0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360042, "uuid": "aafc6c81-2596-4f0e-8872-1a65efaa0a89", "value": "Unpacked PE Image: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c861df-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774367224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367224, "uuid": "00b47d93-b5b6-4d82-bf41-22d98a2471e5", "comment": "Malware payload (QuasarRAT)", "value": "caf58507740eab3ac009562572a113fd", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367224, "uuid": "ebb23135-9ce9-416b-84ff-dfe295c8c644", "comment": "Malware payload (QuasarRAT)", "value": "3cd05fd21e40144f7b5b3b58a6567cadbcf9f84421920867e5f142fb6711d6da", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367224, "uuid": "da4eaba9-1052-49de-85c1-4367874c070c", "comment": "Malware payload (QuasarRAT)", "value": "9aa323d83a18e3b7ffde1b318493fb107ddb220a", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367224, "uuid": "420723f2-4d0a-4688-96bb-e34d564af1b2", "comment": "Malware payload (QuasarRAT)", "value": "34ea96ef3b8a70c8d4aab0a0e188a058a181edb68ed0cb63771ab8da22252c5a50a91618b6db79a04ee23c34f4f1da10", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367224, "uuid": "6b296801-0d88-4759-8d22-a1168ef0c88b", "value": "T160A7E14B920830FEDC671B3076B7BF9F0E38221199469EC7D1DD47146C62A7E206B99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367224, "uuid": "3709153f-861a-4947-9367-22d09cefddd8", "value": "357cc116ab0c6386ada7d6d7cb64e784", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367224, "uuid": "02870a5e-9a42-4b4a-934b-093b39c88371", "value": "786432:ClOq1Sz6gw/hGT7p5bmqutZmAxbbLt5YnMwh0zzzt9b8ZcTrSTMLB7s/:Cra6g8yp5bAtcAxbb4TSzt9bWcTrNJs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367224, "uuid": "e63e9919-9534-42a2-9d5a-b6d5addb2097", "value": 44307433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367224, "uuid": "777ef467-13e0-4e1d-b48c-929b33329fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367224, "uuid": "c4a2388f-ee32-4c52-8846-c5736387e0b9", "value": "Clash.Verge_2.4.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d96aed-2785-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774358930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358930, "uuid": "e564e0c7-409b-49de-a587-7e69ee95254c", "comment": "Malware payload (SnakeKeylogger)", "value": "934a25fd3ef8564fe1e5ee273b06a39e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358930, "uuid": "6f40a0b9-7db9-4327-8513-dabcdd62bebd", "comment": "Malware payload (SnakeKeylogger)", "value": "3cf55e4274cd58ab4dd1a4bbcff64227c0043e699b806c2af08cb1fcbd9a8915", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358930, "uuid": "6ea39f3a-49ea-44d9-98ad-3364cf29f202", "comment": "Malware payload (SnakeKeylogger)", "value": "d469c8775165bc560d1c5b4266e66687287f8c09", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358930, "uuid": "1b7de0e1-0e07-4bf2-b6b9-b0b9e5b35f62", "comment": "Malware payload (SnakeKeylogger)", "value": "80ec1983697b796a73eef289f0afa99e7887f3830005edf60929ca3f5e6b5a93874f40b97a03a74c5a3b19312ca434af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358930, "uuid": "bd21246e-9837-4942-99e3-6b43a07c473b", "value": "T1C775AF2280A25FA65B56330E31FF121463B496B66158FA765F38F80E9DEF09600737F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358930, "uuid": "038f8758-3151-42b4-bd38-b314ca47f015", "value": "49152:ZVwdjQ2q51F3wJkWogeuQjembKNXQk86+oKg:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358930, "uuid": "0cea5882-de69-4abe-9e21-86c39a8267d3", "value": 1667960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358930, "uuid": "e974538f-ef5f-433d-a4af-e6e261486f48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358930, "uuid": "26c26ca4-b592-46ab-96bf-c194ec9e008d", "value": "934a25fd3ef8564fe1e5ee273b06a39e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccec5154-2784-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358675, "uuid": "72f58abc-5593-4977-ba77-fd596e736502", "comment": "Malware payload", "value": "f0190dcfe0a2c0018b61f440dd8253ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358675, "uuid": "f94c4cc7-f5d2-44a9-addc-42fe2d0925f7", "comment": "Malware payload", "value": "3d1b3ea691122f9c332232b8c8e6541c431b74b783e317189e3ddaab8f864b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358675, "uuid": "643bfcc7-90a8-4cbd-8b59-f6ffba1dc8bb", "comment": "Malware payload", "value": "163f4370d41d375270e197341f1d5e76bb182c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358675, "uuid": "e6a0cace-18da-4005-96cb-6588875e6825", "comment": "Malware payload", "value": "b941bbc3df032c5c1fa0aa395280b8bf28df6057ae522f40012fe6983634cb70012dd1fa15d3fe832e6ee59791c1d682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358675, "uuid": "609e6013-5cf6-4b8b-8d19-fbdb31dcea31", "value": "T123652302BBD1C4B3D4B125315AB68B91177C79205F628A9F13E07AAE6B316D0D631FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358675, "uuid": "c43ac598-d8b2-4f6e-b90c-d5938e905afa", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358675, "uuid": "2b6bdae6-9ca6-4d82-8c43-11d86686e950", "value": "24576:bN/BUBb+tYjBFHNuuNVv/8tiAcJRSXWVEFQo0sH2O1z9jkkdULauX1zJ54D+qRfb:JpUlRhNV7v/nArXWVOUsH2BoULauX1zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358675, "uuid": "5304d504-667d-486b-89c3-8d773dc1784f", "value": 1510081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358675, "uuid": "3a4522cd-9740-47df-bb97-1585e80a6ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358675, "uuid": "f415114e-15ad-451c-ac34-b12ba623ec98", "value": "k2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a79a384-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343343, "uuid": "a61dd2ee-bc73-465c-bdfe-6e2175a20cfe", "comment": "Malware payload (AgentTesla)", "value": "a5b90c68e7a466d7b21a1a5b8ab58a1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343343, "uuid": "fc98c6fb-1846-46d6-8450-aa73921d7528", "comment": "Malware payload (AgentTesla)", "value": "3d78dd5dc545ac357fc07a24440acc88dff71b7cbca3e80c747215e851fdccf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343343, "uuid": "47bc7557-f2d2-46d3-b81e-53f3b7094fd3", "comment": "Malware payload (AgentTesla)", "value": "52b0feabf4cdd48a37ace6a8c5549ce211320944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343343, "uuid": "6c2b1225-ba45-48fa-a48e-2d5e810f52e6", "comment": "Malware payload (AgentTesla)", "value": "ec54d303e37de54cd982bf6661c8a793406926d2df7dd34b40368f11420cce42bfd11ffcda20f045263c649908540972", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343343, "uuid": "35bd1bee-6061-40ef-9d63-65398e3b1253", "value": "T188843970CD30199A4F536B9EFC660672CEBC8B1A5A2B45B1F5C9030E51055ECF3BEA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343343, "uuid": "8c4f1f33-8f07-44a8-9ff6-a8759e4db3c1", "value": "1536:DxyI1xyI5xyIboXHWxyIIwoxHxyIgjFxyIboXHTxVJexyIb1xyIYxyIb/x6x1mxx:EHlCjWHHJsQHlllNFyA/HlxHIHlUg+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343343, "uuid": "f7ea9a58-89dc-40a8-a59a-f6f7d2e892dc", "value": 380268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343343, "uuid": "790dfeaf-a226-4d51-b1ec-b78bfd5326e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343343, "uuid": "95764d3d-138d-476e-a141-c73b711b023f", "value": "a5b90c68e7a466d7b21a1a5b8ab58a1b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5f5ad3-2792-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774364683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364683, "uuid": "dff73616-6e6b-48b2-ae68-ab437259f79c", "comment": "Malware payload", "value": "d9418fb432631021a15fb896b365d608", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot6503922640", "colour": "#4DFD87", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364683, "uuid": "58146593-f124-4175-89bb-4679d3246183", "comment": "Malware payload", "value": "3f1313c813e51edf5734d9fb99eb93d6c3aa6c309e3f0a6a4878291c5b2ec73b", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot6503922640", "colour": "#4DFD87", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364683, "uuid": "827adaa6-a67b-4a8a-a129-5bbd6a52bb61", "comment": "Malware payload", "value": "f269488e2128128f234ee2e996489317bfa4720b", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot6503922640", "colour": "#4DFD87", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364683, "uuid": "c03fca54-d528-431f-bd97-550cd20ced94", "comment": "Malware payload", "value": "5ba638df6d8c1a131603745dc27da73fe556907b52a5ddeb412f56b297badd75f9b9e9b5caddb56ace41b9a563faa518", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot6503922640", "colour": "#4DFD87", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364683, "uuid": "ff1930c7-8b58-4eea-bf3c-fd4dbca42d1b", "value": "T1A23733CDC512C66A8A5C9024CF4D1893C43D902A4E62EE3F49EBBF867176DAD9D6CCC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364683, "uuid": "27b84d60-93e6-4c54-b022-a26a37fa4c5e", "value": "393216:uzZShZz7v9YAppTWme9vKeUS2JjWDJ1+58+dq1hsweXFf5+U:uIf3vnpMx9vnUS2JcLbF4BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364683, "uuid": "99620637-9302-4d17-9971-9a42b8bfdc3f", "value": 23085792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364683, "uuid": "27211bff-d66a-4ac5-a758-e3ddec3cad4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364683, "uuid": "4d983f49-c5e8-4a4a-878d-c1ca6a5c7fc4", "value": "RuntimeSSH_def7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8496d7ca-275b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774340944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774340944, "uuid": "180d8e97-feed-4e78-ba76-a7f81fe1f813", "comment": "Malware payload", "value": "cc40a433a350d2dd3247c4ca9b36cd45", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774340944, "uuid": "87f7aa64-88b8-4dc2-934c-dcbc2648528e", "comment": "Malware payload", "value": "41270db8f7f015f3c6d6c4972c237be3366237daf9bd431a60cb024d1eb99033", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774340944, "uuid": "556456b1-fcd1-40a7-959d-8fa168bffd8b", "comment": "Malware payload", "value": "2909a85f4b32b1ecd4a6fb74ac048d516be84184", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774340944, "uuid": "4ffe5253-bfc0-4e8b-a9f8-24395ed86938", "comment": "Malware payload", "value": "40aee938a5832f76bbdda4a25c5dbd616444d404ae22e1c7fee06dbbfe3b454c0e2a4af6c44057593dba61e79370c130", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774340944, "uuid": "e2640e71-3b73-4aaf-b987-74fca73c20ce", "value": "T150C412BB8DC63C3EE24E14FB400B79B4B4D64D029838325A305307DD9C6586E299A6FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774340944, "uuid": "16880eeb-caaf-48f6-90d7-28db5c39cecb", "value": "12288:3aktl/NXlQBkUK1Dvgd2YTaZWJEXhp7NhJHp4+7I9my8eHdCeXUDk/d30h:Bx6k71D4kUohtNhP4yzeYCPNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774340944, "uuid": "03c8814e-75a6-409e-9563-4343f93006d9", "value": 590307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774340944, "uuid": "6951ee1f-5519-44a1-9c85-b6091de9bfc6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774340944, "uuid": "35687dcd-40d7-44c1-b023-8a0ed15e0af2", "value": "Inquiry-pdf.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7269b5-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366943, "uuid": "7f9547be-7927-4cfa-b329-68dd540315ec", "comment": "Malware payload (Mirai)", "value": "5c5470efe6b3309fb69d3b67c7605579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366943, "uuid": "24176072-0794-4c60-87db-b935f9f04aad", "comment": "Malware payload (Mirai)", "value": "41e750cba85ad9567c235d681e3bf1cd1de57ceeb4bcac1f7df0ee043dc13f47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366943, "uuid": "28ee75f4-b7bb-434e-8ca0-bf0dda2c6d2b", "comment": "Malware payload (Mirai)", "value": "8c160cd2956204317639a471d719f6f34631a125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366943, "uuid": "03b66957-60eb-48cd-a05b-3f6cebb485e5", "comment": "Malware payload (Mirai)", "value": "e29c9c141adcd0eb34a87b6983eec495cac46f4945d77429f3b350ecf19c409d3b2c8c345173f4acb987541e88b53d4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366943, "uuid": "80a08f7e-013a-4523-b1f7-12c4187d3866", "value": "T13F336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366943, "uuid": "a8ae099d-60a1-400c-ac25-df474d598e4e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9cm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBVm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366943, "uuid": "d450870f-6a9f-4c77-809b-639c5336ab9b", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366943, "uuid": "08ee8272-e755-4721-981f-b5c478711275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366943, "uuid": "e93ecd1d-7b4c-4950-be0d-a2623d3f43f0", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343a4320-2766-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774345534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345534, "uuid": "f4d2429e-b618-4c8a-87cb-def614537f9b", "comment": "Malware payload (Mirai)", "value": "cc8e883cc0ccf4787676760ce747e7dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345534, "uuid": "ee952d0f-0381-411d-8c97-1eb22166de86", "comment": "Malware payload (Mirai)", "value": "427b8d77e54c2aec1be63174679088fab14c14c8429adc8d81866fa0ac453bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345534, "uuid": "4a96c512-7a74-4fc1-91d6-86dba5121400", "comment": "Malware payload (Mirai)", "value": "307c6e2988e560d35c2ad1fd8b6d9965c776932b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345534, "uuid": "4e9b8635-6335-4618-b381-6e5886fb7833", "comment": "Malware payload (Mirai)", "value": "b3125247fd2cd59639e97a64aa1e1b3cdefca0e7e74382907aadc2c0715ad9966a1d1ec41f135b69cb5f65ba36ac45c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345534, "uuid": "6871a1b5-94c2-4799-8045-e11de8d68625", "value": "T1FF534AC19793CCF0F822017214BBA7364B36E5390065EB47EBAD9737AD52602EA5778C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345534, "uuid": "25a79395-a943-42c7-9ff8-e00fbf8aadfe", "value": "1536:c/VpEWtUsBzzBQSrgl1bb3vRgczLJ76rxr:SVpEM3PBVro1v3ZgEFAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774345534, "uuid": "0d5d6768-15d7-49b7-a5a5-9df43fdb4f10", "value": 66644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774345534, "uuid": "b23deb4e-3e90-470f-bb25-fb72f67c076d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345534, "uuid": "41cab7c0-cc10-4758-9062-34b82077d8ca", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a86e001-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358966, "uuid": "ba767d74-5f40-4263-bc09-1f54169f3cce", "comment": "Malware payload", "value": "0904c819a160a0037977df3f19d6cad3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358966, "uuid": "2a623c85-6eae-4919-b56c-b54a6f9f7777", "comment": "Malware payload", "value": "450e5022c7f91d06884200f5ee14f21528def6f3601376f093eb42989d27f9c4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358966, "uuid": "f08b5463-c2a5-42c1-8ec4-76cb2c099c7c", "comment": "Malware payload", "value": "7373bb80fe13fe77b020ab03aeb1ae0e832a76b9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358966, "uuid": "2d2cf7d2-7c3e-4856-8b2a-c0e5dc344e9f", "comment": "Malware payload", "value": "d6062b678dfad3ea219bc6d9f1b8ccf4dc822064d9b01c925f977cdc94856503bcb31ba786bd9826537a3903687c0557", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358966, "uuid": "51444825-61f6-43d3-acd4-dd6dea696b00", "value": "T186C505F1142DF22B8B989DC3D091730BC80CEC56E5ED5B2A79215B3D672A3B935C06E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358966, "uuid": "06e49dd2-e03e-4925-a417-139c2bcd09d7", "value": "96:VApU0C9hK6DUttFidtFtP2SImSVSqFmW78WUYaT11dtgRCtLJATFR5JPPtttttth:3/IYBcY8uyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358966, "uuid": "325c1526-2e64-4f2e-883b-d79d8fb5d5af", "value": 2659737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358966, "uuid": "d32bd88b-bb69-469e-a921-c7861b2b88d6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358966, "uuid": "763efac8-394c-4d14-b505-0ada5f2310e6", "value": "0904c819a160a0037977df3f19d6cad3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3730f129-27bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774382475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774382475, "uuid": "0b722518-abac-4a4d-955e-29965da91aa1", "comment": "Malware payload", "value": "de06b51926e53a05dbe6b9f056657497", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774382475, "uuid": "ebce0cff-d67b-4a1b-b352-d99f2e33196e", "comment": "Malware payload", "value": "45b7d050df530d1fc6d3b9440b8319372c28710b2c897c602af3af9e986fce85", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774382475, "uuid": "a3945161-dc5a-4b24-927a-ab2c7fda2eed", "comment": "Malware payload", "value": "43953c5644082a2bfea75856b0ebb0b5405f6690", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774382475, "uuid": "3973cbc0-885c-4c67-83c6-a0b1e2e4a6cd", "comment": "Malware payload", "value": "1ea63513bc075960e67ff02fae8f89d1af621685a878cc8f28a0f61efa0895c79bf35c42d104ba7afd2a8f38d9cb7459", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774382475, "uuid": "d6a6cad3-6d1d-42ad-9d28-a704d868c8c5", "value": "T164924CB512496D79FBD0CE39AF3C6F4DADE8C2C42124A3ACBA4F39205A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774382475, "uuid": "346453d6-4f8d-41cc-99c6-96fd1c45b755", "value": "384:57cuQpWx+BL0SWL0gAzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:578i+BL0SI0TzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774382475, "uuid": "50b04a14-e186-4ee8-8609-9c3747e29f35", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774382475, "uuid": "b9b6afec-1df3-4c49-be74-738ffebd981d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774382475, "uuid": "c7d58485-d13a-4c14-8be5-a4731fd4e546", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b21e2d-2755-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774338448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338448, "uuid": "17b96772-0fda-4065-b861-a428d49666d1", "comment": "Malware payload (LummaStealer)", "value": "27a137b4c150b991e4e500419208ab86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338448, "uuid": "f31db719-e9a3-4778-85fb-c7e024dc6946", "comment": "Malware payload (LummaStealer)", "value": "45ccb6f0b57114939322e4f0a7d9ccbb800f8715f217e64011483ccc9d44b90a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338448, "uuid": "8c65d3be-ed87-4603-9383-fcad1c42aca9", "comment": "Malware payload (LummaStealer)", "value": "1a2506a2f2220914c64218a56767008e998237d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338448, "uuid": "1bda5909-3bda-406a-955e-1710b8fa2c06", "comment": "Malware payload (LummaStealer)", "value": "063eea773d56c0a0c410b46ae60c5ff3ee8003321970357f53739fcf1f7e5bbd9b7f4b57924bb6a44c53593259501b15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338448, "uuid": "d7b0ac81-f100-41e3-a4aa-18223c7e294e", "value": "T12D644B46E3B758B0C9470C75318BA27F9B3426195328CFDBDBB4DB04F56B1E2A936A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338448, "uuid": "128cda58-9acc-41ab-8a96-f60637c68e4f", "value": "27867cc79589a38330daef3059900599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338448, "uuid": "ec9d94ae-b98d-4f56-801d-d47de7f89be6", "value": "6144:ZzAlUFVs4BFFxE27colG/tcObtAu1l3C6BRVbOmuh4hn+AZrwkdUvtC9+94f:5LFVXzGl9btAuzS6Bjbh+2aAS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774338448, "uuid": "de2fab3b-b960-4886-90a0-cc821a3e8cc8", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774338448, "uuid": "514124ac-ece0-4356-872b-6a9a910e3238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338448, "uuid": "ab180911-999d-4264-8b49-a346aa20c9cc", "value": "27a137b4c150b991e4e500419208ab86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c97c6ce-279e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774369680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369680, "uuid": "25d0cf46-e418-4452-801f-73c27f5108e7", "comment": "Malware payload (Formbook)", "value": "6365f8d7cd1bc73c2da921e8eca755f3", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369680, "uuid": "058be239-d2e8-4b2c-a391-d50dd67f2e86", "comment": "Malware payload (Formbook)", "value": "47053b752966dd81947bb51b6a798f2d9844723bcd7fa2f02cd81ede6f38d5eb", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369680, "uuid": "ce8cf714-e05f-4beb-942d-4f7a769a0895", "comment": "Malware payload (Formbook)", "value": "ac9dba5ee4fd5d159238d12048a208cbb4fe0d6f", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369680, "uuid": "76f34b36-373a-4a5f-b110-9b506dda454b", "comment": "Malware payload (Formbook)", "value": "371501745517052fea3f7bf8c26ddf86527ae00b7ba3cb4d83c98e083109c715284e6e2219a0bb85f486a22affc4b7bd", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369680, "uuid": "681b8827-74e6-43c5-b35a-a1b3c7637bc5", "value": "T18A3512143B28D853D8FF97B85661D2356734AEAED853D7865ED03EEB30E27100A266C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369680, "uuid": "7671e616-b1e7-4e0e-b06d-04b8bfbbc9f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369680, "uuid": "cc82854a-a724-4634-9779-dbcd5c3a0867", "value": "24576:jch15rXDMJMVqoB9MVa0eWMqMRnskG4oR1LEe:QvDMJTobaaJWMNskG9rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774369680, "uuid": "d5658194-d0d0-46bb-838a-d1139a184354", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774369680, "uuid": "685e0ebf-e108-48ab-8d89-68fb240ca471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369680, "uuid": "7770d20d-dee0-463f-b7af-3b413a7255cd", "value": "47053b752966dd81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21446f4-2743-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774330686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774330686, "uuid": "80635a07-a5ce-4acf-bb02-86aa82b5ddde", "comment": "Malware payload (QuasarRAT)", "value": "ba4e85729527955de7c3684a44288fdb", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774330686, "uuid": "c6ea1037-e4a8-498d-8274-155e323ac800", "comment": "Malware payload (QuasarRAT)", "value": "4793195f7da6e22ba89f6782206b02d53ec009a900ac0028c6fdeb8222419f1e", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774330686, "uuid": "b6a8308c-a725-4173-bec0-ef5bf96922c1", "comment": "Malware payload (QuasarRAT)", "value": "e40a2ac933d6ea03bc8d729c90b720f1fdc742d0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774330686, "uuid": "61fa8e3b-55e1-4c62-b165-529d1943dadf", "comment": "Malware payload (QuasarRAT)", "value": "2f45bb4e7274375e3361ef7c9c145b0b4963eb9ac831b1479379d595e5b33a9fd9c604171ba4e93a909eb54845c981c2", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774330686, "uuid": "01f22322-ed34-4b07-857e-8733405969f9", "value": "T189C533884E9D1860F3E5B27AEEEA3C6887C423975B95393DA49105663FB470B340CF9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774330686, "uuid": "bd7bfb8e-4414-49e9-8887-2b115f772b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774330686, "uuid": "8a8ca16a-c275-438a-b458-47471cf3a726", "value": "49152:sF5oMm5KlDe1YG7lO/a7Jqts7in7qcf/9J9NcxFh:qoMm8S1N7oC7JknGoKxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774330686, "uuid": "54ed00f6-e7e6-438f-b42c-8164d02c7fd6", "value": 2634240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774330686, "uuid": "cc1a5574-c325-4f0c-84d2-dbaaff9be873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774330686, "uuid": "34095830-344a-48a2-918c-84c2665c0f38", "value": "verification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc6ee11-2752-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774337119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337119, "uuid": "4873df18-53d6-4052-864b-4b89f804a8ee", "comment": "Malware payload", "value": "7a2a9a75fbf0f30720e7945cbc01faf3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337119, "uuid": "73f153a5-71a9-438c-b1c3-c549e82476fe", "comment": "Malware payload", "value": "47fa296aadadf7242eae49ae92d78187129af87a4871bcf101b945321df2d031", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337119, "uuid": "113e5c20-5f20-4c58-8592-4e048d3c79d2", "comment": "Malware payload", "value": "6e0996beaa06a0899d7b7fef21fcf8e6869a8118", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337119, "uuid": "ddc9413f-2f41-4092-b3b1-9367116dc86f", "comment": "Malware payload", "value": "f5fac252ae5d144a1a06a4fc7f93342f4e25de7edad66f8365068b214e3baf39af68e32ebba94b88f3ecbc6e8fcdc7c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337119, "uuid": "fec39cc3-e217-421c-b692-a83adfc9b81e", "value": "T1AC744A0253F9850DF1F74F886A7A54A18AB7BE9A2C39D41C12A8240D1AF3E54D8F57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337119, "uuid": "124b3123-8c60-4bad-96d7-de3c2e9f683e", "value": "6144:lbRdl5VRUvUn5p3b7PB4el9tCdLt6y5IA4XdEkWkUzjIhfEshMereLJo4nIwU:lbl57y4tb7PB4y98dLUy5R47WrIhfEst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337119, "uuid": "ad294448-5fe3-4aba-8d27-186b5c34fa75", "value": 356386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337119, "uuid": "d0914d9c-cf32-4df5-a974-6cc8aa825f1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337119, "uuid": "56365209-f970-46f7-90cd-77a29dd4e764", "value": "INQ26-012207.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed9d95a-2785-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774358946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358946, "uuid": "6027f985-623b-4ede-9eee-5f4ecb97eabf", "comment": "Malware payload (SnakeKeylogger)", "value": "98e95be02c1e935064cfc9b9a683d82e", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358946, "uuid": "3459e2ef-8037-497e-a4a0-988043e8f970", "comment": "Malware payload (SnakeKeylogger)", "value": "4a6528e3feeff24fbc95289eac90af09fa084d30da62bbbdf3052d6587f44523", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358946, "uuid": "f93049fb-22c7-45d7-bda7-7620f06a46fd", "comment": "Malware payload (SnakeKeylogger)", "value": "62ce026f9d64afb8a28dcc333c2a576d10310964", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358946, "uuid": "f5b9b7f1-19ed-4a3f-ac5e-6378ea6934dc", "comment": "Malware payload (SnakeKeylogger)", "value": "b477c8fdcf5dc4993dd9ed8073a17df9510c560eb775cc5c73996efdbbab8ac16837a693756a783ee3811fcd3a50d6d9", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358946, "uuid": "eb86ad01-d589-4cbf-b5c8-8e0c75f5aace", "value": "T13315CF0ADD552BE49FE56A12E0FA870F77E0261AD044304D9D11FE729FE76C9820FA28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358946, "uuid": "befd0594-33c0-4eae-82fe-3acfc05314c9", "value": "12288:cPgjs+RioiBDpwuh/eSpAnTvzP7DEywUePhwCcQSSUygKygkhCYUkP7puT:cPggEMDpwuh2CAT7DAyjwRSGBkhFzuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358946, "uuid": "b1350ecc-cbb5-4f3e-8878-c2a65b20fe67", "value": 934120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358946, "uuid": "d4d229a6-0660-4536-a66b-9b317f002443", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358946, "uuid": "b87747ef-7ac3-49ba-ab82-3f73a461fa9e", "value": "98e95be02c1e935064cfc9b9a683d82e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a474f5a-2774-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351637, "uuid": "1312438f-5618-45b6-a9b0-07da54be0d43", "comment": "Malware payload", "value": "69853c843688d939affeb88ca2bfab13", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351637, "uuid": "e4641b76-0a65-4267-bc36-699be1622324", "comment": "Malware payload", "value": "4a738a947f4e4b22f36b532a2b7a3af1ae0fe7481d954d467eae80dd765efab6", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351637, "uuid": "776003db-c106-4778-998a-73e87b8238eb", "comment": "Malware payload", "value": "8e6cf85ad18108252ec21a84ef0f44074b4b6869", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351637, "uuid": "5cc331c7-f246-4a13-b85c-693d122f6915", "comment": "Malware payload", "value": "62c9db58c4d1d583bcd4eb0ab1e671c82bcd35efc0e7c2aa8dfaf7f62c70fdd1d3abb92181d995dc645d478ce8b9398d", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351637, "uuid": "7f9a049a-c318-42a5-8d1a-4ac9cb0f35bb", "value": "T16C73E898A2C4B94553872BB73E0770D2E51A08AD744D084FE2E8BDBC7DA5727E4F9930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351637, "uuid": "0f0ecf7d-af37-4bab-8149-6bed9e2b943b", "value": "1536:gxFKiClCY5ovyjyhl6ELqaCL8dgUSiA+komisf1:gDaf8hUELfCLN/+komi+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351637, "uuid": "2eb87453-628c-4578-8146-5030d11ad7c7", "value": 76023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351637, "uuid": "0b199a73-6d6f-456c-9323-dddbbb319ec7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351637, "uuid": "d3ccf1f1-d1ad-41d8-aad5-65a8d8afa207", "value": "4a738a947f4e4b22f36b532a2b7a3af1ae0fe7481d954d467eae80dd765efab6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2246d68-275e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342336, "uuid": "9f4f7c9e-1bd0-4610-8f46-0f691e25586b", "comment": "Malware payload", "value": "e1c8f7e9dd31ccd5c127aef6a9b9b382", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342336, "uuid": "67990015-7c19-4db6-af15-417f91334418", "comment": "Malware payload", "value": "4ae711a1e1208d108e32e224700996275872dd9a2213bd32e3ca38a49681f30f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342336, "uuid": "2c25cad0-bf98-481f-9ff6-283b10f73479", "comment": "Malware payload", "value": "8f1e4d77f8140d891219d3d3af7d4e7ca7c130ab", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342336, "uuid": "08be0eb2-440b-4c4e-b9b3-2d8a43b975e9", "comment": "Malware payload", "value": "3bc073fe1f4a9f0d9eb995085aa2a0544e63fbb7dbd1a01a1f0f055ecb7415a8f7e7047718bf6999555cfa927275039d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342336, "uuid": "bde77a9e-d11d-4ee0-8358-d15e8c8b7151", "value": "T1DED502BB58B2A9576B604663EB0F2C0E335B19D13768D345EA11909C2F7B1C38E92737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342336, "uuid": "f9b049bb-bcf9-4f3b-8dcd-c7e60f8fe5a2", "value": "49152:eOc2yD4lTPXTmEpOaME6Z3lv2lE9kdvu4yjUmMJY1FlVzk:eoyEFPXF002Vv2lE9k1nGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342336, "uuid": "cc8648c1-0336-4c52-9ba9-cfe4a4f129ae", "value": 2888538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342336, "uuid": "6187a196-a38b-4719-b659-2b7d3da6cd0a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342336, "uuid": "69cb7468-39dc-48a6-85d5-420b8473a480", "value": "1014578922 INV_PL SWB Specimen.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a894f4e4-277d-11f1-a769-42010a9c0008", "comment": "Malware payload (GenesisStealer)", "timestamp": 1774355607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355607, "uuid": "f17344ae-8602-40ee-a55c-82c600e98892", "comment": "Malware payload (GenesisStealer)", "value": "9f15f20fa261b9149b0510a5293ff3cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355607, "uuid": "9af72a71-5aa4-4f5a-a18c-5f414b2d8d56", "comment": "Malware payload (GenesisStealer)", "value": "4b52ba67747f8eb8287080a41164972bfa79ad4ac1baf0966fbf54545faeed32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355607, "uuid": "aca403ed-8a81-4052-9755-2fb0de10a88c", "comment": "Malware payload (GenesisStealer)", "value": "13484ac566fb6e205e1138a4a4c188249fc93da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355607, "uuid": "d357ea0e-aacb-4903-8256-f15b34789bfc", "comment": "Malware payload (GenesisStealer)", "value": "fbf6e6ff58c3a11ff07bee6e5a88c1e1bc3ae5c440062963d6225d0bcd5542efbdefb4cb9bf3883f07003db3159f6b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355607, "uuid": "3c952459-0661-4834-868a-a9e22e3c1ba7", "value": "T13918336BBE689C0AC47D333F67F539991E2622032DD4B2D215AD6DBF94F0B509520F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355607, "uuid": "cb5e3ea7-49ff-4799-a0ab-0027fc1b0e16", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355607, "uuid": "18739bd4-6691-48ab-a7d1-8fae4426ce45", "value": "1572864:Xa+BWMFDe45kTRkfm1V/6hDRof62qqIiJajSAA8OLVu9H02nk7rO2P:XLBFle45WCmShDRofGPiErAvVuq2k3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774355607, "uuid": "3a125b01-ed39-40fa-8db8-99c133c867bc", "value": 88190536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774355607, "uuid": "4154dbbb-2413-4bbe-b994-cd663336a71e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355607, "uuid": "deaf707c-4ce0-47e2-81dc-186cec4e4cd8", "value": "JlgexjRD Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8145b502-2785-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774358977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358977, "uuid": "af51e32f-0277-4da3-bf03-fc34f6a46f25", "comment": "Malware payload (RemcosRAT)", "value": "54984712e28987236c825112d5a45eac", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358977, "uuid": "1a315d40-bebf-4adf-b685-d4cd1d1b3bd4", "comment": "Malware payload (RemcosRAT)", "value": "4bbec313a4cf2831c3b19b3bf261a3ead4bfeca3bd5ba79cb07960f4032a3db8", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358977, "uuid": "3eb161e9-a34a-472c-b0d7-d9af5d072553", "comment": "Malware payload (RemcosRAT)", "value": "bb3dbac0be24a30385c2ac3a1c694cff786278da", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358977, "uuid": "f51b7157-d7a6-4bf2-90f5-6eaecd811a71", "comment": "Malware payload (RemcosRAT)", "value": "0dd55b87524452b7fcfa52d3d0d7b588c91a8546ad77ded33a6c7914faf8b5cb08069932b8f2a398ab7dfe738415bb4c", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358977, "uuid": "872eaf6f-9353-4bed-bd71-9ac372ee5c69", "value": "T1E7C28C2436A9D006E1469AB68CDAE2DB2B34BD62DF13864B72C8770F6C7A5D0C853717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358977, "uuid": "a8de0037-6d97-4ac4-be75-1ecf41474c82", "value": "384:Cd/bznpgLpoZr16H0J9pSsV4FHTwJlq8vzCz72aNX/:4YqZree6sVgCv+P2aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358977, "uuid": "b3fdc75b-860d-4b5d-b5c2-357c719750f0", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358977, "uuid": "8ac18a79-b26a-454c-b0ae-823a992633dc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358977, "uuid": "cbad5ed8-02bc-4f6b-a8ca-cfb49b82a155", "value": "54984712e28987236c825112d5a45eac.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1817a294-2730-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774322294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322294, "uuid": "63573515-48a9-44b6-9e13-5dd3d2c56519", "comment": "Malware payload", "value": "bd5b4ea23bc4362fdc9a8472935a234f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322294, "uuid": "022905af-5b98-4891-a9a7-fbdf9e42196e", "comment": "Malware payload", "value": "4e695ecd6d667c960655d5680b69b5399acfb48d8659020ea0166a3f84364298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322294, "uuid": "092e2da4-430f-4b79-96b6-5fcbc130424f", "comment": "Malware payload", "value": "5c4ab38655bcfd91453cdd1790fbc8dd6ed02f66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774322294, "uuid": "8e3b6015-27cd-443e-9110-c32ee6668bf6", "comment": "Malware payload", "value": "ca313ec3028acd8031504c3933938a21b9283bab98ab71f8d93c460c3209d85b041e3296f8b5734d9865fe60bd5864ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774322294, "uuid": "3d6bb153-2f0b-466e-a36d-ae8d63a9a64f", "value": "T19E44165B6E328F5DF661C636C2B74961E39833D722D1C685C5ACFA101E2064FA42FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774322294, "uuid": "1d9f0516-ba3d-44b6-bfff-a184c1475595", "value": "6144:gTkJsCthFelyDJdO18ddukmkbnwvDe3qv8Xjr:qiZFdPwWqUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774322294, "uuid": "e8d6db71-cba6-4536-9255-8ff4f3a7a06d", "value": 255668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774322294, "uuid": "8acb01dd-86e2-4d2c-85f3-7851095a090a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774322294, "uuid": "a6a6e635-04ad-456f-824a-b9274ee53316", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5000d1e0-2791-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1774364049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364049, "uuid": "57ea2411-2a4a-4cfc-b956-4df0f213af24", "comment": "Malware payload (DattoRMM)", "value": "b1155cd6ae1938da0dceb07ca502dee2", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364049, "uuid": "1626250e-a97d-4845-b9ec-c52c74c56223", "comment": "Malware payload (DattoRMM)", "value": "4e8f03ae4eb97e15356e5ea6d5c046e26c662a71c42a2e1752ecacbc768a4d0e", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364049, "uuid": "5fd80d08-6d6b-4f45-b152-9a3cd03db9aa", "comment": "Malware payload (DattoRMM)", "value": "6b6d3ca727b6c83dcea5ce23a71ea2562baa0f98", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364049, "uuid": "7b0dbc8c-8003-4807-9164-e8303ec15e2b", "comment": "Malware payload (DattoRMM)", "value": "c4c4a8ad29bddbdf4513dc6c6b364bfc2f428fa25b75e110b3e1d0a9e8402336a9193c958dffa3ed878e919b8ad94b91", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364049, "uuid": "3c17fefd-fa84-4ac0-a6b1-eb8fef4b77d6", "value": "T17BB63347D9778DF0CA330B3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364049, "uuid": "5797f91c-67b9-4363-b567-bfed0c8155a8", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364049, "uuid": "e3718116-a27b-455f-8cd9-1924113b8e62", "value": "196608:LaZk+wjP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:LnymzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364049, "uuid": "18bab81e-2823-4281-8b9d-f3346df905a0", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364049, "uuid": "045f7be3-53f8-4d54-a970-c99ef596e192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364049, "uuid": "4f58efa4-91f1-41de-ae2e-ec03c97e5c26", "value": "Adobe.Installler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4200a71-277d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774355734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355734, "uuid": "6db13115-8d1a-4b7e-9aaf-ba952c3c99f5", "comment": "Malware payload (RemcosRAT)", "value": "bddd96ebadd2b05fb7b0038621070495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355734, "uuid": "4a24b2ba-aa4a-4e91-99d7-81b9c1fc38f2", "comment": "Malware payload (RemcosRAT)", "value": "505b686537a646709ea054f37fe5e53973dd3778ffc66f36b93b75389d3ef42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355734, "uuid": "3f5059e4-c46d-4836-b55b-1056d55fbaff", "comment": "Malware payload (RemcosRAT)", "value": "16c7b18b86d0c3bf98afaa1a2b0543a3c63c800b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355734, "uuid": "70654da7-3a6f-425c-a1e6-daa663751984", "comment": "Malware payload (RemcosRAT)", "value": "44cd764e03114748b30f07c0458b5f0461d07e6e9b38947b48393a5e6c670e50b22ffa7d17d6509584fe42d621adb49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355734, "uuid": "e7a8e865-49a0-4dbf-97cc-1a016087c7b1", "value": "T1F964B07578CBA8AC621134190B89F9C1F2DC0B3B67D755BD14A8CAA536AD32EC4EF14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355734, "uuid": "4e46e65b-9349-44f9-8396-4895c48d230a", "value": "192:Fpvk1kTo25BHaeVvg+ANrLxLNhqncOLe34hQu9WvANrLxLNc4k1kTo25BHaeVvgW:Fq6BOBBb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774355734, "uuid": "fbdb41c3-5e13-4ea5-9d07-1d54386790ca", "value": 307646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774355734, "uuid": "3ef4c026-124e-4618-80af-c0a579e8c10c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355734, "uuid": "0986c8bd-6eba-45f7-8155-090811009a1d", "value": "seethebestpictureforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231c9c88-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774342928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342928, "uuid": "f05f95d9-1876-440f-bf9d-22204bcb23fe", "comment": "Malware payload (AgentTesla)", "value": "792e99af4e6614d98be9ab9e08c15d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342928, "uuid": "58a9f337-81a3-4850-89d5-ac1f95d2982b", "comment": "Malware payload (AgentTesla)", "value": "513128e493b77eb3aaf87fbc79ae5902c7f3651bd7200f6f1900d1381237e5de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342928, "uuid": "51cdefbd-60a5-403e-87c3-3dd017025582", "comment": "Malware payload (AgentTesla)", "value": "82f15ca76150456f475716daee24971042440e02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342928, "uuid": "4fdccabb-f4ef-4d2a-a3b8-7a1291aa868f", "comment": "Malware payload (AgentTesla)", "value": "d1168a247c9917c5cc4214184b00f61aa81a004260b10fd3128cf2f0a25dd1728a5c9a997adc64d3cd1445501121cd7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342928, "uuid": "2c03849b-0bdd-457d-bae9-4e3ac392c1cc", "value": "T1B9658E49C7535F4AF10C3DD622BF128FA3F21F1F8BD21109EB86AC85196F725116A3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342928, "uuid": "3469e2ce-2b1f-450f-92a7-dedb544fcf7c", "value": "24576:+AgHNe/djqfL4/hiwSeP+US+PppZ2UBhaMM9mjBTg8DEuiF3XrSdF2VwQxchNg38:TwSjqfM/hiwSePFS+PppZ2UBhaMM9md9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342928, "uuid": "aa1cb668-795f-47d6-a594-d8e21ff707f3", "value": 1454098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342928, "uuid": "a4f0b8b6-f0fb-4d42-987c-d4492a6c770f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342928, "uuid": "a5fae013-5504-4f44-8cdb-9ff537bab080", "value": "792e99af4e6614d98be9ab9e08c15d9e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeb06ff-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774343458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343458, "uuid": "31cd4211-1a32-4223-a8bd-da0692fb0686", "comment": "Malware payload (Mirai)", "value": "454d1bcee0f66cb8d99065a8ae44b027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343458, "uuid": "55762265-248b-4a87-b54d-64475439e6bc", "comment": "Malware payload (Mirai)", "value": "515fa150dd501477994d59e301e24a5bc61f121709f92a209ce2d5c4ff1c4f1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343458, "uuid": "98f47230-00bb-448e-8bfc-7e971ee2d2fc", "comment": "Malware payload (Mirai)", "value": "a0421b44da620f7c916cf6d5e93ac067484867c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343458, "uuid": "7ab8f457-83a5-4c6b-8276-2fcb113a9617", "comment": "Malware payload (Mirai)", "value": "678c3580b9868dbba1639c01fd60f6d603685b5eb958ab47dc3e2ff74f2b3b310deb8e9451e5af7a68337170144bbec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343458, "uuid": "6fe619a9-ed27-4912-9a3d-003eaa77ecd7", "value": "T187A3D81E2E348FADF369C23187B74A31979833C626E1C649D27CEA011F6034D245FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343458, "uuid": "d5e5332a-440c-460a-9110-69d3d0315b4e", "value": "1536:kFiu8OMgcmljwTjhG9IcPtCrtCnZCsWJ4Byk0IBmmAek+9yEWpTX:wiuHwngucU4BySBma9yE4TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343458, "uuid": "87a6f22e-7dfa-4749-b5f5-987870e48a7b", "value": 101392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343458, "uuid": "effbfe8f-1343-49d0-88b4-e45f3fc06cfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343458, "uuid": "c83ee304-6e68-4ee7-80ca-ff369f09ac96", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf8c87d-2735-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774324746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324746, "uuid": "9fd9a2d0-b498-4aac-9856-9ef935382302", "comment": "Malware payload (Mirai)", "value": "fbf5d3fa7a58b89e334d7a2d9254a77f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324746, "uuid": "f0580e7a-8cb3-4e49-ac7f-2c5246ce79f1", "comment": "Malware payload (Mirai)", "value": "531b33dd1a79c4a57ca2aed8a2ecd97df05974c84d39d35b8ca4f568edba1ecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324746, "uuid": "5f857525-e276-4193-9ea1-23f4f9be23f9", "comment": "Malware payload (Mirai)", "value": "8dcedc19c2ce3d6faf770d1b5ed9425946e51c8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324746, "uuid": "c2af4b0e-10de-4601-a9b1-ae54f4a73bef", "comment": "Malware payload (Mirai)", "value": "261cf1b444b2c76263790be061dab34954bfa732008a4ff743cdfe0d6f496b73da7ba79357df03ae787d81dccb7d0b08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324746, "uuid": "7c03bb0f-c151-4cd8-9359-605956e55cfc", "value": "T154E34B56EB818B03C4D61775BAAF424533239B64D3DB73069928BFB43F8279E0E63502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324746, "uuid": "3b8700f8-a6fc-452a-8bef-52705280bc61", "value": "3072:aufh1cc4RRye0MKazEdXIZAF3G2Ov1WCWUc1M/9fl:auffxEtKazEdXIZk3GcCWUWM/9fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324746, "uuid": "81194bec-d43d-421c-8a85-03a9e8c2e479", "value": 152266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324746, "uuid": "0e2e9378-f51d-4711-8fb8-11061ee704a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324746, "uuid": "8f8ec327-de5c-4bbd-982c-125810120d69", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3d4b92-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774342895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342895, "uuid": "6bd71404-9a6c-4a5b-857c-d7f0be738dad", "comment": "Malware payload (AgentTesla)", "value": "266de50b4d34dfcc96d9e67894c5c4ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342895, "uuid": "f343dd06-57dd-4ec2-8a14-a682b7cbaafd", "comment": "Malware payload (AgentTesla)", "value": "537bea5c67d3343fd23ecdd7090406be6a818763ebad20a43baae234a46d24f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342895, "uuid": "0806fb5a-aa72-48af-a825-fca6e859ab62", "comment": "Malware payload (AgentTesla)", "value": "c95c0ab7ef8663be72745c200c0289c8d03c909a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342895, "uuid": "80e26c8a-00fa-45e2-abcd-0dbf51833f66", "comment": "Malware payload (AgentTesla)", "value": "59a75ee1f8010608a537e652da9067b022aa807f7e1a1a96b17c278a25ee948c898f671c2a7058f3af2d4cc8ea1db19f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342895, "uuid": "a62ee0c8-872d-4f05-8b54-9f02b5625e1d", "value": "T1B9659D0E664C7CDCFE2C5D1EA28E5707FED0558AF4E610CABE02EC1909639456C68B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342895, "uuid": "9131a4c4-5763-4a14-a987-c7a32f857e62", "value": "24576:ihM4eCI+LNih4NdBsjShd1MQwKwP9an5/uHzYAAc81SGIPNTWie4yk9Ryjlr:ihmIjNSG2qj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342895, "uuid": "5367cd32-662f-4768-8821-035e2c2b271d", "value": 1430926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342895, "uuid": "d3ff61f6-1e57-4d3e-9304-bcdc6158bf5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342895, "uuid": "193f2daa-b92f-4b65-b0ac-40e982c50f52", "value": "266de50b4d34dfcc96d9e67894c5c4ab.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475bb78a-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383791, "uuid": "705d507c-674b-4402-81bb-7b4af0ebceb7", "comment": "Malware payload", "value": "0cdd3f2dcb602de22d16748e66df60aa", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383791, "uuid": "adeb33bf-3313-4cb6-bdb7-f6587aad78bd", "comment": "Malware payload", "value": "53cd02e362b1e50a2dc7becbbba17ab0c196c9a7dd378d6af516570acc046a8e", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383791, "uuid": "aadbbef0-ad98-4a95-84fe-bc0fa699ebe8", "comment": "Malware payload", "value": "46eff33631d54b096c27c8c7e0a04c9979d115ac", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383791, "uuid": "3c1d72df-7b8f-4b9b-9fbf-37ab146d8e24", "comment": "Malware payload", "value": "cd6835add6eef96a53a0fc4fc7a2331ec18737a6a0334e44504541d11f08531db684029dd1807e97fd6f41ad85c82856", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383791, "uuid": "622846d5-941d-4c97-a876-e1c522b827c5", "value": "T107F4C5486EF721559263B07D9F6FA0067234E40B2909DE487E1C97E05F8963887F6FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383791, "uuid": "e0e38c3b-22ad-4807-990d-5f1cfc9c30a9", "value": "12288:UEkjHaYhu/UwoxFBUvtpuL2BT1A9Uhsv6uIFTLCNAuKScl:IHaYhu/UNxFBwBT1Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383791, "uuid": "e6ca2ff0-a595-4327-a592-10ebbb91522b", "value": 747464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383791, "uuid": "294b1116-45a1-4831-95b3-544325cbcdac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383791, "uuid": "531b827b-1469-46df-8174-033544fbb1f5", "value": "q6AU_darwin.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac870465-27b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774377948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377948, "uuid": "96831b10-13b9-4b0c-a55f-315205881881", "comment": "Malware payload", "value": "a676758a682c22cc5fdd0006cbd9fd5b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377948, "uuid": "a9f11dd0-8aa1-4718-8002-c2097aa4803f", "comment": "Malware payload", "value": "53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377948, "uuid": "6e83ea60-e769-4f99-bf99-64868666cc81", "comment": "Malware payload", "value": "cb028bcb366129ba2109c201e9fdf444281d2fa4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377948, "uuid": "36e89d9d-a047-40dd-9a69-bde7fc1096f1", "comment": "Malware payload", "value": "f68e0c51a238f0218590d1e8cc38b115d47ff44996b3e2d010fdc1e922a60acc158da04f4b0d6a6ff9e22327f84832a4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774377948, "uuid": "06bb37d7-3f99-4133-84d5-b5c975d5df35", "value": "T1BDA6D056E7160C32C99EA23A14FB4B40FB31258ABEC367860824D67D7D733D4E7A52C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774377948, "uuid": "1a6fceeb-ff80-4bee-8e63-f4f906759758", "value": "98304:eQieEVulRnftBN3x6NMQDUpCnoy85HKmUDY2Yzr2aDysxizWQmd+:AeEELfnQ+pCnM5HKmU0Dzr2f8izWz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774377948, "uuid": "2e112d65-7b02-4391-8435-40ca4f74a2eb", "value": 10386330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774377948, "uuid": "206ea27a-1974-47bf-9575-96689d443ac2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774377948, "uuid": "5c4c020f-d4bd-4794-b027-d50fbf1d9cdd", "value": "Install.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8c2099-2767-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774346242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346242, "uuid": "2d905370-2eda-448e-91ba-144749ea2de7", "comment": "Malware payload (Mirai)", "value": "6c63623160fb2121697f404fa5ed9948", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346242, "uuid": "d36b3787-c82e-446e-8710-13d43e4e2aee", "comment": "Malware payload (Mirai)", "value": "54770cc6f92091ece1475548324fe4255f9c2b6002c4285fe34b7dc6f38575d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346242, "uuid": "1af34197-7782-48be-acd1-c0292041f9ba", "comment": "Malware payload (Mirai)", "value": "30d8cf1a32a88e76aec8fb1fa5fcaede2c621c7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346242, "uuid": "ab59c7ca-32b5-488f-831e-b2741ab3fc5d", "comment": "Malware payload (Mirai)", "value": "536dfe18ecb124ed803bb10615670dc9668d71c31a4a9908e1b38b696fb23d0692fb61f3d0c8b310861956abdd59d6d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346242, "uuid": "0dd467bd-e9ea-472d-b9e4-0f9a00b4e5a1", "value": "T129A3F816BBA10FF7D86BCD3786A8470539CC551A22E83B763974C528B64B14F8AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346242, "uuid": "92745cc4-db19-4a52-89d4-b9b9f3023e83", "value": "1536:PINRUcuspq3Q9yRHC71vHa+fSY48Q4PwMwtsZVyyByFYyEWpa:P3cuspeQMHCoZ8Q4P2sK+yEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774346242, "uuid": "057cd4ce-1f7c-4776-840d-8f0d2c186c50", "value": 101392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774346242, "uuid": "bd98e881-95b6-4e7a-8372-5d3680d07e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346242, "uuid": "fda91d8b-602e-4511-9349-584c5fe0229f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64bd732-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343175, "uuid": "de5cc9a4-e5fc-4621-8459-f43e9e5b8f33", "comment": "Malware payload (AgentTesla)", "value": "958d9b4299993dad215fa389db0a0808", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343175, "uuid": "2c061a17-4498-4697-b658-bf6745d5a6e4", "comment": "Malware payload (AgentTesla)", "value": "55321417acdb619425cdcc1b1efce657f8a570cf013897bfbafef3232270970c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343175, "uuid": "4154a211-e980-443e-a489-b4a1219a340b", "comment": "Malware payload (AgentTesla)", "value": "01fad1d4423e358737fed5246e115de74806eab2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343175, "uuid": "f497e3ab-abe1-4ef4-8d7a-73f97cabdc83", "comment": "Malware payload (AgentTesla)", "value": "43e2b156db052c11b2770a5371ec09ce3bbf24b2e8a55e3f8fd6876c6bd3e871808bc76f095296efcb76b6d96077e771", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343175, "uuid": "6563ed56-39dc-4546-bc68-5215d8c4ac36", "value": "T12E746B4653F9400CF5F34F49AB7A10604AB7BE9A1C39C46D16AD240D5AF3A18D8BA7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343175, "uuid": "6c059cae-9751-4654-8f70-f6f64a2b4750", "value": "6144:9bCArNyn8AOR0DCkEEY+chDgSPbJj3YU0g9TBkIO9QentUJzJSVZ4fMzP:9bCApyn8Aq0D1EEY7kSuU9CtOotU1JSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343175, "uuid": "32f790a3-3841-4fe8-82d2-cbeac69ec0c0", "value": 348932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343175, "uuid": "510db1fb-db10-4b47-bf39-2524266a2edb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343175, "uuid": "d6d6fdb8-68a7-423c-b569-1232da3e8f41", "value": "958d9b4299993dad215fa389db0a0808.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c226344b-276e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774349208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349208, "uuid": "90f9da05-ad9e-4b36-8218-0d6ae5dacea5", "comment": "Malware payload", "value": "44308e0632ef28ed0ef449bc537543cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349208, "uuid": "58f88d88-bdcf-447f-a0b2-e521e3236ff4", "comment": "Malware payload", "value": "5545062a887b83075d0dced66c75cc3beaf0268f68295f8a442565e2f5f8d3ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349208, "uuid": "cddb9226-dd2a-4bd5-bbdd-ef744ded22cf", "comment": "Malware payload", "value": "b93053a009d2f4e6e05809a8ee04cffebca5c80f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349208, "uuid": "e4b59d21-aeda-4ab1-8ca3-862c462c84a3", "comment": "Malware payload", "value": "f503a7f0052ba2b79796a0ca61a0eecd736495e5366629eb672116e0a8fb0637d29bd63f1fc0f6e6616da00b90504244", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349208, "uuid": "0d637b1e-5006-4d5a-a5d5-3dccbc60bfcf", "value": "T124669DA4E0A355A0C90708B485BFFA6F6B255E1D9620CCF3E7E4B954F9F3BC0570858A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349208, "uuid": "c53df64f-aff6-4a88-8856-5c3d55865233", "value": "f11716690dc3b1ac312b344caaf28102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349208, "uuid": "de95db19-ac14-41e1-983d-9e5dc03ad0ea", "value": "196608:DLKQ5UsLthxhmnVrf7V4hl4jhRUuiJJ9qOyggI:cf7ml4jhRUuiJJ9qjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774349208, "uuid": "b0ae1a23-4d2c-4ceb-aaac-3c55f4053cdd", "value": 6893256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774349208, "uuid": "c81ec883-5946-4370-bc53-8c2fd74d9a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349208, "uuid": "38de2b34-4ea2-4589-9da4-4707e5e69dd3", "value": "5545062a887b83075d0dced66c75cc3beaf0268f68295f8a442565e2f5f8d3ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e85bae6-272e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774321553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774321553, "uuid": "511b53da-7add-40d7-9ce3-314d1a48bab2", "comment": "Malware payload (Mirai)", "value": "140afb39fe69e25219f701fbb4d36246", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774321553, "uuid": "f2dea112-8afd-449c-9048-cfc2b353218d", "comment": "Malware payload (Mirai)", "value": "55f2f0f77550a9627c8bc18f81d5d996f9278d4f63a29fe5170376c125bad5d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774321553, "uuid": "faa6bd7d-c069-4594-b2fe-f12763259d6c", "comment": "Malware payload (Mirai)", "value": "0beba34399f21e6ffd6e36a003fb950a885c1a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774321553, "uuid": "cc088484-681e-4d0b-b1cc-39353a08d91a", "comment": "Malware payload (Mirai)", "value": "d1449fc157991e80a641588e119557b7eb5318036307bd6d34cc86c80bdbf507dbd4cd3f1ae909558cdd6154eb4cb9c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774321553, "uuid": "5639692c-4f76-4a7a-9d91-a1a1d04a0c33", "value": "T1BF539E7AC436ADA4C28946F461748A741B63E28881A72FFB9555C369D04BEFCF50E3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774321553, "uuid": "070db13e-b748-4156-ae1e-2aba7145ad0f", "value": "1536:ugSwtPHVFF/fktvfQneXK8oRU7nLt6CuKFz6Na0u:ufC/Ionea8lnt6wz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774321553, "uuid": "4a79f259-530a-4ca4-915f-7d7a19cae5cd", "value": 62908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774321553, "uuid": "889a3d06-b33e-4deb-98b3-537fc9df14d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774321553, "uuid": "020e224a-b232-4529-8c8d-1888ebe2f6d2", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad71883-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386427, "uuid": "d5011c1e-0f5d-4bb9-b964-579f996e6def", "comment": "Malware payload", "value": "b499d4d8dc0d4877195e0ded3bf6ebeb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386427, "uuid": "bf315973-4446-4b54-a02a-4b162b1b46e6", "comment": "Malware payload", "value": "56871f4074cbb9b887b3e46b818b6ccde7fc14b844f7f644c7a7187cd724ed09", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386427, "uuid": "47ebc7a6-505b-402b-842e-64530078a1bc", "comment": "Malware payload", "value": "7ca3bb16a424d83684f1c1bbd477ac86fcdd3566", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386427, "uuid": "b6546061-d349-4f6c-9653-0d70ec6ecdcc", "comment": "Malware payload", "value": "96828e0ca7277454e623d077917f1dbfcf6023409eca7a8fd67d830e46b39b68993b4d5407af20ccd2bbc411aa5f2bde", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386427, "uuid": "10de4813-a2d2-46df-addc-24642974e52e", "value": "T13617330A29BD16E3D3FA25B9F174216A88B1837DCD73FE07B69CC6619AD36413532306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386427, "uuid": "777f51da-5029-40ab-bfa9-1241a0ff2d7f", "value": "393216:P3xCUFNs3+W/SslHWTWE35wpZOWL3y5K3dnoMsBsLa:PcUFZW6sl2TWCncC5K3dGBsLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386427, "uuid": "d6779a4c-9dd0-49dc-b5b5-1b5123d693c0", "value": 18880576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386427, "uuid": "f1152e27-e4c3-48e9-97ef-6c32a5595d2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386427, "uuid": "0a98513b-4048-4af7-9a7a-28dc69964cc5", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86e87d3-2797-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774366828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366828, "uuid": "d88899ad-713a-4bae-9fc5-082ce7fafa1c", "comment": "Malware payload (Formbook)", "value": "e3723325b361e8c60b40f5086102d528", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366828, "uuid": "7776d222-9164-420f-8f90-ad086c752cf8", "comment": "Malware payload (Formbook)", "value": "56f79355d0986ff46295ac25d1880191961b339bfc3843f36f3f3b5fb1346ef2", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366828, "uuid": "8b04d7bc-0c1f-4a3c-bb1f-7566355f198a", "comment": "Malware payload (Formbook)", "value": "b87c0944af06fb45df15680f9c39c9d5bdcbfead", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366828, "uuid": "6aac4d92-00b6-46bd-bab3-1ebced9d2718", "comment": "Malware payload (Formbook)", "value": "c1cca6d78eb070aa8e544d73978f1bd96347349b54d2febcf49d41d1671ef700d21c4d8d86b3cbc5c902a81cdc4fad81", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366828, "uuid": "3bf1acdf-7a40-4462-b00d-e4cc5a307240", "value": "T1734533C6DBDEBCBEAE227A3219750494DAFBD7944DECC1F38C786862D84E965605C200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366828, "uuid": "b5957460-d400-4c6d-94c5-b3ba7b4ba259", "value": "24576:yEOMYg8BXe6nqIcMKY8SivNELw4wyeTSIxzFEoWK3cP08F:2MJ8de8q5kivNELf7eTSIxzFBcsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366828, "uuid": "ce26fc42-60ae-4f14-8537-a3a3471afa11", "value": 1221267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366828, "uuid": "7c48742a-8f73-44ad-a8d0-64d0879f681d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366828, "uuid": "9f9b4541-7ad6-49c6-a550-6fe2f44de15f", "value": "PO47849999940904.PDF.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fefa0f3-278a-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774361123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361123, "uuid": "3879cb96-6402-4a11-bab6-1ef23fdd63d9", "comment": "Malware payload (RedLineStealer)", "value": "c2548034394c074150a54ab7e72efb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361123, "uuid": "2dcd4c9e-e3ff-4b72-8e88-06545673c564", "comment": "Malware payload (RedLineStealer)", "value": "57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361123, "uuid": "59569535-9dfc-4bcc-bd5f-8067197ec061", "comment": "Malware payload (RedLineStealer)", "value": "55f455ba3751b633ac3db5cf653fae4857315d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361123, "uuid": "afce9f96-4e3d-4be5-8114-3085be54fb8c", "comment": "Malware payload (RedLineStealer)", "value": "e0d858b9acc8a1cf0928351edd5015f2d2aff6ebcb31c8e722c7c6c595ecb0a1bd08df376a230cceeb442db1dc5497ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361123, "uuid": "dc4ed3fa-30ad-4774-b762-b62cd7eab6fe", "value": "T1EA34DF82A3E6BE80CBDC55F550F14804B7B9F6A3014FDB8B14A860747B26374D6EE993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361123, "uuid": "8e355872-6caa-48e0-8743-78252dd45d53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361123, "uuid": "2cd02b62-2ab7-43e5-bff6-78850be1107f", "value": "6144:z8zS6vxU/6QKR0rPp6oOkSzkz1HbMAKKZqNP5EOp6K/fw4t+DuWfs:3OxLeGz2+Ys7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361123, "uuid": "7aeb4cb4-6443-47ad-8847-2c2ce48bba5a", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361123, "uuid": "9cd6609e-7a5b-44c9-bc9a-563b8752565f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361123, "uuid": "6286be6d-2f22-4172-9983-5aea4129ce0c", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdab1f2-2774-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351512, "uuid": "763a91f3-bbc0-44f1-9595-c3b099be7470", "comment": "Malware payload", "value": "001303fae7e0053615d842ca90da4666", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351512, "uuid": "904087b9-7ddd-4837-b6a1-b23750ecd14f", "comment": "Malware payload", "value": "5a0d393de439aebc236a87f3ff18c89c5634f8b7b9331c54986b113b75e8df7f", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351512, "uuid": "e4dee43f-bcfe-44a3-aebc-23eb26e286f4", "comment": "Malware payload", "value": "46fc58cd5f7693ae6bf4714c7b54305a4b05944b", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351512, "uuid": "8c50284d-4c54-4d09-8882-8dcb67cdad7c", "comment": "Malware payload", "value": "e1cacb6b087a755016804a80437cf1a20491a2c6d8eec9f007bdb08c031e926f9d58aa8e85c8988aefef643f74be3da9", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "77-42-75-119", "colour": "#5096DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InterLock", "colour": "#E8AEBE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351512, "uuid": "1b53b75c-ffb7-4ac9-af87-6ca40a39ad1c", "value": "T173755C73EA587793F90644B0E3F44E5ECE08A4B2624966D3CB847D9609BB4CB905F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351512, "uuid": "35635b5b-1a3b-4466-b126-e2d610efb8d2", "value": "f4e30bd7fbe0a622e6ae610b8694a57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351512, "uuid": "df1c456c-a91e-4c7d-8064-89f27ba43f4b", "value": "24576:1QVj5MHt/Ed4iQhp6bHsR9ad0+fOp6QOnjLzUefg/NDawZahun/s4FQrv3O3I:1UdMNcGiOAM6d0kOpcj/LS5q4FQrv+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351512, "uuid": "e20f6ec4-7975-4fbc-8000-791ef2d8fdb5", "value": 1611776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351512, "uuid": "c8812dfb-9d75-43d5-80a8-06e44a0341c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351512, "uuid": "c08240ff-cd8c-43d1-b65b-055531baeb04", "value": "5a0d393de439aebc236a87f3ff18c89c5634f8b7b9331c54986b113b75e8df7f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e8658e-2791-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774364059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364059, "uuid": "1bea5418-99f7-4e01-b3e5-716a4e4a6fe5", "comment": "Malware payload (ConnectWise)", "value": "1e3fdb6c81b0526e4f69b6bccec8a691", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364059, "uuid": "27486218-0dd9-4de2-9270-20668a4f1fe7", "comment": "Malware payload (ConnectWise)", "value": "5a137d3f1bad58031f4a19af91b5506d23c7ac1ff2436f4bf779c1ab9b6e7b67", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364059, "uuid": "394b5247-c2bc-4452-ada1-ce46330df9c1", "comment": "Malware payload (ConnectWise)", "value": "d9d12534c2ebff1be525afcdeee4b06b758f5ecb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364059, "uuid": "430966f4-bb9b-40e5-8990-cb94132a5607", "comment": "Malware payload (ConnectWise)", "value": "f221b2db7c6bb76ad7f9e1a3dd9a4e6ff20b106086d6a91855ebd68ffd9d4ede579ef02a210a1fc209e38969acebf6ab", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364059, "uuid": "c774ce59-baa1-40fd-814c-6412e39a4142", "value": "T134F633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364059, "uuid": "76363d3d-ee51-40a0-8ee5-8a42ecb8da54", "value": "393216:YOvTi7hha6203N11zOvTi7hha62rOvTi7hha62UOvTi7hha62:YOvj0371zOvjrOvjUOvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364059, "uuid": "ecb30ac3-b3ad-4dc7-9865-33eac43580ed", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364059, "uuid": "a917207e-84c5-4d3c-bfb5-b4049c72e258", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364059, "uuid": "a764debe-655a-4711-8943-9af7e20f6e80", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cbce7d-2750-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774336089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336089, "uuid": "d7c57a98-b144-4271-9d9c-74534bddfb48", "comment": "Malware payload", "value": "8e5f044d15b7ee84764db28a6f433a73", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336089, "uuid": "be32f952-8141-4255-ad27-928a72e882ab", "comment": "Malware payload", "value": "5a337763369c8a9d7c4c9cf705f2ffdfd1d86dcd48d1fa5e93d82b3ea449fadb", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336089, "uuid": "7a4ce343-172b-491c-8ee4-d0b3a0b6e0b1", "comment": "Malware payload", "value": "268842d0ed7d10d43f878da35a81ed8d3bbacc32", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336089, "uuid": "3c20d2ed-091c-46bb-a8bf-35990abb25c0", "comment": "Malware payload", "value": "854fe9735eecd6d736ec9b2039c20d3219695066cc472b3e08c00fd48b83a3486ba489c22d9ef61c5ce7ac6453e2a57b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336089, "uuid": "17cb0885-5061-47fa-b449-31daa3fef6c0", "value": "T151545DE467F02CF4F826113BF841912DF7E27C1A8B50D56B8366E55A2F235D128BAB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336089, "uuid": "b0634751-8b0b-40b8-b917-b4c427cc0f9c", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336089, "uuid": "c6e75219-5dce-426a-8dde-4280124d5564", "value": "6144:1BfaB/yttqQ0XWhGF9HIkHyUVdA31WJ6:7fwKttq5XWhGF9HIkH33I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774336089, "uuid": "354fe8cd-9903-4b73-956b-6a9edee87dc7", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774336089, "uuid": "1491dbc8-0376-41df-949e-aa3d7635b37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336089, "uuid": "35254f46-8e85-4cb4-8e79-958afc0c8df6", "value": "SearchHostService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a38acd-2774-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774351739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351739, "uuid": "d80ee743-2467-466e-8916-9e3b32d6ce0b", "comment": "Malware payload (ConnectWise)", "value": "25177ec8833210555fd6a9938111fa07", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351739, "uuid": "465e69cf-a01d-4ee4-95f4-1d8f7865f566", "comment": "Malware payload (ConnectWise)", "value": "5a499038069af6abe8212d2acb71655fe20b08d7a3150c438f00d81e9043c422", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351739, "uuid": "c3bf415b-f2fa-407f-a192-1aaab7fa2d91", "comment": "Malware payload (ConnectWise)", "value": "2d787ef6ebab7c38170eaf0f22659a80bfc7543d", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351739, "uuid": "047620d7-8d79-4d1e-8a15-9ea0ca52ea4a", "comment": "Malware payload (ConnectWise)", "value": "588b678826742beb3da5a2cb65cc3dbe1a85df0b5c9f8971c627a33c7f0f4e09f284e965b0c8b03d4a1f342c9347a045", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "partyglacierhip-top", "colour": "#DA99DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351739, "uuid": "ee42f794-26ef-4724-94db-8ba7f2ed99a6", "value": "T1C9D623116BF89678F0F22A35E87AA071A53B7D115E23D12E2324791E2C75EC0C9A3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351739, "uuid": "59f62e16-02d3-4fe0-a307-2308cb6adcfe", "value": "196608:rHxcp9ym3nltDUJVPHxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym3wHk:1GplpUGpGGp6GplGpRGpeGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351739, "uuid": "4cd8af16-e406-4fd8-a869-59ba9a269457", "value": 13447168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351739, "uuid": "74378ff8-28f3-49f2-9d42-9be83fdd38cf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351739, "uuid": "8b450922-41f0-4c48-9712-7cc6178008b6", "value": "5a499038069af6abe8212d2acb71655fe20b08d7a3150c438f00d81e9043c422.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac976d6-2794-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774365624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365624, "uuid": "e6c1b1c7-82b8-48d5-9bf4-871196a5a283", "comment": "Malware payload (Heodo)", "value": "3476a08b03a01ea3c686429068025ef5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365624, "uuid": "7d290df4-dde0-4a81-af3b-f758702e587a", "comment": "Malware payload (Heodo)", "value": "5a4eae20292dbcf6b7874bc5b7a77497da6d89438798daa40e84b29512decd84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365624, "uuid": "c179b839-8003-46c2-b2b5-f799f145b5a4", "comment": "Malware payload (Heodo)", "value": "83b3f50e70dfda73cf64c2ec48432fc2c1515999", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365624, "uuid": "1af33f2a-60db-4c54-a15b-98994b31bcc6", "comment": "Malware payload (Heodo)", "value": "5919f457af0b1d1860cae37a07ac28ce35a6b468dc2e6ecebc519cd08ab0f9530ddee51806b459fd8aa1213e9126a193", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365624, "uuid": "512647ea-8e41-47a2-b104-b12ac89a5aa8", "value": "T175434A337381D8B7EC818CF89D99B2A84877D13193074ED3AB712092DE63DEA563195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365624, "uuid": "13794d72-408d-4e04-ac0f-ed2027ef92fe", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365624, "uuid": "58f6b9cb-bcd0-49a9-890c-d7aa4f66e7a1", "value": "1536:XnW5GerYh6NDjmulgmeQGN3fzRZ+AvlDK1:CrYhEDau2lNPzRZ+AvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365624, "uuid": "1231de07-61cc-4f93-b51e-88f42b589358", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365624, "uuid": "3a48fb77-d391-4ca6-9026-ad4350a3795b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365624, "uuid": "ada12de8-c32c-440b-b758-4c109460700b", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fa36f9-277a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774354289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354289, "uuid": "2fd5c6f8-96bc-496b-bef7-3cd5d3da0a6b", "comment": "Malware payload (Vidar)", "value": "854a101060018b732bce2bdf8328f586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354289, "uuid": "ffabf375-6a49-4b7d-a519-6d50aa12d7c9", "comment": "Malware payload (Vidar)", "value": "5af8fc924d126eb552fb3abd9db5e132972f7cc30220e8af1cfd93061449905f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354289, "uuid": "693506a7-6b06-479f-b09b-641178a91b76", "comment": "Malware payload (Vidar)", "value": "dcfc8e83a4c9062ea1c8df4672e99884fa4072f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354289, "uuid": "13e1a514-8610-47cd-a3a5-2b2463a4f523", "comment": "Malware payload (Vidar)", "value": "860f67c93704c7758137d50ec552936a201b0861ba0b00137a8cf004bda2b36d45e024d54132bc3e524bd42fd04c449b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354289, "uuid": "5b7afdeb-f193-4201-b721-af11cd7cba07", "value": "T143A58D17BD9509FAD4AAA33288F221D17BB4B8080B3233D72E5066793F727E45D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354289, "uuid": "d1b63fe5-f2ac-40af-a68c-9a5237b3c7f0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354289, "uuid": "52b66ce0-c67b-4704-9c0d-a30daea5518b", "value": "24576:J9iHHLmsonTSeQaEU2RaH/kq8XI+raZqnRmbXW3OvFheletn92XBCgf:J8nisOQaEZRaMq84+GSRmbrCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774354289, "uuid": "2bf69fe1-9067-4d2d-9ab4-2c921926fa62", "value": 2243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774354289, "uuid": "0cdfdcaf-1c5a-4f98-b402-a44ad8407e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354289, "uuid": "2d624313-8e11-4b42-b300-00261f9e23d2", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6970afa1-2733-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774323719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323719, "uuid": "7605362f-b21f-47ee-8212-851ea535386d", "comment": "Malware payload (Mirai)", "value": "3b4ae61cf865d78966ccd24726d55d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323719, "uuid": "0ed3d21d-622f-44da-be31-4d8d57bf27ff", "comment": "Malware payload (Mirai)", "value": "5b41fd9e2a14a1ad94fbf26a57d14459bbb08e48adce67c71851561cfef7623b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323719, "uuid": "eba9ab5f-d570-46fe-a172-f248044a35a9", "comment": "Malware payload (Mirai)", "value": "cf4ddedaf6055fc8f4ce8a70453d0553866436b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323719, "uuid": "ea196fee-4d49-41dd-9d2f-66c1e999b534", "comment": "Malware payload (Mirai)", "value": "43cef41085e9a439192e8f9087bf0ac994867b1a2db06b2cc5d79eb39d34f8ff584593d4f163036b04ef285ff737d80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323719, "uuid": "80a2581b-001d-4b90-8b94-0569fcd7f1b6", "value": "T141242A55BD415F22C6D126BEFBBE81CE33232BFCE3DE7112DE045B11268A84A4E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323719, "uuid": "5d851a99-4e13-4957-b74a-7b7025d02c94", "value": "6144:mkHdg+u3Rg/ywIBlW57/+LZmpz47UZqm6JWw4kPi5Nkja0HelZm2vwhsmNw1jgqm:PURM9/fz4Aqm6JWw4kPqNkjaoelZm2v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774323719, "uuid": "7e9f913b-34b7-45fe-b7cb-5a414c9e67ec", "value": 224460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774323719, "uuid": "58d1bec0-2adf-4e70-bc1f-371e24af042b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323719, "uuid": "f86604fc-ddb4-4adb-99be-dc6630e32ee4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba70422a-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774343182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343182, "uuid": "b8a7d768-0b9e-4451-8ebc-a8fe84fdad6a", "comment": "Malware payload", "value": "2c66ac5ff533714b5d3d7d11a6cfe892", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343182, "uuid": "53792287-523b-4234-9fe6-67af5780851c", "comment": "Malware payload", "value": "5bcfb47b2303b4c798f0fab8fdd99fe7aab4b6eeacad399a5ab1f2ec6bc4b9e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343182, "uuid": "9ce39e27-7962-4a0f-8287-c1be153b600e", "comment": "Malware payload", "value": "0eb8596742f46166db99088a782533d8755d0315", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343182, "uuid": "5409afb1-9c01-463d-b8d2-dea719e21a92", "comment": "Malware payload", "value": "2e062b5382a7861db30ca44ddfd5b27359151a001ee747aa36743ce74b1db9bc653b92d9d8e80060ff691dcbc25e3d83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343182, "uuid": "c2f2357b-ddc8-4906-b870-c02fdba2d10e", "value": "T1B184480357FA4118F1F34F88AA7A50A04A77BE5A5D39C06C12A9144E0BF3E5899F5BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343182, "uuid": "469d61c4-db65-4985-b703-34d51a7f8832", "value": "6144:wWZDnwTt7trvGmHjznLGGq8ldnAmekwipR5Dw5ycJWB+pMHh5nAsQ78a5OojDczm:BDnwTtprvBDznLGl8PNGA3DqPpMHh1AF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343182, "uuid": "db625483-708c-4db0-8ad0-ccfdcdb78bf4", "value": 375796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343182, "uuid": "e2b8e4e1-31e4-4358-bd41-f01ab16fad76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343182, "uuid": "1c4524ac-3841-42c7-a9be-96afaacd903c", "value": "NEW POP PRODUCTION - REF.xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3151a0-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342918, "uuid": "b8cb2b80-daf6-4613-a9bc-37af5ca8f1f5", "comment": "Malware payload", "value": "d7f9f573551d758eaa17df1762acdb4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342918, "uuid": "d7b2e570-59ba-44a1-b5ef-c4e20bf67dfc", "comment": "Malware payload", "value": "5cdc9f65cdf2d5ff015154143abc43a65103447d27a78dd8bbcc11d9a6358d82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342918, "uuid": "b5712da3-7308-4aa8-b370-2db6b9b85c6e", "comment": "Malware payload", "value": "2b6f9826bc6864999ac4d252ed7eb21fbe1dc637", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342918, "uuid": "ee8c408a-3d1f-495f-91b3-bffecdb4a7e7", "comment": "Malware payload", "value": "f8777e2a2065e022834a5d3a12e470c81366e2d7d2584ed2d165d89b4902045e8d783f60a5a28c7fa57565d3667cbc29", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342918, "uuid": "8e15eb68-4bf1-4c4d-b8e8-695d8a49607a", "value": "T1EC645A0253FA451CF5F34B8CAE7A54614EB7BE5A5D78C06C12A8244E0AF3E149CA67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342918, "uuid": "c386d706-26bd-4cd8-872d-b34f6c032b64", "value": "6144:+/Iwhz6JjfVLsiuAUMh4Mtr4+GIvUCi4dtYjJnaEtGEJ7Nd9lFGbpOlqhgY:MIjfVJhx4CU+GT54d6jJaEkEHblc9cqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342918, "uuid": "9dd271f3-e866-4cff-817a-5ac3da8533ff", "value": 313800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342918, "uuid": "5faa48f9-82cd-4e5e-b7b9-c69e7ffef909", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342918, "uuid": "4d43b44e-dd5f-48b7-8acd-ab539fe840dd", "value": "d7f9f573551d758eaa17df1762acdb4a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8145ec5-27c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774385671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385671, "uuid": "44c4ca91-08bf-41e9-9e80-92e801c647aa", "comment": "Malware payload (Vidar)", "value": "b14a0e841306c203eba9cac6183f1399", "object_relation": "md5", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385671, "uuid": "3c2c3d1d-733f-4beb-bd1c-4a11bdc4e354", "comment": "Malware payload (Vidar)", "value": "5da94cce3384c3e59aafaf32d521e727b45612c54ee62728e974360586f39580", "object_relation": "sha256", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385671, "uuid": "1045777d-b983-4286-a652-d83d014f5fc1", "comment": "Malware payload (Vidar)", "value": "e1ed98601b6463165aa655bfdc6f6f6f8d4e4d3f", "object_relation": "sha1", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385671, "uuid": "de26d188-cdb0-42a3-8a00-31f2679f34c9", "comment": "Malware payload (Vidar)", "value": "44fc8e32019b101b5e405b939e1c1fa14b450b175cbff9402332a1969d224945d7cbfa25a1e3b0669b054874efc57230", "object_relation": "sha3-384", "Tag": [ { "name": "45-151-106-110", "colour": "#AAF5A6", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385671, "uuid": "7db7e31c-5dfa-451a-b37c-fed6b5b9c9e7", "value": "T1D7855A176CD244FBC06AA33688B23191BBB4F8180F3223D72EA07A792E767D45D35755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385671, "uuid": "a1fbb244-0554-4c2e-8d7e-db7c501e685c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385671, "uuid": "5c40a1af-393c-4eed-b676-4524f57345c1", "value": "24576:QxIq9O3HRisT1wwLDBBGnRu0jMNXnyivLa+7uBNFheletn92XbSP:QxVg3ZwwLinRu0jMZNv978C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385671, "uuid": "c41804d7-9b3a-4d69-977b-cf93b0c80a99", "value": 1855616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385671, "uuid": "ec60333d-c440-46ae-a97b-1b3e3b902ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385671, "uuid": "101db56c-be6e-431c-a145-868e13e7ff81", "value": "\ud835\udc7a\ud835\udc86\ud835\udc95\ud835\udc96\ud835\udc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98be1003-27a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774373620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373620, "uuid": "0db26ae5-dfac-4306-8920-264274c88cb9", "comment": "Malware payload", "value": "bfad1792a9a8e933b9be727ff8c2015e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373620, "uuid": "9532ae08-56b1-4314-8205-f264dd8137eb", "comment": "Malware payload", "value": "5dc07c2620b0b5382ec9e74f8ebaf9e7b9622af650c7904632aa07fd36c0a2b5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373620, "uuid": "cfd9240f-4f27-4886-b6ed-fc7ac537f0e1", "comment": "Malware payload", "value": "1c02a0d86bc3f38011fa7b93e61e942ce0917189", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373620, "uuid": "c9eaad36-16a8-443b-bd82-7f68d1ae0061", "comment": "Malware payload", "value": "6e85332388b493557ca71c65c72f3493a2d409259b3639953da931c5787d810802cdc533bb4bc90f8386c672bbc24268", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373620, "uuid": "d5ae5697-97af-4838-8bd2-859e2f7bcc59", "value": "T16AE401B5F68C84DCC60788756A578986530EBC145F6ADB1230DFB32EB473AAD93D3812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373620, "uuid": "003a6ab1-04b4-4cfc-ae5c-deb5e7d6f17f", "value": "12288:TS4+IypuLoIj3ipuLoIj3dSXRcBJfuRRuFQ:TS4+LusHusrSB8uFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774373620, "uuid": "1643a363-7fc9-4220-a765-5ad35cdbe390", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774373620, "uuid": "6c203526-6551-4e83-9dcf-30b095cecec0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373620, "uuid": "8b2491e4-39fa-4fa3-948b-0c65745d92d6", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.26069.6282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f4acd1-2767-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774345973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345973, "uuid": "e18c9669-2a0c-43f5-b319-f591e7065b51", "comment": "Malware payload (Mirai)", "value": "5652ece07d02d93cef2b99e7abe92335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345973, "uuid": "8e0617f4-87b2-4b48-b991-f9ddd836e1ad", "comment": "Malware payload (Mirai)", "value": "5dc7e84871af255a0706465eee841ddeb13819d9b1555b6976e3f96d2591521e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345973, "uuid": "3e9d679a-fca0-4061-8298-980fc0e29847", "comment": "Malware payload (Mirai)", "value": "015ecef8f77ad8c6a3d4261d27cfafe6472530b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345973, "uuid": "119cdc55-b636-469f-a5f0-3d8f9d2844ac", "comment": "Malware payload (Mirai)", "value": "4d8766aff90b4ef28fc7bd1abacd7520c633d19b23b1bba6187d57835bb0feb48e9ecad935e7fa218e95d3a953a28131", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345973, "uuid": "8925166f-0906-4037-9177-6cf53d0d498a", "value": "T1F7733A85BC819A13C5D1127BFF6E428D372A13E8E2DB7207CD295F64378B82B0E67255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345973, "uuid": "47b1192d-37b0-426e-a1ce-0c937c9d21d8", "value": "1536:6FCXCUosRbyoww9ZO8ywK5+7PxApQQk7MBz/OHqRsNUPyTvVyEWE:6FC8WbZR93jK5eJAuQkmJwhVyE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774345973, "uuid": "65b90719-211c-484a-a5e8-f19cd27a9dda", "value": 79164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774345973, "uuid": "2a71fb59-feba-423e-939e-f6cc319eef89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345973, "uuid": "0bd626a4-0e4a-4ce5-9d1c-cc2579fc1b73", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d726922e-27a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774372865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372865, "uuid": "ff0f0b9a-7d2e-4bca-b984-d66f0454ef80", "comment": "Malware payload (Mirai)", "value": "eee31b12107a77ec9f5eed0d7efa17d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372865, "uuid": "cb06903c-57ff-4ab3-aac0-128b3cbb312b", "comment": "Malware payload (Mirai)", "value": "5e3b9203246f0faec39c7ea93b46de66411dfae9acedf0a268daf2638b53a481", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372865, "uuid": "5f2ade90-7902-46e5-9e1b-a41637165be3", "comment": "Malware payload (Mirai)", "value": "ac45430aea95ed07ba17e733267abdef1d4fcdc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774372865, "uuid": "ac197156-43c1-4884-985f-b5719225b79a", "comment": "Malware payload (Mirai)", "value": "15c7331e1630c1aeb58f514aee09219d3e36329261e37f402a93e0694d4930b4490f45877ab9ddf9f36aacc03bdd710c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372865, "uuid": "2bd767b5-a46e-4f10-ace6-c2dea5799ef2", "value": "T17A42C007DA3BA09EC0A278F7614C035C19CC9BF4DE652914564A651787490EF093F84F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372865, "uuid": "d6b73665-e2fa-4243-9d2e-f99b3511d4e9", "value": "192:EczJ6NpLdASO2hjhA18Vo/SD0U0cEA/zwJRxEaoRB4b5AxH6AwgNkDYnBjrW8TLQ:V+LGSFhAZ/O0cEA/KEaoRC0ugOabHB+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774372865, "uuid": "c86693e7-b760-41e1-84c4-d0e792e5bfe1", "value": 12852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774372865, "uuid": "1992482e-6209-4230-98cd-9162075e9431", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774372865, "uuid": "65425e75-6699-4679-8e28-f08db9c31665", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d545174-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774343455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343455, "uuid": "77b8376d-d7a9-4457-b07c-9cec071c5e82", "comment": "Malware payload (Stealc)", "value": "05f5addcc409e0d8bd1ef0d464a75e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343455, "uuid": "d6e68cb0-0826-4958-8e14-13ca966685ad", "comment": "Malware payload (Stealc)", "value": "5e4360008d4cdd40ede1d19a565cf754598425d03c56cdfdeff248736600d014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343455, "uuid": "473e9084-f3cb-4ce6-b308-285ccfc1ebcf", "comment": "Malware payload (Stealc)", "value": "cd01fae386600b86d751212f0fb9185618ab09de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343455, "uuid": "111a658a-9191-4fe4-bac1-a4e4874fa0e5", "comment": "Malware payload (Stealc)", "value": "4a73e92568d03dff61de2465933519320d2cfba8f76216ae3f567d85bbf409473f286a3e1813e4847e57646de1a9baa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343455, "uuid": "c4583cb1-fd01-4a39-bfb4-d8d313468b68", "value": "T139A59E76B6C08035D45B31B13D1AAD7B659CE031832091CB62E89B7E5EB06F12B37E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343455, "uuid": "afc87d2a-ac7e-4229-b55e-7b7d83c34fc4", "value": "30b62189dd33bea0f552414113e8b2af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343455, "uuid": "91f96a90-d7d1-4d25-bbc0-a8a7ae176a80", "value": "49152:YPIaGigXBHvfD1f3Li9UVlerVWhNBGigXBHvfD1f3Li9UVlerVWhN:cIxD1jiaYQhCD1jiaYQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343455, "uuid": "87fca2d4-7497-4936-9df4-40af3de6d911", "value": 2243072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343455, "uuid": "81d72441-f631-4695-aa9d-0032ecde29ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343455, "uuid": "48179ac2-0f2d-49b3-8c2d-ef668c9eabce", "value": "x5e4360008d4cdd40ede1d19a565cf754598425d03c56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a94f497-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774367019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367019, "uuid": "eea5f0e3-699e-4c90-bac2-f490461583ac", "comment": "Malware payload (Mirai)", "value": "4bfac823433adb03db9f7bb50bfc810e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367019, "uuid": "c3b3c9f6-82f2-47f4-930e-1a968c04d1be", "comment": "Malware payload (Mirai)", "value": "5e979407fe8373ea13580dd77c1a93ac1b83db2866ca1d82a72f02bc49e208df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367019, "uuid": "22479657-c758-470b-b99a-9d61780d7ebd", "comment": "Malware payload (Mirai)", "value": "0c508d659571e2f1492019a3803f6db8d391cbcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367019, "uuid": "8be39ec7-89a5-4221-a96f-2402e2691c45", "comment": "Malware payload (Mirai)", "value": "6f8424799626baeb507d97e995a2624d3065e576763730b11a7d8813bc61dfc0c1527fd56404f64ded697c445b1c3e2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367019, "uuid": "5953076f-e3a1-43dd-8c18-dc7d5d6a451d", "value": "T19B431891B8819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367019, "uuid": "446258a4-b42e-445c-9948-723f3463c1a1", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9Tv:/M99jmL8BZp9IFUoWKdYuvQ5IIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367019, "uuid": "2ca9d096-e4fc-44dc-b666-ec30363ebfbd", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367019, "uuid": "0d15e3cd-b448-425e-9378-3b1df61cf008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367019, "uuid": "54519da6-40fc-4389-9dfa-038c9bebaf05", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2004a8-27ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Datzbro)", "timestamp": 1774376367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376367, "uuid": "1aaa3b84-6062-45fe-bf68-e4b86adb971f", "comment": "Malware payload (Datzbro)", "value": "eac0852553641dc8fdd42b8b2f2a9ef2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376367, "uuid": "befce81c-1d8d-49af-90ad-7d631f8d95f3", "comment": "Malware payload (Datzbro)", "value": "5f6d901c7626694b8e0e37e572a375488980cd240782d9a5e82f4c463a9b098a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376367, "uuid": "e35b8be1-8216-44d3-85d7-c3e03b9ce5e0", "comment": "Malware payload (Datzbro)", "value": "386e7d3623088f669f9d2d0a9fff5bb1ef33ca55", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376367, "uuid": "3f856a5e-6448-477a-8796-aa0837dca8b4", "comment": "Malware payload (Datzbro)", "value": "801e3e920c3d2def8a9344152850c4facb47fc43504d90a43e45aaa12c7336ea05b84208b33f52feab1cc48a3b0c5499", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Datzbro", "colour": "#5C16B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376367, "uuid": "61526560-699b-450d-8e91-f3b5e036b495", "value": "T1AB66F1C7FBD45A9EC4F313B2CE3652E695838C264743DE879920327C147B2E41E59ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376367, "uuid": "20ae25c2-361d-454d-b42d-a8b9e17c2287", "value": "196608:K1LwFsy8Z7MpXLbB/WXMYRd4AW55ebAKcXvfKeYq:ULw2ys43B6MhA+ebrcXvfTYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376367, "uuid": "878efebe-3d81-4179-a6dd-14dc597a12df", "value": 6501247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376367, "uuid": "7f90636a-f151-4c9e-84b6-80c3faa4b3d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376367, "uuid": "c5f33543-2fa2-4e46-b6a7-97fee29a82d8", "value": "smfkp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5b29ab-2798-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774367260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367260, "uuid": "8cafea2f-41c6-4891-be7b-7b8a4c65f9c4", "comment": "Malware payload", "value": "4880ea8dd9d44f46e020d82f541e95b0", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367260, "uuid": "2d4783a3-fb82-488b-a073-b375c75eb27f", "comment": "Malware payload", "value": "5fd5a9c6ed1513046b92c41a192dae3cf314550e6af6a6daffd4ed2dd5998887", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367260, "uuid": "c950a950-3fa6-4359-940c-341781d57c32", "comment": "Malware payload", "value": "f90f5a0057c2ff5d3a9e49cb8739d6d36caba6f6", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367260, "uuid": "1f4405b6-1757-4348-9206-5e8e8cc8f16b", "comment": "Malware payload", "value": "ae8ce9865433b8972fcd378028d6b310d91dc01715637b76af0759b5b944cdca2c28827fc35b236c5e1f8a6d4afdcb1b", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367260, "uuid": "63401972-55b7-4055-98d9-f39b2ba576c7", "value": "T194963D03BECC6E48E3FF676620316FA59F3BB8334996D5ED0556044924B4B70E980EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367260, "uuid": "ee782c75-c2e9-4651-b53c-b55c57d132f7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367260, "uuid": "4e209acd-a484-4138-a6b7-cbdbadb63bde", "value": "196608:luunFbR4cvuSPG6aA8SJf0LfnM5RltCrbbP5pFF:f50LfnM5RltCtpFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367260, "uuid": "09ba08ea-3666-4529-8281-b061ff84d004", "value": 8714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367260, "uuid": "c6a5e42f-1d26-4aac-ad72-3d9c0c28bf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367260, "uuid": "63e3c883-ab19-4e46-ad00-c1873f9b269d", "value": "5fd5a9c6ed151304.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f916bd-2757-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1774339393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339393, "uuid": "35f6d48d-af6b-495a-a562-0bc03e3b34a2", "comment": "Malware payload (ChromElevator)", "value": "1be8f44bcb3f0b2b687672b2fd46150e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339393, "uuid": "4db3357d-2c5f-4f70-bb40-7b863b5325d9", "comment": "Malware payload (ChromElevator)", "value": "61e1ecb154bc8d21908940d2005de2f2bc3c106043ce85aa179c6da6ea8c0056", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339393, "uuid": "135b1321-5008-404a-8e6b-1d7ccc42dee4", "comment": "Malware payload (ChromElevator)", "value": "9bffd29de8d7a4e94ef24d263cde88c6e1d5f374", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774339393, "uuid": "ec82a36b-0b7f-407b-bcf5-7dc2aa3588a8", "comment": "Malware payload (ChromElevator)", "value": "409a061800a7ec66ef900c2ce87ec42d2ac34da428edda71a8c07417b42d9c386ca4c348233e550fd1fe55ffcd945fa6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339393, "uuid": "37bc6571-208b-4e64-8c41-d70f880b5239", "value": "T1FC52FF792DB317A7B4D342D85FCBA138D0B894BF176EE69A19C43519C9D230F29A3803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339393, "uuid": "113050ff-7b4c-45ec-8fce-cc64192d6b6c", "value": "96:YZj66BKBE0M9v6fbB9knM2nDhMc5BpKKd9FTl7B4UYBM8Av0cKSkR66MajdfGTUY:YMLC5BuKRl5qsJsYaspd5z5B6sFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774339393, "uuid": "daaa7e13-d0b5-4186-a2d9-681a17d244b2", "value": 13421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774339393, "uuid": "75e01ce1-63f1-42f2-8682-b26a1f150409", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774339393, "uuid": "e40c2b41-7e9c-4765-b8d2-a820f75b2c93", "value": "1be8f44bcb3f0b2b687672b2fd46150e.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d3da73-27b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1774377935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377935, "uuid": "8234f384-d6f5-42c7-badf-22e8f30aa1b7", "comment": "Malware payload (Metasploit)", "value": "f3c501f46b5a29378c7cfa2a46047de9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377935, "uuid": "df2ea098-863c-48ff-983c-ac74603ae8ee", "comment": "Malware payload (Metasploit)", "value": "61f6ab5b07b1bef78e25da133d0a6df09a54f34d15c2b1dc2fdb6306ce567fce", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377935, "uuid": "e71be564-382a-4fea-bf9d-6df6b2236679", "comment": "Malware payload (Metasploit)", "value": "e83c36afafdfb7338546676885a37bc2ac7363b3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774377935, "uuid": "a1e0c55a-256b-436e-af44-4fee56fc4118", "comment": "Malware payload (Metasploit)", "value": "602876842e3eb3119d0f601ef04c07b6f57d6eaa62acc85471c5389da135477e4a1da35ad7f8d12734d23c8e11217823", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774377935, "uuid": "25d84e36-a250-44ca-9f17-eb2361c569c3", "value": "T1C8229C3296B445B6C387C876872B3285692D741113EABB4FAE1C9CD7AD70446ADC6E30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774377935, "uuid": "e3326b5f-9f7d-4b14-9165-3185e8a907d1", "value": "192:eLt7+5NELVNzmA+I3wZ4zMCzDboVtM5u/otx5mvB0ROLNln1Mn:eLtvLLJi4nnbUtX/otxU0IHnin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774377935, "uuid": "9ae552fa-08ef-4e3d-bb3a-d1f62bfdae20", "value": 10236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774377935, "uuid": "87990411-58c6-4ecf-9bab-6a5dcfc734a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774377935, "uuid": "92c0c3a6-633d-46ae-ade0-a416fe7ee2e9", "value": "game.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ce7eaf-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774343463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "cbee2fbc-9d89-4ce6-80de-6e2519de5fa0", "comment": "Malware payload (Stealc)", "value": "737575403e3c814c20f318bc359b5450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "2e24611b-ccb1-4eef-85d7-aaa1a4b075d5", "comment": "Malware payload (Stealc)", "value": "621e48effd3bea252f5a21019527a7babfdd475b8ae9923ad7bacdbc89f9f34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "7f7c5ef5-34e3-4253-ba7e-87bbb3f5d3de", "comment": "Malware payload (Stealc)", "value": "f2b131d5c0997a1b0228a1fce71fd17913563a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343463, "uuid": "36bb4439-996e-428b-8042-164880e245f4", "comment": "Malware payload (Stealc)", "value": "1c27429dbf5f59dc682608e50aaca325734b05b15355a25ce32f75b68ce6e45344e35dfc37883d8ba3ba9a6261c1c388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "fa5962a5-c6ab-4c3a-af09-edd5cf46882c", "value": "T1EFB45B21B3D59868E57602341F75E1E0EB3779676A18D86D358C230E1FB26924B33B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "774637d2-5642-48f3-95cf-2f2d08491e92", "value": "5aefb555da349593a2c4f6f3ef54f8a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "cdeb4de1-8708-417f-ac19-f44debbca340", "value": "6144:xqV6dTLbrTsnTw49MMcnbuD5oHX2cDzT4jp48WNTx:xqV6dTfrTsTn9Lla99x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343463, "uuid": "48f46dd1-e815-4a2d-8b3b-d6a1afea87db", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343463, "uuid": "78be16bc-3b30-4fc2-a411-e8ebed5674be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343463, "uuid": "d1c20af4-b186-4410-8b5d-ae7410f62395", "value": "x621e48effd3bea252f5a21019527a7babfdd475b8ae9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380fceda-2798-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774367015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "0508be6c-0e3f-455c-bf6e-de364ced0489", "comment": "Malware payload", "value": "e829539f2e4a1132d1c9f4ab38453fbc", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "39a1ca4a-efc7-4293-a411-74689494d73f", "comment": "Malware payload", "value": "639860deaa4b16634d03876e275b7d933cd0143de3ab22f48fbf8eedd451b796", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "c3f6f0b1-0415-4988-8dcb-ae9e32155fb8", "comment": "Malware payload", "value": "772f7fec5407043e0a52701d727cbdb8446bb76c", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "d33b438e-9310-44b8-bedd-7c90cea66343", "comment": "Malware payload", "value": "dd0ccadc4e797001230a0dd712543fa1701c687edffefc186106d5ae8b61bbb521a5a2e6553cb9275adda33e1d53bac5", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "2f3e4c16-c1a5-4e8a-b1c3-2b12ab082190", "value": "T16AB5B71026B0EAADCC68073478250356B7FF968F4778D36E56A0171D4EABB0B9B13763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "cfc2f5cf-3d67-433e-851c-22d863470af8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "5f86f33a-97cf-475e-898b-4c3888e32b83", "value": "24576:dIbZC5EazShs+tqfK/wZ/dEl6TRJpp6Tr0NuHo4o9M5qtyxGX+JaZX442:6Ir/dTJppiYuo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367015, "uuid": "6a78be29-c41c-47ef-b435-da088152fe30", "value": 2441216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367015, "uuid": "841720b5-9975-4983-b3bc-e1307c0a7ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "d1bcd23e-4054-45d0-9f20-774e97d50e75", "value": "639860deaa4b1663.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cbc92f-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774342884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342884, "uuid": "71f67ddc-cdea-4eb5-bcaa-f0a6963647b8", "comment": "Malware payload (Formbook)", "value": "f6fd57968396e8628e24cbc14bcf3b53", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342884, "uuid": "6cd89113-ce5b-41e2-94f0-75d7364f3f1d", "comment": "Malware payload (Formbook)", "value": "65205e741e0cc2e843bffc6f31b80aa32a928c5898c4f78f8d6b60898bbc2217", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342884, "uuid": "f4181dda-d4f5-49c3-852d-1015d78c14f1", "comment": "Malware payload (Formbook)", "value": "417afd7ced7d897f245c0f677139418d3a675310", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342884, "uuid": "1a76124a-c3b5-4544-952f-15a758697d15", "comment": "Malware payload (Formbook)", "value": "b5e527fa56496fe569a818d36b99869e665ef0e3bdd382d32770480cd5150cadc2bbfab6cad5494935caeed43f2d3846", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342884, "uuid": "0434b2fe-6a38-47e1-ade3-5aded5b7579e", "value": "T1F3A5BF121B843F728EE65F1AE5D8998FC2F2D183A445A8A6E7513F007EFFA01535F468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342884, "uuid": "f8a57de8-9d47-4fd8-8f14-1677b7ae5778", "value": "24576:WmPPiOE5Op97uwyXXksM+NFd1PWMjAggKCu5btWROFovxn+44o5rSHL1Sr+sTFAh:53ihkHaJbKr6s1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342884, "uuid": "1780a52f-5bdf-4a75-840e-f664b94956a0", "value": 2070740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342884, "uuid": "c6eac066-0230-4d4d-b372-58573ca11df6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342884, "uuid": "6eb408c5-62cf-4a5d-acf9-c9e1a6302fc6", "value": "f6fd57968396e8628e24cbc14bcf3b53.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95f60d9-275f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342858, "uuid": "0b522a26-f540-4505-81bf-a95e26dac170", "comment": "Malware payload", "value": "a0a218f5922e99ac143400cb64177f76", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342858, "uuid": "0261f84a-c1b6-4c55-bbb0-2a96aaafa96e", "comment": "Malware payload", "value": "65e5a88c0a2d5d043b7a43e34575b855eae637210e06417d98d740a4f1294b73", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342858, "uuid": "acfc6744-c495-45d1-9274-1e49c54509e2", "comment": "Malware payload", "value": "c0efabd453752375f9ee9b638bef9a3b59a15d96", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342858, "uuid": "eea4ab8b-27b1-4d43-93c2-87d3ddf66049", "comment": "Malware payload", "value": "7f4b145b4ecfffe0bdfe94b405de493e6b9c8e1edbdd45197f56b2571629a0befc0d27f65685e995335df13ae3eac48a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342858, "uuid": "97401360-d636-4df5-adda-d2d76f667161", "value": "T1D6A2C3854035A87E7E2472A71D79952EEC848EC60C3ED8FD51CCFA7E81EC032E96146E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342858, "uuid": "db108df8-be90-4a2e-b8b9-dd71d37ab19d", "value": "384:2agEmpZOvYZwx+HIl5mXzmYuVD0+5whTrC3p+hChF4:2nEmp8AckK5mX7u575whTrC3UYhF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342858, "uuid": "cec3cad4-7809-489a-a51d-69473ef1c124", "value": 21874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342858, "uuid": "32d2fa7e-9eb0-46f3-81e4-dd6f01802bec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342858, "uuid": "5655ea8c-1150-45a6-9cc2-a504be2f7d87", "value": "a0a218f5922e99ac143400cb64177f76.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ceedcb-278f-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774363308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363308, "uuid": "f48532e1-2eda-4816-8643-7159e0871072", "comment": "Malware payload (Heodo)", "value": "1c2007eac249e26b57d24039f3827022", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363308, "uuid": "b28541a6-e7f7-4042-afbe-3fae8b69ce36", "comment": "Malware payload (Heodo)", "value": "689f36634c8bdef24108072891de18dc6382bd8954e78ce64b01755d8cea19c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363308, "uuid": "197e19fc-2ae1-4530-88d4-95eca3890e1c", "comment": "Malware payload (Heodo)", "value": "4dcee3ec8a945c8516f35ee72df0c65f788839a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363308, "uuid": "a170c1df-719c-4974-bfc2-9595ec30513d", "comment": "Malware payload (Heodo)", "value": "1e41d1d5f2bf68e1de213f0d00367e9cdbe9bf573071db058b42fecb567760cb6a52183ca0cbab73b5cf30aee04e8a6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363308, "uuid": "3028fb5c-2e4c-4d47-b911-8c15a0b744fb", "value": "T1537460826E70C6B3EBE515B158A657B709B78C207F0232D78EE6378AD5329C47C3442B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363308, "uuid": "6000cfba-bc98-4be0-a2c7-dc622afd5fae", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363308, "uuid": "d4ea86d0-4d01-4f4b-b099-24f2838f7e0d", "value": "768:0Lo2dWDfxc+mdMv/I/cYKlr9f3qrJQRSX+QnVb9rR8y6kBL+6sNiZVNUN9g7TRHs:SnWtNIgN3qrEQvriJi+LN2NcG9GHMM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774363308, "uuid": "59bb7b8e-180b-40c8-a093-29cd4e74fce0", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774363308, "uuid": "e0735e9a-143c-4371-be80-e0ffb6af5642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363308, "uuid": "aaed8d33-246e-497f-a1c8-b6169f5bea54", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8c9cc4-2797-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774366858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366858, "uuid": "25f1ee91-08dd-4bec-97b3-2f84dab845fc", "comment": "Malware payload (Formbook)", "value": "f579f2a48df58a7388d74344b5bf0a9d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366858, "uuid": "9f73a831-9158-46f5-ac74-5212a47d81a5", "comment": "Malware payload (Formbook)", "value": "69fca98c1541f3953c9d14d56ad949dfc5953f01ca7222a157d1057abf44e184", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366858, "uuid": "b45951af-5897-4dff-b207-74fcbb307752", "comment": "Malware payload (Formbook)", "value": "10022b30283567eb1123ddad84438ef2f57cf3ca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366858, "uuid": "a79b6ff5-8da3-4b09-b78d-70cd8f3f72ba", "comment": "Malware payload (Formbook)", "value": "91312c32a4e39ceeb4bacf4f2e29cb2291bd0d3ce19469ade8b0a6bf55f34097a263da05ecee663671f2ce5dc684e1aa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366858, "uuid": "3ea43554-5067-4119-a3d7-65e698c99692", "value": "T1C855339A64CC0CA7F262DDBBF302A0D03A77A8F536F21576A7F8920A6445347671F643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366858, "uuid": "f7f0a18e-b136-4c91-b8ec-d1e5313523e2", "value": "24576:MabTdoPwZiHnYRHgdNoeOhW0AxMYsrLXNx063v7ymjR0KqYakyYRBTYOy:zTuPNHtWIxMJ063v2uR0SaWBxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366858, "uuid": "fb0b5a7b-24b6-4637-97f9-3eefeb64f1ca", "value": 1331742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366858, "uuid": "5e0ca78b-e124-4b97-8421-ed7d0a5a3447", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366858, "uuid": "06f12410-9dcc-4807-9bce-9fc6a845d3c2", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93ae35b-27c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774387042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774387042, "uuid": "27935b69-a627-45ca-81d7-43b278fd6314", "comment": "Malware payload (Smoke Loader)", "value": "39ca7c37ad8e822c21d478e065255756", "object_relation": "md5", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774387042, "uuid": "3f6f8fab-4598-4de2-9173-182f3a5690a7", "comment": "Malware payload (Smoke Loader)", "value": "6a0fefc0d62ba3d71f9fb1872117f1756da126291c811c12e6e645b33b79386c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774387042, "uuid": "531d90d9-19bd-4b92-94ff-df852af304ef", "comment": "Malware payload (Smoke Loader)", "value": "47b9e5b1b854547c76b127253f2fbd08d75f0b63", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774387042, "uuid": "008343ff-6613-4f96-9f22-0c2d4c5510ba", "comment": "Malware payload (Smoke Loader)", "value": "04f7be41775af3ea8aa304546e673aa38bada4795a62f8c9a69d6f36c4742ba814b946b01bbda14a4165be3970c7744e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774387042, "uuid": "cde0d730-8503-4ac4-b387-76b55f1b099f", "value": "T189C633629AE44122F0B3EB71A9F31641E931BD563D31C94F1186B24E0B76FC1ADA472F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774387042, "uuid": "c2f3ac07-5027-4cf9-aaf6-9359690e68e5", "value": "196608:OwwPTWxGU5UKZQAM56ruEzvKKez/th9IFX/Io6e4MCqm:nwSxG2teAg6rIhhqRx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774387042, "uuid": "e7bf40bc-ea03-4637-b8f7-f26dced0e185", "value": 12306432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774387042, "uuid": "c2e71e15-2ca4-486a-a2e4-93839003a04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774387042, "uuid": "18582906-98c8-4dbe-8082-165c149288b4", "value": "O2bJvMV1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b4839b-274d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774335087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335087, "uuid": "3c53bd0f-ea49-4a30-85ae-7d248e5faf8e", "comment": "Malware payload", "value": "c83c5d72716c2a56ebbca2a5e464618f", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335087, "uuid": "b946ec69-e1b2-4e46-9058-fc07061c4583", "comment": "Malware payload", "value": "6a3b154d28e3f53d09a73e3919c9bd23aa04e141a118233f2c26fd3f18a2eae6", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335087, "uuid": "5c6365a7-3e7e-410f-92ee-b6db4991f712", "comment": "Malware payload", "value": "5ddb32aad03db235adeec68a0db5caa0b1bafdf4", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335087, "uuid": "7b4a9b5a-05ff-4c29-a0ea-16ebc7f2e7b7", "comment": "Malware payload", "value": "3577b5f0cf350152a5a4f837890826e5ccc68b4c7a6652f2a6da1a18c6fb4c09cd67d20e3b4fffca287dd60718c15797", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335087, "uuid": "7b04bec7-22f2-4a6d-9900-98da83f60cb9", "value": "T1BBE4AFB65355AC9F0A1C0E75F4080B4B1D6848D7E6B8D2F87A82B4F887761A40EFDDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335087, "uuid": "365bbd98-e04b-4089-9d76-f8a6c7f0dd9d", "value": "12288:AId0KtLQuaOQZazsdd/jcPhAz7wTiv+o9KHZbmmnBiMg4DkfT3qlWkJVV:AlKBEZcsd9YPNev+oc8mBiMg/fTalWMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335087, "uuid": "29c41f26-7d31-4567-a960-a63ed9cd3f71", "value": 706700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335087, "uuid": "8870eadc-ffb8-4ca3-aab7-a25d8b7a9c18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335087, "uuid": "c20fde82-b57a-4ee3-89c3-8fa0a1b8bfdd", "value": "6a3b154d28e3f53d09a73e3919c9bd23aa04e141a118233f2c26fd3f18a2eae6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b0bf11-2737-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774325264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325264, "uuid": "e5ab1578-d5c5-4fe3-af11-9c1f7669ac5c", "comment": "Malware payload (Mirai)", "value": "efed1b1db68ae64db42af6067723cbb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325264, "uuid": "db5cad50-87f3-4ace-a1fc-584b8d360a39", "comment": "Malware payload (Mirai)", "value": "6b20ceec5cacfc49cd64def8ba0135499cfcb6e7fd85637da4ac8745b8025bcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325264, "uuid": "aeae02d9-6267-496a-b630-0524879c2d42", "comment": "Malware payload (Mirai)", "value": "620fcef8698d404844d463591da0f6218b635f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325264, "uuid": "1f5f39b2-2c96-4b71-a25d-7d126815f67e", "comment": "Malware payload (Mirai)", "value": "012809f4e7f74abea1176d3777e8c4588161adaeb8dea8df7142a90a12c867c6b66036c41fc0c22e005aa99dc18d1fe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325264, "uuid": "8c25759f-c7ae-45bd-b9fe-bbdb169de04e", "value": "T1EEF34A13B89484FDC496C2784FEEA626DA65F84CA134B12F2B957F263D9CF209B1D701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325264, "uuid": "2a46af4e-2620-4ed7-89e3-48da9af5aaaa", "value": "3072:/HqKYheu8YKU3dp2kT59n+WcT9HoX822wta969UHyqUc:awajx59n+WcmBE9zSqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774325264, "uuid": "c3f1081f-55b0-469e-9f7e-e490ed7c8ba1", "value": 159808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774325264, "uuid": "9e7e6898-61bf-4524-9e5f-fb43ed6bb464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325264, "uuid": "0b014a89-0ca7-4538-85de-c69fe5120102", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db7341b-2785-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774358891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358891, "uuid": "2535ada9-8369-409a-b257-77b889cbfd32", "comment": "Malware payload (AgentTesla)", "value": "dfc08700359cd01cc395882a1e4faa64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358891, "uuid": "3b3b9b90-1763-4a5d-9bdf-d7bc3721967c", "comment": "Malware payload (AgentTesla)", "value": "6ba3fff142538a8678a347c98683df8b26f6f5355844837d03f40aeb8f05bb21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358891, "uuid": "70252da4-87f4-4019-9346-dc6f23a6556f", "comment": "Malware payload (AgentTesla)", "value": "0f7785d2b695e07f9165ba9aac9447cc191b3185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358891, "uuid": "e7998c63-1bb3-484c-a25a-2c6f2c4b54ab", "comment": "Malware payload (AgentTesla)", "value": "a431373881679b626c43ecc79628ef2fa7825f21d67ab5f3f80923dd15762547a77d9dca1fb43a96b1f89eb20982ed59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358891, "uuid": "04bf953c-eb47-450f-b0d7-1301bee7f9d2", "value": "T15865AE31FFB13B4D4ECF1423B1F0B2CB776476F1D56F58AEBAFA14099A1A104A960894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358891, "uuid": "5a230aa5-e666-4012-87d6-7a9147625165", "value": "24576:Kw0Lw1um4bXaSSOQ9Nes9IpxkzYAAx52Pbyj4k0Bgrsu/LzB8++/VFPi/ccuT:YS3WjxYHezg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358891, "uuid": "b3dd7cae-4e9a-4d36-9f2a-aa705a21c5fd", "value": 1490252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358891, "uuid": "0d5294a8-6f66-44b8-bb93-efa03b5bd7f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358891, "uuid": "5c78ab42-87c0-4821-8170-ae6c7470f21e", "value": "dfc08700359cd01cc395882a1e4faa64.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b59644f-274e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774335157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335157, "uuid": "8a155c73-15a2-40b3-ba72-41b66f3451f2", "comment": "Malware payload", "value": "ae25a1071964270faeff9198dd503ab1", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335157, "uuid": "69cbca15-ce6b-4c02-a9fe-84c870c91ce0", "comment": "Malware payload", "value": "6c70febafc3b9f585d816fadd33baa0c54303156f3b985bf7187f01509c1fa4a", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335157, "uuid": "1f59466b-b06b-4375-893f-97b8a181d94b", "comment": "Malware payload", "value": "409f350567178574fb895b056d6906013b387380", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335157, "uuid": "667bf7f2-0fbc-4a4c-9982-6d9caa3ad3c8", "comment": "Malware payload", "value": "faab778ecf11a04d7386a14c036cb4b01a8e724afe04127ed20c3421cb25ddf7174d86ff84b67cb84e9c7b3c64d294a3", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335157, "uuid": "a6bb47af-dc8d-472b-a14f-cb3bf38a9a75", "value": "T11123E8B889C91CC54696E0285C9F8C3CDC814D1BD90DF627F9CD64E2CF227A52BA679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335157, "uuid": "36d61b9c-b09b-4e75-a885-7ffd72a5caa0", "value": "192:Zc4ve186G3e1Yc4ygybgMvF5vTg8e1/e1Svc46tA00Q0e1Be1tc4qc4Ve1q:e4mf94ZX2+TWR4h00Qrgi4H4kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335157, "uuid": "84c1885e-74fe-4e56-8bf7-a99b4e7c925e", "value": 49503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335157, "uuid": "a129dcb0-6e54-424b-a3bc-54c5aff96c07", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335157, "uuid": "d324afa5-fa26-4d1f-8147-93acf118eecb", "value": "6c70febafc3b9f585d816fadd33baa0c54303156f3b985bf7187f01509c1fa4a.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711c731e-2773-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351219, "uuid": "31fb6ec8-2a7f-41b0-8dc6-2a017cbcd54c", "comment": "Malware payload", "value": "12d399e6966db58f6d189d606ac34cc8", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351219, "uuid": "e7d10f5e-05a5-48c4-89b1-410c96d96fd4", "comment": "Malware payload", "value": "6c8efbcef3af80a574cb2aa2224c145bb2e37c2f3d3f091571708288ceb22d5f", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351219, "uuid": "1dc4291d-6ac0-459f-9b5b-bc2fd6003f31", "comment": "Malware payload", "value": "17986b6595fe960fe8e9757d3069d5daabd628ef", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351219, "uuid": "b8f6e5c5-4b67-4650-9dd3-d3545457d90f", "comment": "Malware payload", "value": "7a8f2c1c991179cda5d4d75336d71905fd6bde56b3a861cdbafe5ae5a0a170926be93594d36668b9139b5a3637c692ca", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351219, "uuid": "c679289d-9d7c-409e-8fd8-28db37be3c09", "value": "T197B2391EF32258DDC396C078D1DB5771E1B5BC1241A6AB2A271CE138AF26DE6DE3E101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351219, "uuid": "d7442133-a899-498a-b21a-2579de1d75ef", "value": "18cec207a2d1c3b05a51f3fd5ba0a1e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351219, "uuid": "8581eb2f-2820-4d41-bf8f-f4ae830163b5", "value": "384:5J/++vXbOLh+S8DkuOa2+QGw/ECJYMEKTH07YjG3CW:5EO8+SKkuOpjEC2MLTUnSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351219, "uuid": "2dfe05b6-f065-452d-987c-780ce8da7191", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351219, "uuid": "59aca646-83ba-4e70-8fb7-ed7896f92910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351219, "uuid": "e5b4f6d5-d1c1-4aec-965e-432c092cd117", "value": "6c8efbcef3af80a574cb2aa2224c145bb2e37c2f3d3f091571708288ceb22d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea48adff-27c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774384494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384494, "uuid": "78e72d43-b6d1-4666-949c-32335d9fea19", "comment": "Malware payload", "value": "22b937bdefa197a4c88ceb11ca828b16", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384494, "uuid": "800974b7-70c5-4288-ac01-ebc9c5a3daea", "comment": "Malware payload", "value": "6ccbe0765ecb9f4cfffc6cd7176ecb989cd7b4b371e4924563f708d44d935869", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384494, "uuid": "3b505456-a6f1-45d1-8fbf-3f937b61374e", "comment": "Malware payload", "value": "d310436ac45e187407426914e07a066e62444ac9", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384494, "uuid": "a35155b8-50a8-41df-8c6c-822f94e99192", "comment": "Malware payload", "value": "70df25c6ba134fa38cd90440cedbc0264270f0f2f36c115cfaa436ea0e76b7904362f883dee433cb2e02598ddc268f4d", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384494, "uuid": "d50cf044-9e72-4352-9559-8f159712e509", "value": "T11F14918D59F322114563B2B99B6FA40E2235E103690ECE147F6C93916F8C63C96F6FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384494, "uuid": "6e725ab9-e3f6-479a-bda9-ab5394b9db2a", "value": "3072:WyE0VWmfmQZJz3ME4bkCoitvtrHLqr6gGKZKWoD:RE63mQZJwE4bkCo+vtrHLqrzG8KWoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774384494, "uuid": "60b8f0db-8954-4786-8caa-618448efbb3b", "value": 200873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774384494, "uuid": "8058f962-fb0a-4b42-8d86-a77c45355f37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384494, "uuid": "ec64a0aa-9096-4633-9350-2514ea880484", "value": "NUTA_win32.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b7e817-276b-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1774347595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347595, "uuid": "8a12a9f2-aa5b-46bf-a037-8d53c8f3501c", "comment": "Malware payload (DonutLoader)", "value": "bd2211291ad06c486fe0fd8343f1d324", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347595, "uuid": "3b301f28-5a43-44c8-90b7-7305517797f3", "comment": "Malware payload (DonutLoader)", "value": "6cd042fd0353ca0738c532f9bf34f42570e6abb529363ac70e7d5342fac1be9f", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347595, "uuid": "3767e5af-0949-4b1a-9b16-c0c055fa519c", "comment": "Malware payload (DonutLoader)", "value": "66c18afdcdf169ed431aa34580829c5d6eed7ef3", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347595, "uuid": "c67bef47-4f93-40ec-88b7-d39b6e101613", "comment": "Malware payload (DonutLoader)", "value": "63925460aa16ddd37b7f5331ed9c89c7c9b19199f3cd192af2572c7b9430e3d1e0a48d8e1c00dff9a5ba9bfd13ec5ed9", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347595, "uuid": "4f42b8e3-2643-4f72-8481-c93df525ef55", "value": "T1B0C63339D27304BBA9F498CD2316E7C464279957C1C6C489AD582C6F7E2DBE9CD368C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347595, "uuid": "d9dac237-9523-4ad8-8712-cc6a3a5060e0", "value": "196608:l+5MHqw5HpY1RBhIdJSksgodg64DgbUIpov/wXJh+5qighP1AjrxGY:l+5MHDLYvzIPFsY9g7ov/iJh+MighP1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774347595, "uuid": "2aff4f3c-4607-430f-ab03-52758c9d32fb", "value": 12517942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774347595, "uuid": "0860acaf-9f65-4363-be3a-b1e57908e616", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347595, "uuid": "1588c0e1-7c4e-4fb7-b12f-c18994126b23", "value": "T-Mobile-Security-Patch.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c2e03c-278b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361564, "uuid": "60f8fd33-b521-4f30-9bca-e3ae01d1a469", "comment": "Malware payload", "value": "ebae474544f9f4e8e086d99c40488ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361564, "uuid": "286361a8-a34f-47d5-91b9-942419356811", "comment": "Malware payload", "value": "6ce3654c34fd62708a597f93756b430c66e777b44b9467d8ff4f5f6ba538f4a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361564, "uuid": "bebbfc84-9e73-4ee3-82b4-b734a1d219a7", "comment": "Malware payload", "value": "9cb8868df8344717d2e8eab071f108ad8bdbefcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361564, "uuid": "a1cd38b4-7cd7-40bd-ae3c-2d6d49521294", "comment": "Malware payload", "value": "ca57fc57073d3953fc00285599529acd3ba17eaa23b8069e028329d9e3655a137e7dbf4b5215361fc4af69c737ee3b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361564, "uuid": "edb313d7-ae9d-400d-9177-deb87f7d5a31", "value": "T1DE3501442265EE02C5A24BF44A71D37457F59D89A421D313CFFAFCF7BA2974AA8082D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361564, "uuid": "e7982d92-37a8-4a75-b89a-e0224fdc8942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361564, "uuid": "251ac274-52f9-4dc7-a183-4bdb72cc0bb2", "value": "24576:+RQPVtcNhJd1gzzOVFjcaN+P5e8G1EjlcjAgbJMwRciaDOq:FPVtgJd1QzOVFjpgRdYEjlcjAOJMCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361564, "uuid": "fcc3cc3e-0486-4d2e-8be1-2d176a780623", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361564, "uuid": "2126220d-f1d6-4610-bd49-3ac892ceb86d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361564, "uuid": "0d0cd0a9-dc0a-49fa-afca-f8442c9f6343", "value": "\u0421\u043a\u0430\u043d\u0443\u0432\u0430\u043d\u043d\u044f 16 \u0431\u0435\u0440\u0435\u0437\u043d\u044f, SS-002V-0000810-0022EM026_\u0422\u0440\u0430\u043d\u0437\u0430\u043a\u0446\u0456\u0457 (2).docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec5d344-2752-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774337149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337149, "uuid": "daf75175-d859-495a-af56-a6e65abc443d", "comment": "Malware payload (Formbook)", "value": "fe5d97bfcd173277bd7d09dc70aaf8c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337149, "uuid": "d8955f2a-f996-4e5a-afcb-0afea3164584", "comment": "Malware payload (Formbook)", "value": "6f3432ad487259c0889ba862fb148cbca3b1c568422440ada2e37d130b9aaa56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337149, "uuid": "7e2ea920-299f-4da3-9675-d16c33539262", "comment": "Malware payload (Formbook)", "value": "f8457a96a064fccf6d273efbbaad1bca907b9554", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337149, "uuid": "8ca1bf0d-c553-4093-9866-0e783287d58c", "comment": "Malware payload (Formbook)", "value": "f5deb98859c4bc04457d276b154ba1dc349e7f675350306f5835495adb3a0d7cc61430e007638c59dd006cff1cb39d7a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337149, "uuid": "b9ad3044-f17e-4631-aa53-5f90400fb8a8", "value": "T107A5CFAE82900F65ADC6C21EE0F9050848F047F45ED93A257E62E96F7DF7B94B0E611C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337149, "uuid": "1a6e5210-d01d-4046-a76f-d319d26bd56d", "value": "24576:AgrfJ9itV+kj0ysLv3w/K56y1oOQy/TaiWTndgjAkWY1uT:vijkyFmjQyvWQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337149, "uuid": "de3b124a-fa7e-4b37-9a4c-6991df04506d", "value": 2071324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337149, "uuid": "bf7effce-210c-435f-8407-9ac89731a83f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337149, "uuid": "92131c5c-50b5-45ab-8556-8582d2d9300b", "value": "LPO\u00a0No. 0201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4383ac52-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383785, "uuid": "6d9e38dd-4ee3-4807-a4b0-9aa6a5208d20", "comment": "Malware payload", "value": "6af1c1d0bf5175f5e360853a6344d7cf", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383785, "uuid": "86744a23-4c6a-4b2f-b8a6-948de239d6af", "comment": "Malware payload", "value": "6fbb15997087eeb37320503a99f42d4b41a0fcab92f2b34a833134821642d161", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383785, "uuid": "8a9679ba-450c-4327-be4d-071395061382", "comment": "Malware payload", "value": "425b21bf9321ca657650eefbef8f38bc0ba897be", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383785, "uuid": "e8c36a9f-3b49-47e4-876b-789614058bfc", "comment": "Malware payload", "value": "17d984f6581a31b9f4b9d73d9aa6f1b3862abe356e2c825473b0e7f82b4baddf701e94e7af905d9c81c00e0cb4deaf20", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383785, "uuid": "8dd9cc31-52f2-4860-88b7-9cd7ef141dd1", "value": "T1BE14918D59F322115563B2B99B6FA40E2235E103690ECE107F5C93916F8C63C9AF6FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383785, "uuid": "7ddbdf0a-f7f4-4012-a3d8-338fe87e7919", "value": "3072:WyE0VWmfmQZJz3ME4bkCoitvtrHLqrIa3MKWoq:RE63mQZJwE4bkCo+vtrHLqrfcKWoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383785, "uuid": "ae793a0a-b8f2-42d6-a634-3027fd8c3896", "value": 200922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383785, "uuid": "3c398f76-297a-4b4f-97c2-e21b494a65c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383785, "uuid": "393995b4-f0d1-4f32-afc4-612141910927", "value": "3e4T_win32.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626b0e41-278d-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774362362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362362, "uuid": "c830af11-4bee-4c15-b00f-971a0fd0c581", "comment": "Malware payload (Heodo)", "value": "596d2c49034e8b968acbd69cc1bdb12c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362362, "uuid": "c00efe4b-236d-41c5-9304-7f799cb304fc", "comment": "Malware payload (Heodo)", "value": "705c42dd63cd4b01a8a858d36948d58c824e67e1363df55183e4bb4dff6f1597", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362362, "uuid": "a979fbd6-8836-44a4-9543-a81726a605aa", "comment": "Malware payload (Heodo)", "value": "73ed7df6b9b40dd9859e8652e0cdf2836c5f7f70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362362, "uuid": "7656e82d-b9bb-468b-97d4-d61c662e10d1", "comment": "Malware payload (Heodo)", "value": "343d6eb2dc5e222c6288afd0fb24412ffe4895ad79f203adb57958ac0a3d9f0aa6d06eab208267f69454e9317ebb1443", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362362, "uuid": "90a53ea3-a016-46b5-9182-0249c0850b22", "value": "T10B431703B782D8B6FC9E14B5619A7627496BDF30430F9ED383F6309259219E86DF814E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362362, "uuid": "d0a5cf6a-8968-4fd9-9379-a91f594c2033", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362362, "uuid": "10d4d953-5c3b-4b06-a678-99cdfd8313c9", "value": "768:VdLo2dWD/nukzBniY0O5aX5ATwOoOZz7sXzJsOZcTuWqXMCCanWef5saSBq:VpnWeOUX5e7sXlZcTfqXM5aWg5ABq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774362362, "uuid": "192bdd1f-1b16-40b4-912f-96c63c6b6c8d", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774362362, "uuid": "ae941f57-aeb1-4b3e-b3b1-255d569d368a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362362, "uuid": "906f2db3-206c-45c6-a7d9-79132c15090c", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bcd70c-2792-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774364513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364513, "uuid": "8c3f1100-57cb-4a84-a391-366199e14af1", "comment": "Malware payload (Heodo)", "value": "459cc461491abee9c84d53aa33fa655a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364513, "uuid": "d9e8773c-1e8f-4d35-80f2-23ed247daf93", "comment": "Malware payload (Heodo)", "value": "70d0348face80ae89f7ff17f190f2a014f49decae63a5cfc2855ad9ebfd5f67e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364513, "uuid": "cfa67aa8-44d5-48a9-8ed6-15e560a9a468", "comment": "Malware payload (Heodo)", "value": "448d00c61197668ae5fcddaa2cdcd32f2ab9708b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364513, "uuid": "48960560-e6d0-4f79-b1a0-77bd10fd1637", "comment": "Malware payload (Heodo)", "value": "a249d84aeaf1723b0eceefd7fa05288485574836a32444b6b5f5fa7e51e31b11c2fdc82032092ee4059be574c90ef1b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364513, "uuid": "6cb501dd-b0ae-4d53-9a7a-c4c62b405fd8", "value": "T1E8434A337381D8B7EC818CF89D99B6A80877D13193074ED3AB712092DE63DEA563195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364513, "uuid": "a09841c7-d35d-4b31-a310-8e670a009515", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364513, "uuid": "f06259c5-2c46-4f57-9303-d755d3bb8e7d", "value": "1536:XnWgGerYh6NDjmulgmeQGN3fzRZ+AvlDK1:7rYhEDau2lNPzRZ+AvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364513, "uuid": "bab5427e-4f51-49a3-b1d8-6a19fe27b0b1", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364513, "uuid": "c2480fe7-9ad4-4192-8efd-c717a3b26c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364513, "uuid": "83efb6b6-e07b-421c-a138-92b7d666c238", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1414e014-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342903, "uuid": "b641d7e4-297d-4fe0-94d0-b594310e1090", "comment": "Malware payload", "value": "79731adb5d0b68577e4086f184483925", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342903, "uuid": "1ecb41d4-87fb-45a5-ac43-6a871f6d337f", "comment": "Malware payload", "value": "710b77977f28ee17da7e3dd252067a1175c243d99ff028ed9ab1b00ef28235cc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342903, "uuid": "294c0eb9-1031-47c8-b78c-d5ae4881451d", "comment": "Malware payload", "value": "6054796469571b34e2e0a1e5826cd164d7613f8d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342903, "uuid": "6235c25e-2e5e-4ade-bddd-86bf93b60a95", "comment": "Malware payload", "value": "b89acec839710e29d680fb7a60c46eda343984257815efd5f38aeed7846fc811a643493ac7bee381f95be2638e6e195c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342903, "uuid": "c2d8c036-36ec-4040-a73a-b537da292dc4", "value": "T12D5512BFFF2C69277C5233CBACC35505C0098B1910A419958ADB7D213C3AE8D6DA5BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342903, "uuid": "708835af-68a8-45bf-ad59-3deb7aab0cb8", "value": "96:NAGiIBDKuwJu0IJRauZH8dm+BoxRJTnc0n:jiANJH8dm+Box8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342903, "uuid": "5cde453d-4629-47f5-85d9-43f1d68dc736", "value": 1324145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342903, "uuid": "d7a5188c-c692-4872-b6bc-e5280b8c918d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342903, "uuid": "bfa03b78-2448-4903-96cd-24ce5fd8677d", "value": "79731adb5d0b68577e4086f184483925.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e96611-27c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386679, "uuid": "d51e515f-85eb-4380-bda3-800e745b47cc", "comment": "Malware payload", "value": "6cf263dd0722de5b6df5b813ab1413a4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4720", "colour": "#8DD907", "exportable": true, "hide_tag": false }, { "name": "silverhost-vg", "colour": "#514C34", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386679, "uuid": "d65dff2b-87b8-45de-a0cd-3d8f9edbadf0", "comment": "Malware payload", "value": "712421f30145ce79851d43b4f8330fd4474972b43ba5e5ebdf06dfa9fcee3cad", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4720", "colour": "#8DD907", "exportable": true, "hide_tag": false }, { "name": "silverhost-vg", "colour": "#514C34", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386679, "uuid": "1b4dfaae-0789-4b0c-bb34-526fcc957ab3", "comment": "Malware payload", "value": "7359c7c4bc0aab4d52e438cafd8bbe47a2321d16", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4720", "colour": "#8DD907", "exportable": true, "hide_tag": false }, { "name": "silverhost-vg", "colour": "#514C34", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386679, "uuid": "bcc5e300-7402-40e6-8007-f06c2709fa57", "comment": "Malware payload", "value": "c1830ce996570ff52ef784662a2f1dcaa7b105f92946639d5dc958eb5395bea515c504f645a9af8361897aa55b83059a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-4720", "colour": "#8DD907", "exportable": true, "hide_tag": false }, { "name": "silverhost-vg", "colour": "#514C34", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386679, "uuid": "3b8dbb1a-9652-495e-8c7e-06b48a5ee74f", "value": "T1C0F53328243E7DB88C34046F5D0B5E43F25D4EBD85DA901CF34DA8ACADCDAD099736A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386679, "uuid": "e16994e9-fa27-4555-bd55-378a26f51c7d", "value": "49152:074WSykICH5ZpbaeeQYkElvpa5V8OoGud9iZEu1Ufr1+T5Ay2EpYqxiOhg:o4aSZVi5p48OK9iZEuMrl+xiOhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386679, "uuid": "b81918ba-9303-4df6-92a1-9b5ecadf1c91", "value": 3341811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386679, "uuid": "0a2418d3-fab5-4758-8658-4a65144f71bf", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386679, "uuid": "9e6447a5-e0a1-4408-8ac4-07bc200cb86e", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d210e7d-2791-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774364017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364017, "uuid": "a11c73c3-215c-4c54-81c6-8e581134c670", "comment": "Malware payload", "value": "db82b505107828d274a4012f5b95e081", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364017, "uuid": "05917df2-1913-43c9-939b-0a5ec7ff5e35", "comment": "Malware payload", "value": "71cb33047d62a728bde8306fb76fd8c40fe7abf18dbcf44070fcf68f9b9feb5e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364017, "uuid": "99a91679-3d4e-4657-9cfa-e11e792ec6d6", "comment": "Malware payload", "value": "3c0fc6f7356927007db90d16f8af0145b1d235fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364017, "uuid": "83dc4cd8-a6c4-44a8-92e3-4d70841027dd", "comment": "Malware payload", "value": "688b91c669cf99d5d1458bf7e40f75b59daedd05ad64def94eb0bf3222005a44fce890946ced197aaadb35f133302d2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364017, "uuid": "17e64a21-4f9d-4ff5-be39-64d202e12b0c", "value": "T137925DB512896C79FBD1CE39AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364017, "uuid": "83ec4026-ad71-432a-822b-552bbec254ab", "value": "384:7FcuQpWx+BL0SWL0gdzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:7F8i+BL0SI0uzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364017, "uuid": "ba1d96a2-0516-450c-b6e1-42444436d5e5", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364017, "uuid": "e16f6c78-9aa4-4bf6-a14d-30fe9f4e4289", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364017, "uuid": "cda72115-0bd5-460d-b7d3-61ba6ab21185", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6824da8c-2733-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774323716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323716, "uuid": "5edad159-cd1e-4f34-ad2e-d94d70f278e8", "comment": "Malware payload (Mirai)", "value": "2b22f89c9b1629f44bd26e6f2e6c457f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323716, "uuid": "a3fb7d70-ee8c-4455-ad2b-3496781c2fff", "comment": "Malware payload (Mirai)", "value": "729a26fcec39465c2819287818a9c5111debf73a520c0fcfcc17d9e4da3b9044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323716, "uuid": "bc484c8d-bbe3-46ea-b1dc-42135e72c663", "comment": "Malware payload (Mirai)", "value": "c773b600bf4992f378139f38a8ab0a9455fbbd2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323716, "uuid": "075b97d9-d892-405c-af7f-ec3bc2eefc24", "comment": "Malware payload (Mirai)", "value": "aff3a95a094ff267367cd56cc2ebaf81e91da43982920842d82a31a73d63c3f1ee38d035f01152c83f153731994f3f72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323716, "uuid": "084f3206-89f0-44be-9a31-6f06b82a764a", "value": "T1BE93E506BFA11FF7D8AFCD374AA92B0525CC550B21A53B357974D828B64B24F09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323716, "uuid": "d63d2ddd-31db-450e-8a0c-4196d19a4f5c", "value": "1536:Yin9mZ1+71GOpDeiOb1HVPsFPqTrK1EEm28vD3Xqqofah:ZmZKzeiy1xW1m28rRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774323716, "uuid": "10f567ea-22ad-4835-89c7-1d72008a02fd", "value": 93016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774323716, "uuid": "ea7d1f58-1b0f-4a35-bbd9-e0e3a96acfb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323716, "uuid": "e052bbe2-a28b-414e-9d74-77d68b491581", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e33ac3-271b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774313539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774313539, "uuid": "1fc86b6f-4e1f-4d39-b1ef-20b6b57c5fc3", "comment": "Malware payload (ACRStealer)", "value": "2ffeacbcc0c71bdeac79a9e9be023b4e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774313539, "uuid": "dffb2ae9-6569-4dad-a589-b6e309a04f92", "comment": "Malware payload (ACRStealer)", "value": "73edb1d8637b28113a1ba04fa4aa64d3020a9eaaf8a3024b978b362a4cce6238", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774313539, "uuid": "2f27c3ff-d101-4e9e-8212-b38f61e573ae", "comment": "Malware payload (ACRStealer)", "value": "8c268b6c3e3f5dbdcbf1ae75f8b8d82fcaaae887", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774313539, "uuid": "96f50cc2-ef09-4a6d-863a-f9250cb3e2a0", "comment": "Malware payload (ACRStealer)", "value": "89ea22f45b3ce0fd7f41f851dce0501b1ed40ecd0ad7dbe402c8692093893027b43f0125fc95382231a9d5dfdaeb25fd", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774313539, "uuid": "d77ce0f2-a833-41cb-8803-f0fb6cbfb003", "value": "T1B7C55C0BFCA005F9C1AEA1318533955A7A717C441F3263DB2BA0B7782FB2BE09979754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774313539, "uuid": "513b5566-6692-47ac-8bd4-361fb182f8c0", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774313539, "uuid": "a328f242-2708-4c74-96b3-071ab1dc85eb", "value": "49152:LdGMFhYn1rvCiiWLwa6Q+Uljy5Qc3F0K:Ld4OigbEq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774313539, "uuid": "ea748a75-1336-4cb9-ac83-ecfbf7072943", "value": 2535424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774313539, "uuid": "eb3815b1-23bf-40fb-8c52-4808a706469b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774313539, "uuid": "0416865b-50e1-4076-b7b7-dfdbbc79a3c7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.55368358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8deda8-279b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774368415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368415, "uuid": "e7b3fb1c-be03-4661-b0e1-72ec0f21c19c", "comment": "Malware payload", "value": "0405f607a2e93e2baf81456efe943e9c", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368415, "uuid": "ac300b84-759c-4aad-a700-9a330347bf26", "comment": "Malware payload", "value": "752c5ee1fd0f0b9e5b2cb3e54606c128b520dc69ea42871f51553736375e235b", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368415, "uuid": "9d2b9c1a-6cd2-4962-9c76-e9a8397909ad", "comment": "Malware payload", "value": "3eb67cf313513bf6b2ea5309c4b784218e718185", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368415, "uuid": "45ac94ff-73b7-475a-9a58-54a6c965ff9a", "comment": "Malware payload", "value": "2a085c79af7fb0699b362b12d0ecf5ffe26eccd4767836d036c2571f0a3f833384573943ab03118f27b0540b000c9694", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368415, "uuid": "346d8904-8e5b-4ea7-be88-884686b4073d", "value": "T18D479D5B76A40094D07AC079CAA38557FB71B4166B316BEF1269935A1F33BE09E3F320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368415, "uuid": "ac5c55af-0427-47dd-823d-39a48b096477", "value": "c5d99d6067b3e02061529e584d377bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368415, "uuid": "72df9549-efde-4ecb-8a9b-76049f656524", "value": "393216:g43q1X5LUknDP7Mndf/s/UgGdIqBGZiIlsASt39WNKFJrJsv6tWKFdu9CFRAP:g4kIk/aIlWt3X5RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774368415, "uuid": "5e918da2-0a0e-404c-9a06-41bcf6453f80", "value": 26771968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774368415, "uuid": "5f105c18-bc56-4166-a420-43371849c16a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368415, "uuid": "09db8661-bce3-4bd1-8361-b0b1d0a50848", "value": "752c5ee1fd0f0b9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b48f5f-27cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774389019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389019, "uuid": "e3fc574d-6904-4984-874e-cca797ba2daa", "comment": "Malware payload", "value": "585182e1e22ee2b0957923a5873ded88", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389019, "uuid": "c3405272-397a-4f3a-bb37-0abdded74a11", "comment": "Malware payload", "value": "75749c315f39faf32ab6758f3c1cb0cc992150ab4a3e841a3afc5679bb639ab1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389019, "uuid": "77ce6c97-0eaf-4b62-899f-b2e72d77796f", "comment": "Malware payload", "value": "5a811624631ec3fe1bf06d9e6583f758e717562b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774389019, "uuid": "1e9ce7f0-1cd4-43ef-8905-1b40927b7d69", "comment": "Malware payload", "value": "e2fe20b73c7177da6c98e66d08740686624d2bc6853d3cdd07af3431c6060283dae6f8cf303b155ba404a6b304e83458", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774389019, "uuid": "11345efe-3119-41d9-a037-a670bfdad93e", "value": "T1E891690812F51B25F2F35A3958BA50858C757D4EFE32CEAC02A5C2480825A66EC76F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774389019, "uuid": "e2a7381a-abf0-4d01-8b25-32f913cf38c6", "value": "96:8jBdSL7OP35/rTxcpgczM9tG90M9MSM9AwCvlPvlMs5T4MksRcBQv9YbM:8Vmgp/rTmpr+otMf8l3F9kBG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774389019, "uuid": "32a69693-b49a-439d-8c42-3d4dd17ddb4e", "value": 4466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774389019, "uuid": "60f91b16-26d6-4d0b-96cd-c6431500c183", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774389019, "uuid": "3b25923b-d368-4579-b79a-beb8489deacb", "value": "SF026_211.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41455f6-2797-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774366901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366901, "uuid": "36f0a12c-f2fd-4b42-bea6-fbce1236b430", "comment": "Malware payload", "value": "10a0c99df0d2360abd182b36c82acbed", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366901, "uuid": "b9689b3e-687c-4a21-be38-12070d07aaa7", "comment": "Malware payload", "value": "760c7cd6afe764792d2470561ce55e537723a4624ce54fccb3581bee2cdd7794", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366901, "uuid": "fd4a9965-9952-4741-983a-a7fbde268c38", "comment": "Malware payload", "value": "397da58e0d693d047cd66cf2c09ff8c791fcd331", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366901, "uuid": "f35a928a-0527-4c40-8236-a0d1e2f6cd7b", "comment": "Malware payload", "value": "a962b5a52584f647357182707b3adf6c177923d2bee9dbe131c57d401e6e540b5f37ad9cfbc00d506f18cc598ca1d9a3", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366901, "uuid": "dadb16fb-e50d-4dad-a329-fcaa6e8ba96d", "value": "T11D673334A280D6F2DB76A134D9916B7850FA70842F35CCD3A5F64C3A243D1E26FF2969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366901, "uuid": "55b7b468-4928-496a-b8ec-2f8382ee674f", "value": "41176959e4a70b99a0f7e88e2afa1b9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366901, "uuid": "9d37588c-3dea-4468-b652-762480da06a6", "value": "786432:J3jlM8Ok4SswMWifNtt7Z1oGwnicL1cHDC0s3T:J3jlgk37MW8NttpSLCH0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366901, "uuid": "b0e50691-8b8e-4ef5-8ccb-d54c6ed5b382", "value": 31422025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366901, "uuid": "a593ed93-b29b-4154-9bdb-bca18bc64046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366901, "uuid": "389a685a-fe87-42e5-b818-2f54ccc28052", "value": "760c7cd6afe76479.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8984f33-27ad-11f1-a769-42010a9c0008", "comment": "Malware payload (ClayRat)", "timestamp": 1774376331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376331, "uuid": "26e3c7be-4634-4ae4-904b-8996a900a4d2", "comment": "Malware payload (ClayRat)", "value": "b71b04fa665e545cffa06e10a32052d5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376331, "uuid": "7929cbff-07e3-4d3c-95eb-402b4d8b4c3e", "comment": "Malware payload (ClayRat)", "value": "78878d33b2b48747694ce2fdb24e896cd9ba027b1d66c66c107cf415ed46b89b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376331, "uuid": "67ede3b7-ce3c-4c02-a224-c82bad186343", "comment": "Malware payload (ClayRat)", "value": "1d0e1a3fb55c21fefa13bfe3040dde43d4b763ac", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376331, "uuid": "7e6479a7-def9-42b1-8b96-26fbe0f74aaa", "comment": "Malware payload (ClayRat)", "value": "5935eebaf23dde2e908401eee402a02cbef30bf7dc724429f7475b3ab134164d8f3db770fdef1e7b37a50292224a5ec0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376331, "uuid": "cc98a5c7-4952-4f1b-aaf5-41ab2c62b628", "value": "T19A660256F749947EC8FB173A463612702263CC628F4396832958733C69BB9C85F29FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376331, "uuid": "3ea9e18f-1c7a-4e2b-9a32-6c6b6a0de756", "value": "196608:oNr8L/UuQxEYXZ4T4zB6E+C7ziRIZ0/OU3Yfz:i8/WZ4UziC74IZpU3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376331, "uuid": "26c56c0e-8745-4a6f-9347-b63a947cca38", "value": 7071157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376331, "uuid": "92b767d1-66fe-40f1-b296-9bc782426bcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376331, "uuid": "4e911794-8150-482f-83dd-8489108e6de4", "value": "%D0%92%D0%B8%D0%B4%D0%B5%D0%BE_%D1%81_%D0%94%D0%A2%D0%9F.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6174368-275c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774341537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341537, "uuid": "f4f277a9-3e0e-46c2-b328-4d6e5faca4f2", "comment": "Malware payload (Formbook)", "value": "98f890f320c9043a0bc3398896b838f2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341537, "uuid": "afe24e93-cab3-414f-b963-b2dff07d2171", "comment": "Malware payload (Formbook)", "value": "78a0226aca4aaf42bc35f67b535bbb46607d71781a20facba7261db93c7a7d6f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341537, "uuid": "422b2410-d9ca-4d19-a1e4-97be45af6b4a", "comment": "Malware payload (Formbook)", "value": "a5159f8847f2f1a0902f92b75700ac09af806a68", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774341537, "uuid": "7eb59fe8-d8a3-4cfe-83ff-432c9559db78", "comment": "Malware payload (Formbook)", "value": "814a0f9be3e7120de8ec7a6bf179dd096dababa7159ffb6914686055da88a7be822f04ebb44c0809571cadf9dc2b966f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341537, "uuid": "95be4065-d1ab-4294-85bb-6741343ed284", "value": "T1FE51B8B60B6322E13D520175F3DA074D9222A008834E478736EC549DADE27BC4333EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341537, "uuid": "02c3358b-f502-4787-9b3a-ed30f1e580ce", "value": "48:zuVKMlx9qYZIiXJCXSb3YzklK4b7du7Z/d8wacMbohO5wNMBgBgOgS3D7mDB7JO:irx9qYZ55CX6YzmK4g0wacMbouwN8egW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774341537, "uuid": "30232105-3806-4ca5-a155-0194dbab0ff9", "value": 3013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774341537, "uuid": "ec954594-d896-45d9-a8ef-8a7416730270", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774341537, "uuid": "341badae-32bf-4f3f-b7c0-dbfc9dc1c32c", "value": "25SZJA tervezet el\u00e9rhet\u0151s\u00e9ge_a\u00b7pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8837dbba-2797-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366720, "uuid": "21ffe51c-0670-4ac6-8bdf-920ece361d16", "comment": "Malware payload (Mirai)", "value": "9d0ba85fb586f9a305838f8f1f1844d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366720, "uuid": "313318e2-adc5-478d-8398-568e351469a0", "comment": "Malware payload (Mirai)", "value": "78c44ed61f0916c913bca1995b2313a9d4324f9e7e0f65e5443ff44b70701cd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366720, "uuid": "e356fc1e-d451-4153-8a62-58bf15f821c9", "comment": "Malware payload (Mirai)", "value": "fc126c6f19bc82686ef8affaf3029d17938c518e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366720, "uuid": "340dbc7d-3190-4274-8fd0-5758f22e1153", "comment": "Malware payload (Mirai)", "value": "f377a07f2b91d71e18f527bf5a6f94b49428846c6d62e06fe428ebf23dba1572636de73eb64f4618b68ab46c1d43526a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366720, "uuid": "9c30e5f2-e8fa-4644-94cc-46e3de5a98af", "value": "T1C0B39CDBF24702A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366720, "uuid": "4e891e06-872b-41a7-84a9-7b3be3c1501b", "value": "1536:vu27gBY9FSSpj3z5Qxw6YaWWgg1K/LWy:29sSyzz36YaWWgg1Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366720, "uuid": "37df434e-3c55-432f-a599-40c82bc36db5", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366720, "uuid": "cb76747b-36be-411f-9dd4-2599bbc14b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366720, "uuid": "191e2394-73f1-43e3-ba4e-628eea3618de", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80590f9f-2752-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774337071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337071, "uuid": "22bc3500-63f9-42be-9336-1ca07c689359", "comment": "Malware payload (GuLoader)", "value": "bcc0853cc4ef6822ba41096616f05073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337071, "uuid": "efb1ab73-8e72-429e-a2da-1848b423c0ed", "comment": "Malware payload (GuLoader)", "value": "79a3df3ceb4932d08a0a128534e02983276a4c690874677cb0e4c799f9b41100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337071, "uuid": "dda012e0-8bbe-4241-a71e-4727c4f3996f", "comment": "Malware payload (GuLoader)", "value": "500a8f6aa648f390324120cd602b6202ee4364dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337071, "uuid": "97173cba-b725-4e52-9555-6373bf48994d", "comment": "Malware payload (GuLoader)", "value": "17e07d22fedccfcf3f707cef24098f6e08f238abccd0352aefaa64c849f229e85a7d024692606dfb9343db144e63bb68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337071, "uuid": "d6db13f1-edd7-4638-868f-e16e5dccc41e", "value": "T11EE4DF11F33C74A9D8E202B187DE8DA00566F9ED665837CA16E07E6D73728215B3FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337071, "uuid": "5271c3c6-a353-4edf-bb73-56964d131a90", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337071, "uuid": "4dcc14ae-e61f-42ba-9257-b7c7f93e6454", "value": "12288:KbBS5aEaRzlu5f4YYo0KmP5LiywJ+p682gD+dx2:KbYaESzi44yu8rCH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337071, "uuid": "d5542c0d-28b0-4717-b192-23e5dd92a340", "value": 659470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337071, "uuid": "01f9dfa0-3f89-415f-a74b-fbe76f0f4332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337071, "uuid": "3ebd0796-f070-4895-9921-502bbca6a93e", "value": "Factuur confirmation #5676788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2a4358-2790-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774363510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363510, "uuid": "66982b33-f422-427b-894c-885338c74cb3", "comment": "Malware payload (Heodo)", "value": "bf562db325c1417cfa846dd551fdd848", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363510, "uuid": "74c722d6-7165-4348-8d81-269060745dd2", "comment": "Malware payload (Heodo)", "value": "7c7c027baabad9e9adfc97b05a53bea249995dd94b01777fd41d890f79525612", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363510, "uuid": "e741c542-d32a-44b7-a75f-14548b0d0243", "comment": "Malware payload (Heodo)", "value": "a2b9d4a3ecd22fedf63ccf1942f1fde695cfcf66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363510, "uuid": "640e956f-1c49-4b43-80f7-8e33d128eaf1", "comment": "Malware payload (Heodo)", "value": "874c770e81195fdd8fd9b3cd8811413de993b35353f5c73477992f59fd37e43323278e4e9d142041040b343a63783df5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363510, "uuid": "211b5b1e-c484-4abe-a3e5-9acc506e363a", "value": "T19A834B43B645C0B7EC8849786DFAB6A60A3BC53093035DD31373398B5DB9AF628B415D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363510, "uuid": "ad5ebbc1-cef5-43b9-953e-f22c126a3def", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363510, "uuid": "fafe82b8-78c6-4e9b-9d3b-b0c64674105a", "value": "1536:5nWcxDpJoykXFKKLSKdLqbF98tRqys5BjE7yLj:tDpJoj/4ERUTjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774363510, "uuid": "59ae45d2-e4c3-4d14-9780-5dc784274877", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774363510, "uuid": "1c7d034a-b7f6-42ff-b07f-222320baeba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363510, "uuid": "3502efaf-2331-42df-b4cd-54b55dcf92e2", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0611be5a-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload (TinyNuke)", "timestamp": 1774386258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386258, "uuid": "58eb7b9b-f4a9-485a-96df-86033c2340eb", "comment": "Malware payload (TinyNuke)", "value": "3294faaf6bb8896bbce7747b9ffa1947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386258, "uuid": "040fa375-289d-4e33-8598-3bcd98708524", "comment": "Malware payload (TinyNuke)", "value": "7c98456c895f4113a53cbff902908e2893b263c0ffa1785dc3d021b3aecf9f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386258, "uuid": "02850015-2c44-4def-92cd-3e96ef2f7631", "comment": "Malware payload (TinyNuke)", "value": "28124629c176758f3dcfaa616cb98efc33eef6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386258, "uuid": "82ce802c-70df-42b7-8bc9-2a9b65f638ae", "comment": "Malware payload (TinyNuke)", "value": "e46375afc82c432b6bac1b15bda56a17bf61f47949db7263323e2fa763945cafe62a2ee06a482d575b65d669bb20f01c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386258, "uuid": "d7f7838a-b6dc-46d3-a5b9-7e8ec9106dcb", "value": "T12CB36C03F1D1C471D9B504B54C609BB0CA7DFC301BAD9DEB775805AA0F781E19A3AAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386258, "uuid": "5d319319-6817-49ca-ba01-0c4d4ef8d439", "value": "c2f68e197137b179bafa6a787519dba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386258, "uuid": "d165219f-a099-4495-a32f-84eceb24d178", "value": "3072:AUQwqu9+2KNoowOr7+Z/eGIi8myg6ebjtIPs+mx6tC3LojRZLZN:JReJwAO/IsVhUJzwqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386258, "uuid": "dd40c151-1daf-472c-9c9b-0352999a7751", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386258, "uuid": "fe9c0988-6ca8-4a79-bfe5-5b8da55d0c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386258, "uuid": "56138ab6-d515-433f-8380-2fd1b577a7bd", "value": "get_encrypt_file_exe.decrypted", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97b2394-2784-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774358642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358642, "uuid": "ad184137-9bab-4976-a335-b48489e19634", "comment": "Malware payload (NirCmd)", "value": "ff030edfb20330d6a4cd12d52bc0b0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358642, "uuid": "15e13886-5cb3-4817-94f1-d4aa2b164461", "comment": "Malware payload (NirCmd)", "value": "7d1e6fb3fe4870812aa17c3f871a3728d949315662980670439196395bd19b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358642, "uuid": "f60a222f-0336-46d2-a684-ca99e84d830a", "comment": "Malware payload (NirCmd)", "value": "d50c06503c81124ea29ab8c1bcfa4bcc15a03435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358642, "uuid": "ef320e4d-3864-4c87-87ae-185e20f240cb", "comment": "Malware payload (NirCmd)", "value": "5330e667c52fb93acc873e227b35eaa1ec01eb895b97da3761b25e8a4c3eb2512dc82dd7a049b3dcf46bb1354b357c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358642, "uuid": "7d19c9d4-24ff-48bf-bbf8-b0c0b59ad5ad", "value": "T199A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358642, "uuid": "ff481027-7661-4b0c-bdd2-fdfa56d4fc08", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358642, "uuid": "edb1afb3-e40d-41be-9a4c-12bf677c0c87", "value": "49152:ABRzTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aNTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358642, "uuid": "ed4149d7-e104-469e-ab4a-d66adbbee966", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358642, "uuid": "74ea59b0-f049-40de-a3b0-e8178b59e15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358642, "uuid": "f28c9fd6-374e-4ecc-bde3-4aef8b8ba1e0", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6271d5a9-2762-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774343893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343893, "uuid": "e512f84d-9def-4448-a879-b719d979714c", "comment": "Malware payload (LummaStealer)", "value": "0cccb9652afe2ff2175f3d89c8834cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343893, "uuid": "71bcf23f-77fb-4021-863a-b49125178a0a", "comment": "Malware payload (LummaStealer)", "value": "7d8067aaa58462c0e0a8e05ce4dad814a536aa11a4405de2a8d4af3f44f9540a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343893, "uuid": "ca06dbf2-ee45-4462-bf17-dfe5d3efef2f", "comment": "Malware payload (LummaStealer)", "value": "2f3d164d6b8a7eb289ff5520ae8a113800a9fff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343893, "uuid": "42ef21b4-3bbe-4772-8285-f34f02e6893c", "comment": "Malware payload (LummaStealer)", "value": "44c2fde5eac46d0918af0cf88a17745575c8ef516f2d4863e0d5213c654b57d41e86f3ffa359aea66e018d1496c65f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343893, "uuid": "63a7e8fb-107c-4e24-8af7-35563a200245", "value": "T15F946C62EB9658D1DC4A1B7874B3623F8D207A2541388E538690DDCF199FAD3C43EF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343893, "uuid": "79282bc3-30e3-4b0a-b0d7-d189cb3bdca8", "value": "75e0bb64141c15432ad7733a722ec3b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343893, "uuid": "bd7d2021-519a-48f1-b0d7-66b61be3fa33", "value": "6144:GSRqAz4+HAAaZlyytbS1okySdHYY1kEtJdsJwJmJSJrXJmJ3JYJ3JeJ3JUJ3JGJs:9MAc+HAAaGIeDdH31kE1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343893, "uuid": "c076c88e-bc61-48ae-a005-d0be226c644b", "value": 443536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343893, "uuid": "ecc928b9-1798-4e19-9e8f-0df3a1fc87aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343893, "uuid": "222ef681-4e3a-438a-a8ad-a7b26a4b633d", "value": "7d8067aaa58462c0e0a8e05ce4dad814a536aa11a4405de2a8d4af3f44f9540a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2266a268-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366979, "uuid": "319e55d6-b92a-4489-9911-95fefa3f0a9e", "comment": "Malware payload (Mirai)", "value": "cb6ceee4e6a8bda7348a114486f126cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366979, "uuid": "9ab9a34e-709c-41ec-84f9-94c2d2928656", "comment": "Malware payload (Mirai)", "value": "7dda7e72a666dfbb9a28379b9bf02465dd867a45de1e21c27f7d75303486f390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366979, "uuid": "88bea585-575d-4166-b131-e50e3e992dac", "comment": "Malware payload (Mirai)", "value": "79cf43c66de265b17a041029c8c09ab456f5ddb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366979, "uuid": "68956084-24d5-4dc4-a391-f9cf3d38e43e", "comment": "Malware payload (Mirai)", "value": "a377b968b6e1ac404f445cae148265e96cdd1c9ab6145a393f5a6b0369d4df811452f745c21d13f817e8ef0ef177d517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366979, "uuid": "0e965e7e-c181-4a70-85cb-e769bbd5f5c9", "value": "T134739409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366979, "uuid": "e660c1ba-7c24-4c1a-9c81-fcac460e92b7", "value": "1536:zJPEBmW5iNWqcGTqwnXHZ84OqdZerEStd:zJPEB8NWq9vqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366979, "uuid": "f636c73a-3153-4fe1-98fd-789484b051c1", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366979, "uuid": "8a0519a8-9ec4-4a57-a7f2-9808ed3f7a37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366979, "uuid": "cc75c102-06f5-453f-9833-3ad6704c8c97", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c331bd-279b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774368560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368560, "uuid": "fc83d6a8-636a-4da3-819a-7787ce82e1b6", "comment": "Malware payload", "value": "0b3d5601d4a580e54c7383164db526f7", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368560, "uuid": "40b5def9-9324-412c-9bdb-a8bc38f40776", "comment": "Malware payload", "value": "7de60d28f2c76bf9b0f2d792f0e2a7a7453e9717f4a9a6684ebff703d0240b58", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368560, "uuid": "92d81223-7ca2-4c59-9ead-ab5a0a3f3e96", "comment": "Malware payload", "value": "9b4a694ff982dfa2c5ebd79b403e3019d521bc14", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368560, "uuid": "dea9cc74-0e16-42be-a9a1-fb081604f817", "comment": "Malware payload", "value": "9be503dac7b7cee08175deeae55019d2bf7f5ca620d2aa21d0f0a5d9be57012c8d2cd315be33743cae96814ca15ca085", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368560, "uuid": "7c82c3cb-65ef-4d34-b7cd-5d41378155b3", "value": "T1D4D6AF203599660BED7E9BFEF997B8940F7AA2E2D7C2D4FD1842028D4591F00B91352F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368560, "uuid": "9952f79e-acd2-4631-8ddb-78b3a26471ee", "value": "196608:3SXG/4Mh5st4kdYsa/oKSkHT1o7DAKKgZw1EDdUy9U5Db0aeh:KG/4t4kdT3kHT1onAKKAnD635Dbkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774368560, "uuid": "c0c32a3c-0191-4312-948d-14df4d551d82", "value": 12690944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774368560, "uuid": "efd19afc-9994-46ea-be63-d4d8d8f4af9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368560, "uuid": "8370403a-8f38-4376-90de-3f85b67f948b", "value": "7de60d28f2c76bf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55318882-275f-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1774342582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342582, "uuid": "a8eb572b-615c-4e98-b778-9a00f319ffd2", "comment": "Malware payload (StrelaStealer)", "value": "3c4112a19fe87b0a372894f6ddcdcd92", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342582, "uuid": "08c6e9b6-29bb-45b8-82a7-1d2823aa8625", "comment": "Malware payload (StrelaStealer)", "value": "7e8b9bcb0dba0271ad431077219b073584aceb075b131f49f652e9312de7880f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342582, "uuid": "d57e54de-65a3-422a-afbf-fa8f3c007e05", "comment": "Malware payload (StrelaStealer)", "value": "bce5940bf4e2061a7f34c422110e5843c78682d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342582, "uuid": "8748b63d-0add-48ff-9625-aff8061ef3c9", "comment": "Malware payload (StrelaStealer)", "value": "3265700b1c95b62e2a89d68d32a6d7eb7f3e8bc5bd99e5796355b9619a0cd3ae7d9fc2aec7b78b1fc8a9893247f2aef7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342582, "uuid": "defb90b3-e6f3-4a20-a3fd-b08309a3def2", "value": "T1A874494653F98508F5F34F88BEBB64610E7BBE6A1D39C02D25A8140D4AB3E149CA57F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342582, "uuid": "89a09909-a5d0-4495-bfe6-5cd79fe466ef", "value": "6144:YTJzhkCgs/yOZDxwVSoBr6qS2W4ceV09Wna5F63QjVCYBvRFemjJ7efW:YTphk9sTSUoBrK4ceV0oaAQnp9ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342582, "uuid": "58a02708-b4e9-4245-8caf-eb168d5ba4b3", "value": 352244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342582, "uuid": "71f7e6d0-6d57-40bc-8c85-0e67d332ec4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342582, "uuid": "70cad86f-7f17-4ece-b79a-dafe2440b1a6", "value": "2202031HBL 2ND UPDATE OBD BL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cbb844-2793-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774364942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364942, "uuid": "701bde68-6966-4a53-8360-ee36ae273407", "comment": "Malware payload (ConnectWise)", "value": "52f0983a6585bdbf6f5439732d715da4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364942, "uuid": "fef5f482-4a6c-4041-b668-c29cc982da7d", "comment": "Malware payload (ConnectWise)", "value": "7eb15c054850e45d9d377c493a39d7bddf50b9548600604c2f1db8bcaeb3e3e3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364942, "uuid": "4b74740d-8310-47b4-b6f4-976808eb20af", "comment": "Malware payload (ConnectWise)", "value": "40dea585a9dd6add8973c0213a2d20ee109c8d90", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364942, "uuid": "bc3f863b-8127-4c6b-9da7-2ada5015a5e4", "comment": "Malware payload (ConnectWise)", "value": "7e9c15cdcb72d2182c927ee558f7a9beb90b03c46a01ad3cf7d418e70d9637d1b9f8bdadb8659cf22a78c0e6a7c89cdf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364942, "uuid": "511360f7-caef-4569-908e-d908e86eba99", "value": "T193D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364942, "uuid": "503a2e0d-84ef-424d-a850-20294ad47b01", "value": "196608:VHxcp9ym3nltDUJVZHxcp9ym37Hxcp9ym3GHxcp9ym35Hxcp9ym3WYHxcp9ym3W0:HGplpeGpFGpUGpLGpWmGpW5GpWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364942, "uuid": "9b1881fb-3256-4deb-9803-97f35702abee", "value": 13524992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364942, "uuid": "5ed81f9e-bdb2-4b8f-b59a-578f60a83428", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364942, "uuid": "aa41bb10-a003-485b-bf6d-7b3902037e64", "value": "Agreement.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17171532-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343337, "uuid": "15a092b3-402c-41b6-a9df-de2cdb383d8e", "comment": "Malware payload (AgentTesla)", "value": "fb4c93e7a23dad01b09bc71928005ecd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343337, "uuid": "fa12c1ac-9258-429f-915d-e775194bc65f", "comment": "Malware payload (AgentTesla)", "value": "7f2797e834c51fec5c87555adb74eaf65614f713ba3577b106e5b104bd791d60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343337, "uuid": "5c89203a-9031-4c7c-b2f2-df7f142d219f", "comment": "Malware payload (AgentTesla)", "value": "ec9cc9b5ddaa83433488a4e6b5eff3e33b24895c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343337, "uuid": "3de0f564-d70f-4e06-9713-9a7e1f7b0f26", "comment": "Malware payload (AgentTesla)", "value": "05cc1ad903486c96a9b7e952a61331c452c84f1d8189af0dcedc12ed667454d068ff05e4f9432ef0d40511ab9c0cca41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343337, "uuid": "d542beba-fde2-47ab-9765-cf1dbd0e7ef3", "value": "T1BA843A60D930159A4F4367DEFC650672CEBC8B256A3B45B5F2C9030E51099ECF3BEA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343337, "uuid": "cbbd96e7-c514-44ee-82a6-a972cd68878d", "value": "1536:XxyI1xyI5xyIboXHWxyITxNxyISxyIboXHwxdxyIbrxyIYxyIb4xgxrxyI2kxyIQ:QHGHmHly1HlMIH4Hltr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343337, "uuid": "22163f78-475c-4764-af27-d60e126d34a6", "value": 382106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343337, "uuid": "2c5d8afb-d4a8-4673-ae4b-840773f16074", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343337, "uuid": "e732a5e8-632b-4960-a492-b8d183c34690", "value": "fb4c93e7a23dad01b09bc71928005ecd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed4b199-27ad-11f1-a769-42010a9c0008", "comment": "Malware payload (LazarusStealer)", "timestamp": 1774376341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376341, "uuid": "066d0131-0ea2-4f4e-9ecb-2d5dbe88507f", "comment": "Malware payload (LazarusStealer)", "value": "f672434fdc93010dbf37e80004e627d5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376341, "uuid": "8fd11753-496e-4540-b198-dc38fbd372a7", "comment": "Malware payload (LazarusStealer)", "value": "7f69d97eb87360953ececb7d8cce0bfb175910b74fd9f139932086b260aa07b3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376341, "uuid": "1df40382-c11c-44d6-a532-c5118747e1d0", "comment": "Malware payload (LazarusStealer)", "value": "b4e29daf5061922d38d23dd8f81465d7268cb56a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376341, "uuid": "ab111d80-d6da-4694-b06d-ea3828aee0db", "comment": "Malware payload (LazarusStealer)", "value": "72b14f057998c56b4d4637959b5d31c61d4c9ae54072e50f7b52f7e74ebccd27a658635983dcc2526f4ac8d75e8222ab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LazarusStealer", "colour": "#821825", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376341, "uuid": "187ef676-03c8-4ec7-bce2-b5310cdc7bb1", "value": "T11A069DDAE7C5995EC4F74336C93A56E1150B4C26CB43DFC3A919323C29BB6D00E4AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376341, "uuid": "06f4882d-ddce-48a7-892a-0dd43e27757f", "value": "98304:vR2Z/dQVwraR4ADqCvcNxo2wrct9BCaoTwrHs1xjSdU:I/dQarG4acNxo2wruqp1xeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376341, "uuid": "97bef054-a68e-4a4f-8d20-cad58ab10afa", "value": 3756780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376341, "uuid": "73add1b8-b425-4b17-9cc6-dbbadda88db2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376341, "uuid": "085a4f04-03db-4c51-8b6f-cb36f59cf853", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87da6a9-27ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774381833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774381833, "uuid": "ad605113-3575-467f-aa6e-f2ac9aaf25c3", "comment": "Malware payload", "value": "aa526a8d5c32aa9a5722575efbac8f8c", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774381833, "uuid": "781307ac-7724-4e57-91c4-ada326af2a4e", "comment": "Malware payload", "value": "8040da63a8f5be3fec9724d6d6e6f101f5336d99be309bf0b7cd781f12aace15", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774381833, "uuid": "a133ba3f-597d-4315-a1b7-72f69bc7e108", "comment": "Malware payload", "value": "b1ce44d4dc11bbe1a002b8b7e9ced44a0764c57f", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774381833, "uuid": "9650d103-e4ac-4e8a-a010-e8098783437e", "comment": "Malware payload", "value": "328e5aaca36313b13214f3646b61c0c04e6c51f14b8b0b7c231487bcaf6d4f0f14ac9d93c3a2d62035ea2cf37591c8d7", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774381833, "uuid": "fd4fb66d-4112-42d7-a04c-fa56f4f60c35", "value": "T12E1125234E2404DFD49BC1B3CE46BF85B099A63EE46517C5706650E2A07F44D27FC564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774381833, "uuid": "d60ec3cc-a4d2-4f6d-a9f7-ecbce9400c50", "value": "24:9AhwfNJLFewfk6P0UaLetScevdKuSljglM23yojHdbD7JcMwfNJLFewE:9rfNVLQLBcuJS1giSyqdbDlMfNVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774381833, "uuid": "56181b7f-3af4-4078-906f-289e80535ac2", "value": 1012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774381833, "uuid": "69f212d4-6882-48d0-9daa-7ef1d4544878", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774381833, "uuid": "f261c6da-8e06-4bf0-81d1-c72c0eb288f5", "value": "\u0424\u043e\u0440\u043c\u0430 \u0437\u0430\u044f\u0432\u043a\u0438 \u043d\u0430 \u0433\u0443\u043c\u0430\u043d\u0456\u0442\u0430\u0440\u043d\u0443 \u0434\u043e\u043f\u043e\u043c\u043e\u0433\u0443 \u0444\u043e\u043d\u0434 \u0423\u043a\u0440\u0412\u0430\u0440\u0442\u0430.txt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bde3ded-275f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774342701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342701, "uuid": "a5fa1f82-f884-48e5-b4c2-8f0c032329ab", "comment": "Malware payload (Mirai)", "value": "eb3fe37dca5f3f993c221b174736e4bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342701, "uuid": "03d5eb90-0418-4fd8-9cd3-cb8b554343c9", "comment": "Malware payload (Mirai)", "value": "811ff4f27b533514bf285a56cfc9d2dce5f8bb8be61a1f06e6395f5481820ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342701, "uuid": "0883aec9-058f-48fa-9aa0-4f97855fa30f", "comment": "Malware payload (Mirai)", "value": "a256f780a7da803afd888b8a51ec438ad5696a51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342701, "uuid": "cd8a5220-4f92-4a58-9c0f-c15cb109dbb2", "comment": "Malware payload (Mirai)", "value": "8a28b124bf7c9bd4c84b0bf073ba66acfeba2662619f202cecbbead2bf6561c244d66a041893620662c87356dcde49c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342701, "uuid": "7276baf5-d51e-47f9-9d66-cd7d0ae6e80e", "value": "T11FF3C70AAF510FBBDCAFDD3702E90A0139CCA55722A53B763674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342701, "uuid": "1445badc-68cf-4900-bafe-2d5eb24301f5", "value": "1536:hR3ynCmOtuIjSdAR+B+1L6JePXxc20gw+nz+K5NbPHSxGZli/jCl0ByzIotQR5qi:6CmOtuIjgBqLrVNToGTuAzqR+db8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342701, "uuid": "d1593a65-de9a-40d9-931a-9d30b3735588", "value": 170655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342701, "uuid": "44b7d38a-4e27-4904-b9ce-5fedb1a1c4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342701, "uuid": "d248483b-771c-498a-88ce-a2126f8bd571", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bb9a9b-278a-11f1-a769-42010a9c0008", "comment": "Malware payload (BankBot)", "timestamp": 1774361156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361156, "uuid": "527e0a2f-9fb2-48b7-9841-faee74ef253b", "comment": "Malware payload (BankBot)", "value": "6afd1e9c4c4e7a4a71c0202c21e2a6d1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361156, "uuid": "494379f8-1f08-4a30-99e7-b85232a1a3b8", "comment": "Malware payload (BankBot)", "value": "8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361156, "uuid": "e038ea00-e686-46dd-b9e7-a133b42d83e1", "comment": "Malware payload (BankBot)", "value": "a4c701f9a4cb0926b5461965f426887ac09450c6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361156, "uuid": "95aa0968-1b5d-47cf-8055-d23639876b2e", "comment": "Malware payload (BankBot)", "value": "31bd6659c31218b404c0ae9c82ff3b29f3d466ea1808946f02da78af94278bc948c04afe9e6624e30c2d304f26ce96ab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361156, "uuid": "86859277-9b34-406a-a51c-0bfe97405b5f", "value": "T156B5F045BBA89F0EC877D1360C4A5232641AED23CB53C387D9746B5928AF6F44F113EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361156, "uuid": "246c8275-4e12-433d-b468-276d29ebc532", "value": "49152:HkcaH2THvo91hLMCjXfZHBUJacfZe9lLh+hQi98cy5O:ExlfICTlIa8M9lt+aK65O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361156, "uuid": "eb3c808c-5b14-4b2a-87f2-35dabdfce489", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361156, "uuid": "a06fd537-c9d1-486a-b821-f4c9bd3bbf86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361156, "uuid": "a88ac8d3-85ae-4792-8e1c-e350d7254787", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9234dbb-2799-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774367768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367768, "uuid": "2ec274f2-5bac-4cba-80f4-62a38655f193", "comment": "Malware payload", "value": "fd76b80bd455b6593d8fd47a93ce8fa9", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367768, "uuid": "2a5d8ac0-1672-4bcb-8811-ee0c2110a605", "comment": "Malware payload", "value": "81cea50441efd7505de6333ff8fc9a17769c0c508d9a3e3a84fe3a3ebdc734bd", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367768, "uuid": "ee8bbfc5-fac5-4b1c-aa19-84b8de2d66de", "comment": "Malware payload", "value": "9b768e298ae901c3d459c2d1ff927a086ec15f88", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367768, "uuid": "7fa94450-31f3-41bd-8d4a-8a8b36cea7dc", "comment": "Malware payload", "value": "72193ac4b561b2c3420c66ed07e5f5c89d159109a16517459502b51af9a007451e540ce6341848149a435d79cf9d7661", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367768, "uuid": "ecfe16d2-9e71-443c-80a9-04fea3bf1a34", "value": "T15F551254328CD813C1EB4AF45B25E0BA03B41D8AA865D79A9FDC7E9F39F3B602944353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367768, "uuid": "6d52e7be-005e-4c3a-864c-10cf2600f319", "value": "24576:yCi/xXIDU8cq9c41Rv5dqfmpMC6X9zr/YgcKbh7LKvAAgEjMJKn:yCuFR4PqfmpMC6X9A+Cvpg+MJKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367768, "uuid": "84b15a6a-b6c3-48d4-9cb0-68a0d5965d58", "value": 1393152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367768, "uuid": "85da5585-2ee2-4b64-904f-35a1eae173e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367768, "uuid": "bb9c2252-f50a-4cab-a328-cb4c9e98a7a7", "value": "81cea50441efd750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e145303f-27b7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774380613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380613, "uuid": "ec790df2-6b9c-41da-bf10-e6bcd71c1ae7", "comment": "Malware payload (RemcosRAT)", "value": "aece7021e467ca6207bfbb993cc27793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380613, "uuid": "0263add5-e048-4dab-b400-be891f7ee778", "comment": "Malware payload (RemcosRAT)", "value": "830f766427911880fb8b8eb56bbffd74fa5ed81a332da2080bb688acfdb26197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380613, "uuid": "a213a657-1aec-4f23-a2ba-af41546af5f9", "comment": "Malware payload (RemcosRAT)", "value": "a7134bf247aa74deb7043ddd13760d1e7cd72043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380613, "uuid": "cb3a2d20-a5e1-4087-aaa0-c78a816a85e8", "comment": "Malware payload (RemcosRAT)", "value": "8c5409eb59c0a380854154f6d20d7f0820e949ad1f7ba2a566cca9ec325905ff4787c2024e524da2650ca66077836d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380613, "uuid": "76f547f7-93dc-43bd-be21-0daeb497029d", "value": "T1E8C47E2564014041CA0F1F71B26D97A67963BFBA297CF21E6A3AFBD522F32C2D13614D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380613, "uuid": "1a6f13b1-0153-4329-b85f-dde150af04a6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380613, "uuid": "7ac4c9a6-035b-4d48-9133-de7016e28c81", "value": "6144:HYa6eJsYMZ4YdvJe+meKeEaOsfEqG1PQiWMbaggYK3gMBh4Mn:HYEJsB4Yxm7jSfEtJQd0ag1K3gMBh4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774380613, "uuid": "c5c09a02-f40e-47a4-844c-d15fcf8e815d", "value": 548240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774380613, "uuid": "c27a7a06-7e86-4bca-92f5-fc9aa2241b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380613, "uuid": "56cebc89-369f-4409-8140-8d969b01d1ce", "value": "rVMACCORD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f538c9-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1774343225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343225, "uuid": "9f418a5a-b60b-4e3b-b368-fb6e121c79df", "comment": "Malware payload (DarkCloud)", "value": "dfa79d02feda6afc88c9d6f09ed85a0d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343225, "uuid": "d19d02e1-86b3-48c3-98f3-aa3a93f585d3", "comment": "Malware payload (DarkCloud)", "value": "832dd153448dd6369bb6a80225a9ab420272f54eb51e2ab91e5c6c74b2727cc5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343225, "uuid": "8f1c6a74-ef46-4537-81b4-895aed5912ed", "comment": "Malware payload (DarkCloud)", "value": "a2dfc55d77291927c85f14f01cce13d0c8b721a3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343225, "uuid": "69db279d-6e25-4ec8-8885-f2527e139fd7", "comment": "Malware payload (DarkCloud)", "value": "bd387ce4948acc7051e722e0f9a475a7a6e12dccbac865b538f61a05cc26dd72042df2f4372c63b599561ca7bff5103d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343225, "uuid": "2de38f3f-2a21-4e95-86e6-b3dacdd16fad", "value": "T164D59E19D980672C859D363D00FF32B9F3B48E2B6C574D8CA41DBECEDB7D604854A68A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343225, "uuid": "2344cc77-1355-4e8c-bb55-3f5ea03bb4ad", "value": "24576:s1VSCOKbIDmjY4KM9Po0+NPLvEjciIyD2tZOowmBIPZZCeFjBi0QeIIdMXO3vK7S:PCaDYYMYuOJSHH846g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343225, "uuid": "0caa70f0-d0ef-4755-a314-09373d402776", "value": 2748136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343225, "uuid": "d9432fad-f887-4ac5-b99e-30b781e41a33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343225, "uuid": "ba7ee3ac-8e34-45f1-af27-2915dc412374", "value": "dfa79d02feda6afc88c9d6f09ed85a0d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d031f5d7-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774343218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343218, "uuid": "a1ffe9f7-2999-4d56-9ed1-0836fd7e9da4", "comment": "Malware payload", "value": "404447653fb7069ae32d336cc1e87103", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343218, "uuid": "380d953c-b097-4ac2-af93-b0634f2a743e", "comment": "Malware payload", "value": "83abd33a7bf5efc817c1e786f0d424e4232e8558eec4c1ae3b5791753dbf6977", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343218, "uuid": "cdf3ccca-d47d-4e73-a274-5a9269e098fe", "comment": "Malware payload", "value": "ab46d7b16cd668e633971c191b0b02692945c96f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343218, "uuid": "13d929e6-0273-4625-8869-3c4699e739d2", "comment": "Malware payload", "value": "3e3f4cdb0728c1e07071545ff4d93eebc2d52316225a5e1cb04386d7e1dc45befb1ff42c93d516cc4826a7724f35b59b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343218, "uuid": "7234b9f3-4e00-4991-8a94-bc75f37f8f65", "value": "T155646B0353FA4558F1F78F88AA7B80A14A77BE965D38D06C12AC140D5AF3A14D8B67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343218, "uuid": "06a3776b-8371-4d10-99ec-b1bd8572a097", "value": "6144:qt2kFIY/O90Na4J9ORzGJ4c4hkw8tL+HSjmYsy9KLSAaBIsuvj7jRnft6zRxam4:TkFXOmNbORzGJ74P8tL+HSj1zKL3Tsuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343218, "uuid": "cdc1484e-d750-4717-b668-c76acf6bbf47", "value": 312854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343218, "uuid": "857308aa-34e3-4a45-9b6a-70487c15bcab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343218, "uuid": "3e6c6c09-b389-49a6-9f85-025775f7232d", "value": "404447653fb7069ae32d336cc1e87103.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed992a0a-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343268, "uuid": "c1d5c6b2-9772-41cc-b7e5-ff123bafd144", "comment": "Malware payload (AgentTesla)", "value": "2fb0fca94dcf679c80e65c819d99dc54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343268, "uuid": "a5f89a7d-3c58-4c51-b358-f4036a8e51fe", "comment": "Malware payload (AgentTesla)", "value": "83b7231c044e34441f53bdec617ede0c303d20e65d801f578a8f7ce35c38fa45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343268, "uuid": "e5eaffac-55e9-47cb-abf7-f63540e1c80e", "comment": "Malware payload (AgentTesla)", "value": "0b0b5186483642799a167453a0cff0abba921dc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343268, "uuid": "95ea1f55-fb5d-4c38-9c63-884654b4f482", "comment": "Malware payload (AgentTesla)", "value": "4d7d26c3a7403991dac05d73e400075784d6943bddbd07a72479bc5dc120f37f1e2358f7306c7e246cd8268858d3b800", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343268, "uuid": "6179e8ef-4650-4cde-9b01-d64563c9371a", "value": "T18C842960C930159E4F536B8EFC6A0772CEBD8A196A3B45B1F1C9030E51065ECF3BE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343268, "uuid": "13d6c3b8-59ba-495c-aa01-793c36685887", "value": "1536:8xyI1xyI5xyIboXHWxyIKx0xyIOxyIboXHExkxyIbAxyIYxyIb7xRxjxyIX4Uxyi:THKH4Hlwu1Hl9HaHlr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343268, "uuid": "086c9ac7-4c48-4254-a072-24749c30b146", "value": 381530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343268, "uuid": "d67404bb-47ab-4264-8a77-f28e9c3d56a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343268, "uuid": "7aa941fd-9d9b-4fd4-993b-51b485dcfbb2", "value": "2fb0fca94dcf679c80e65c819d99dc54.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27db9dc6-274e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774335205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335205, "uuid": "e1c8abb5-384d-4159-9d5e-6e7e30fbed0d", "comment": "Malware payload", "value": "3541bcabfce1fad87489b25190425404", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335205, "uuid": "898fe073-5aec-4ea0-acb0-f00422c3bc90", "comment": "Malware payload", "value": "83ba84c9231c9c03dc58d8e1cf15a67d4d7924923f63dfc5576a322cf237e93c", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335205, "uuid": "053d79cb-9212-4c72-b9a9-0bb2edb73937", "comment": "Malware payload", "value": "d7eebfcd8f74a41a4745ed911208f187401ebf94", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335205, "uuid": "1f9c3813-7d16-4a41-b680-0ae6016f7d79", "comment": "Malware payload", "value": "f16d629c335468aef9a33d2e6657a09a8429a7b751beece9e131a5d3e39f9f01992f1a7d398852e87f0d2760f72c3378", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335205, "uuid": "0aff75ae-17d5-4ded-9307-a998ee514dc7", "value": "T15EA21E3EC984DFF0072A31A1A56F7A1695580367B8342A4DBCCB85AD3B36650CBF10ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335205, "uuid": "3e54b59f-c30b-437a-9279-d5d4c02403e0", "value": "384:KnCzRzFkmw92BOorQcDmOO+KrXZcIcZD4XmYhCOfHVZaUJoHTmK1X1Q88lNWo17F:KnnvO/XDU6pZ8mYDvcHeio1w3CFOf05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335205, "uuid": "a2f0e121-cc28-42de-ae1f-7ba0d2b33ed1", "value": 22090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335205, "uuid": "fc9b4a21-bb7b-4ea4-a3a4-b7cc800fb9d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335205, "uuid": "a0e9bc5c-b89a-44a4-a695-d58e86812c71", "value": "83ba84c9231c9c03dc58d8e1cf15a67d4d7924923f63dfc5576a322cf237e93c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305ffd86-276c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774348104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348104, "uuid": "c90bee39-bd09-4826-a645-f0dba66ea317", "comment": "Malware payload (PhantomStealer)", "value": "250ef78954ffb418e4bd8a03cf3c06f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348104, "uuid": "f01ea273-b190-4cc2-bc85-935b14144c28", "comment": "Malware payload (PhantomStealer)", "value": "843927268c04f1c791bbed033576d07133d25b45c04efe7e1e8b4a0c8034bbea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348104, "uuid": "f631fd83-4ef9-46fb-96b8-b2582585d21f", "comment": "Malware payload (PhantomStealer)", "value": "994beacf6465ed9a70324b9c6f9c41b26a61f75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348104, "uuid": "82b18111-2f0f-4916-9dcf-09c5457c4778", "comment": "Malware payload (PhantomStealer)", "value": "1d94421dd5a8ec6841ccf8e0225f829bdd8f888c30c1678f7a7ea0fff28617dd44822ea3f3712a9f1f26a3e1bcea6f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348104, "uuid": "65957d17-08f0-4a25-99be-a7da2dc97762", "value": "T1B98501055D422B98DA3E0B78C06718A8F7F0C947A3D7D79E3FFC01B459A77A8CA49942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348104, "uuid": "2b30e751-6ea2-4030-aaa6-f8268202591b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348104, "uuid": "445c8e31-8b7f-4d7d-8a3c-608667506387", "value": "24576:RMc2XPavYZOaO2va6R0/eS9BrVXqI+QRM:y0vwpO2va6S/pVaIlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774348104, "uuid": "68c0a373-39dd-4dd2-b28c-f95488040ef0", "value": 1739264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774348104, "uuid": "adae2027-a832-4a9e-baa9-311ad1d5fc3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348104, "uuid": "a9d713c3-4468-4a1a-9c04-d18136c620c6", "value": "Payment_Advice-065789456.(~134kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6ca2a1-278e-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774362778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362778, "uuid": "f4ff1f24-58b9-4df3-800b-b837f5fd683a", "comment": "Malware payload (Heodo)", "value": "14e87a422a88f6997b62f133c265085c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362778, "uuid": "c4a7a312-0485-41b7-bf32-784802d90bee", "comment": "Malware payload (Heodo)", "value": "86a5b8ece539b7a3093df6a734ff25f2ff3803096be2fee97d14d0c605fbbedd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362778, "uuid": "c0b25f34-6429-4f37-b907-e2e283ca35f0", "comment": "Malware payload (Heodo)", "value": "f4bacac40ebd14e13751609343980e462e909325", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362778, "uuid": "b7d3b539-1f82-42ae-bbe5-94dfa2dd3a2b", "comment": "Malware payload (Heodo)", "value": "6a547fe4290051f37399feb652e345ceaa8a71b8de264fbb5b965f16c4ac98f02beb3171b8bad4a809d094c18373d65f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362778, "uuid": "fe2986fd-b344-4428-8ee5-b3caf566ac0f", "value": "T19C43190FB582E8B6EDA854B473DA123C0867C5315B037ED38BB034F94D729DAA57285B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362778, "uuid": "5cb6a3af-9125-4add-bd3c-8d3b4420911b", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362778, "uuid": "d66bfce6-40d9-4e6b-af8c-5c1dfc039668", "value": "1536:AnWbX1fFFbQcYNWvSA8fnGxWw0c6upOR:nX1fFFbQcYMvAGxWw0c6ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774362778, "uuid": "fd2b5547-0534-4619-bc8d-ffdaba0cfcf4", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774362778, "uuid": "14b07fb0-cfc0-46da-9373-8390399f622a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362778, "uuid": "0b4237ce-1211-479a-8508-dc6975457d37", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9873aa-2795-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774366053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366053, "uuid": "2c895e0e-4af2-46f6-8dcb-5572337ee349", "comment": "Malware payload (Heodo)", "value": "8f8859705a2bb27553648322e8342912", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366053, "uuid": "094bed3a-cafa-4d0b-a73c-e6064d0d8d47", "comment": "Malware payload (Heodo)", "value": "89f57920aba3461bc035efd5678cc9e09b8fd36f2678c2ec326e3abcfac53d0d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366053, "uuid": "fb9a6631-53ae-4738-a68c-90121b79cf87", "comment": "Malware payload (Heodo)", "value": "4ee84f2b16704f2ea6413a82b64c8820825feebe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366053, "uuid": "ba889a26-b329-416a-905f-d5a7faf52783", "comment": "Malware payload (Heodo)", "value": "a208a50f4aa8cc67ad3ec08f14a25b528b191151b4f5a3ba70f82352dbe38e18e10fdb9ba8d7e21fe3ca745db3a6f13a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366053, "uuid": "8839370d-090d-41a4-b02e-ea7d65248df6", "value": "T148432A03BB81D8B7DC5E95B952CAD59A2A67ED3003071AC383B334B31DB2DEC54B4989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366053, "uuid": "2512c18d-3dad-4e2c-b90b-b3c4dffb9bd0", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366053, "uuid": "5c643e9c-b217-4dde-b2fc-b9c4f7e39298", "value": "1536:tnW6+MPwg0GwVdaT1mgojaAhB3w7EHEFkb3iRPd0bi:qGhBmge30p2Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366053, "uuid": "f14e4d04-b9b1-4bcc-aff8-2791c46450af", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366053, "uuid": "1ece24f2-42ab-4121-ae09-e0c79e0fd850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366053, "uuid": "020638aa-a43f-4d4d-8c85-65f401dfb652", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8ee082-27a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774374055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374055, "uuid": "73f0195d-774f-4b98-94aa-a19cf8970ace", "comment": "Malware payload", "value": "85ed77a21b88cae721f369fa6b7bbba3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374055, "uuid": "30a5fe0e-3a32-464a-9a65-77cdbd91d427", "comment": "Malware payload", "value": "8a2a05fd8bdc329c8a86d2d08229d167500c01ecad06e40477c49fb0096efdea", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374055, "uuid": "014ee35f-0044-40a3-87d9-56ab3ecf0cd5", "comment": "Malware payload", "value": "b20aa5b6c1f01117993287edad462cc49f588b39", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374055, "uuid": "7adb8a52-9a35-4c73-8ffc-7551d20cd467", "comment": "Malware payload", "value": "3568cf799213b54163182240b2afb942468223db95c659e859a435fa4bfbd6a0e68ae0ea3978387465fce3d354d8a7f5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774374055, "uuid": "5498e5df-ef3d-4003-80d8-b1637862d8fa", "value": "T1EA073363F487209F25A72B362AC79FB8F7D6A067394A6568090D3FF27E770005B18197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774374055, "uuid": "786af490-1a3b-4b8c-85ce-e931e3f3b916", "value": "393216:KIDL2d7JtDAIrH2LIGEaFIOZ0xeUQa1Zh67OCq2Ewp/+s7mwhIHHyD:K6L2d7JRvyDE4mMKKEwpbmCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774374055, "uuid": "10162b6f-7540-4115-a074-858bcbe6ae6e", "value": 17383897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774374055, "uuid": "b6e55ba5-0217-4805-8c8f-8e065230f5f5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774374055, "uuid": "1422907d-1c6c-4940-8a4e-4f7ee16f4516", "value": "litellm-1.82.7.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485790a4-2778-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774353298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353298, "uuid": "8e9b4c07-97e1-4379-8127-78a97b9e87d4", "comment": "Malware payload (AgentTesla)", "value": "618848b675dd36627ed562c4a18ae436", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353298, "uuid": "6c723251-f4f0-43da-8d71-44894c330bc1", "comment": "Malware payload (AgentTesla)", "value": "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353298, "uuid": "4141e519-9d8f-4065-af1f-a4f206af8a34", "comment": "Malware payload (AgentTesla)", "value": "b446d05ac0c73e12c9d8ed9e463a3a4269a70621", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353298, "uuid": "b0faaa57-5f9b-4cfb-a9f8-f4e510fe2af4", "comment": "Malware payload (AgentTesla)", "value": "d6c298b4267822ece82dc6abf243f7596ac703d7ff39f3b082b5b80670fc023603c4d69367e438471fedabd4c62c2df2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353298, "uuid": "b71fdab0-29d0-4028-9c21-9948cf411d96", "value": "T1D93421037E88EB15E5A87E3782EF2C2413B2B4C71673D20B5F49AFA514512926C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353298, "uuid": "68d5d1be-95c7-4ae8-93f9-e76e23abd564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353298, "uuid": "90c654cb-9f0d-491e-a9e6-1c782417a4c2", "value": "3072:aWb6lCe62aeHvsHvDyyyyyyyyyyyyyyyyyyyyyLyyyyyyyyyyyy9yyyyXT1R0ors:aONe62aeHvsYEEHZbMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353298, "uuid": "0d2f2d2d-e5a7-4a96-bf37-1eeaeb48e074", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353298, "uuid": "616e329a-e437-4994-8161-e807b52aa5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353298, "uuid": "95f866fa-c9e1-4bda-a2e8-e0821419070b", "value": "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c453c25-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358969, "uuid": "2da77ec6-c796-48ad-9075-5e7d6f08b353", "comment": "Malware payload", "value": "cb5c72814421594a6f8b850543934b07", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358969, "uuid": "9e4ef894-a8e7-42ff-8cda-01144a0fde60", "comment": "Malware payload", "value": "8b9bbbafe62e8e308ea144f3dc352fbaa9bd8c9e9aace50b250338b0255a398c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358969, "uuid": "e670d8e0-778f-4ad4-ab9a-3f34a978ab2b", "comment": "Malware payload", "value": "baee2546bb3193402ea6b972d6baa19b0d7e9b54", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358969, "uuid": "030c2cae-c582-4e6f-ac2a-3eac66ee92d1", "comment": "Malware payload", "value": "a2d7d633c021b96d6c0f0518c3ddc48d806ccf91368c59eaf395a872cd943720cfdc3833a936db446b786119950840be", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358969, "uuid": "9c4eafaf-1a32-4a32-9d21-3b19005915cf", "value": "T15C01DD1026EC1B24E3B69832C8BA6755493BB705CB35C72E019409CC6C11A46DE3EF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358969, "uuid": "8c18b723-fc77-46dd-aa47-146f773bd67d", "value": "12:8Mm8BlbQ4rUcqjANPafvqVxxDLRmnMGraQJhzPr+lo+GrbLn1Il6:8MXlbZ/WApyqV33RUMGGgzEQY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358969, "uuid": "23135969-07e7-4fb3-8427-e8d48f4bf653", "value": 765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358969, "uuid": "406eea31-0814-4d98-8268-8323ad0bdb9b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358969, "uuid": "2ff7032e-acc4-4c2f-83fb-1d6d412a784a", "value": "TM_SecPatch_v2.1..pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe41ad52-275f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774342866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342866, "uuid": "870fad35-1405-4bc4-8ed2-a61e30b49c2e", "comment": "Malware payload (Formbook)", "value": "1e721dbf1e2ad4849836c04a9416e1f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342866, "uuid": "ad852519-b5a9-48b7-9e26-fa0a26c31d2e", "comment": "Malware payload (Formbook)", "value": "8c6df6dfc227d3c6092d0a7197bf1d40c6599ce5e6a0ce6b186b94dadae77b92", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342866, "uuid": "e65edca0-e8da-402e-b4d6-4c5505fbfa3b", "comment": "Malware payload (Formbook)", "value": "a308336e3930ed2b25e981d4142403120faf7abf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342866, "uuid": "f74d3a62-71c5-4a82-bc4d-ce13dfde3c9e", "comment": "Malware payload (Formbook)", "value": "d20b3429387a4225810264109e987c995aaddb4d5c29f1ab3e0934b8b78ce4fe66af0f071167e0cfd4d6949335a00417", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342866, "uuid": "18918f0a-cacd-4d02-b31e-64a578994d91", "value": "T1FE66B069DDD44E584FFA7D10A4F918082BA056D9CBA4EC54CB4B7FA13BDA3094F1B0CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342866, "uuid": "15e9cc29-6fe3-4b0e-8776-65639a023597", "value": "49152:I8c4A567UBWevDaGxROnCTDtEb39Dm34cBZeG6uxIF1BwI6XRMRycoHgfl:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342866, "uuid": "88512e40-8830-48cc-9687-9d4404c09690", "value": 6984530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342866, "uuid": "f17220b6-2a9b-4b62-8a15-da2fdb9483ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342866, "uuid": "5f7b711c-4066-4b5c-adae-4f25e9c39048", "value": "1e721dbf1e2ad4849836c04a9416e1f3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027a0d09-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366925, "uuid": "324af4bf-a147-4930-b6ac-66bc967a119e", "comment": "Malware payload (Mirai)", "value": "d9418fc1818f490e48cad4e9e9651c03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366925, "uuid": "473d802f-e127-4954-98b1-8246e9c72571", "comment": "Malware payload (Mirai)", "value": "8e91b4ef4b79a7d4c490983cbac45b46425fb53fa9c11196f781c7cd8412eb4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366925, "uuid": "db9440a6-dda3-4e80-ac84-990ed01ef398", "comment": "Malware payload (Mirai)", "value": "286bdd8224bd66426905f21ec1b4947a16e3f12e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366925, "uuid": "fb45464e-ebdd-4acd-8675-84778ae54491", "comment": "Malware payload (Mirai)", "value": "63d9a667dc504fa9a226dd42dcb3f99e32adf9993ec872f3fc063400b37e0cc70facbbbb5ba3b2e84d3c9bfdc6b4f00c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366925, "uuid": "aaffc9c7-821b-4d9e-8310-59710b25bc73", "value": "T115A2E055BF1886CFC832293455D9EAD62256FC72F2DCDC096940C16FB4B33A95830F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366925, "uuid": "2134e0c3-dbfa-4fc0-899f-f6e6caa3de96", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkdaqOKV14b+502F2vwA9dWuMW21bAKj:798o08kxofBE+ZkdaqGbp2F2TWul0c5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366925, "uuid": "0fa14e3f-c1f6-4a51-b836-b06bab543e6f", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366925, "uuid": "86098e9d-62a3-4a1d-815b-d005cbf43b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366925, "uuid": "fa23d123-17c4-4d8f-97ed-ca31869e1b3c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35706946-2779-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774353696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353696, "uuid": "e4bb9ded-d8c2-43a7-90cb-de814fc78dfb", "comment": "Malware payload", "value": "96a9321deca6717db13bd5db8d3abba5", "object_relation": "md5", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353696, "uuid": "093a5285-1ca2-41a3-8e3d-929690c9f633", "comment": "Malware payload", "value": "8eacfb5579bb5b8a2d1190ad54d3cccb5a26fcf507bb380ae94e353bb69de8c6", "object_relation": "sha256", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353696, "uuid": "5a1f17ad-a63f-49b7-bcec-1c105948518b", "comment": "Malware payload", "value": "f7e389fdec8b8e7a7991b620b671c55abeec5648", "object_relation": "sha1", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353696, "uuid": "fd05c864-a483-48d5-983d-ffc9b9b6805d", "comment": "Malware payload", "value": "086685f5bdeafb9a8feae8cd570a940a776eb9be2ff4cecb664dcc26ea92abbdaeccdd2720b8121c00e44e10467c0aa9", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353696, "uuid": "768c13bb-6032-40f2-8374-5ef0ecd82c79", "value": "T1F3D3B338BF75EBF4C26AF1B854823B33D99C59125961BA74AC9D7CD83E713004E2C19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353696, "uuid": "4965b0ac-f6d7-4cfb-9ec6-c8689249a036", "value": "1536:wq9flZTx/70mx0SzbZbODuZOCmuS3W96Dis2G:wATd3EugLFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353696, "uuid": "0f743d8d-0afd-440a-94df-62f6f96fcde5", "value": 130696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353696, "uuid": "dc744cb2-c83b-48e6-83bf-e4e3306ecad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353696, "uuid": "96d3815f-85a0-4af0-888a-da6ffc6f8ac2", "value": "8eacfb5579bb5b8a2d1190ad54d3cccb5a26fcf507bb380ae94e353bb69de8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae5fac3-2798-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774367127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367127, "uuid": "6b89e128-ac37-4eb6-ba27-1e754dd375b2", "comment": "Malware payload", "value": "6852ad30c5d72a094ccf1fbd4a440bf2", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367127, "uuid": "0b1a711a-b455-4071-899a-0404ebb8a4c0", "comment": "Malware payload", "value": "8ebda871e879de7e734ba2a25432cf82121fe3597d94ac625f6e7f6bd25bf1cb", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367127, "uuid": "cada56df-9541-4840-ba8f-042c0e9bc21e", "comment": "Malware payload", "value": "dac8075f6e9d8c948934fd539561c6a1f1d4dcba", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367127, "uuid": "fdbf37be-5473-41b6-ae1b-9f93129d6277", "comment": "Malware payload", "value": "964c739e016abab63ffe25e88b305aa5ba72fda61725970788e33be6b414f9d5079090eec17cd1d5ee935408a8c7a59e", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367127, "uuid": "59206e04-f363-4896-af2d-c920098836fc", "value": "T1FE553816FF8582D3D17F43B34564832AB365E681A7C2AB1F3154E1E25CB37601EC62AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367127, "uuid": "680bcd71-3cd7-44b3-a498-b664079e2d82", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367127, "uuid": "79c19029-3a59-4906-a34b-dd02b4717567", "value": "12288:bNGB6QwqDcLOlzI3ENsCbA77l3hlFFhzGRpBmtgHGtExSwpL27fDisc3rU:i6QYERA7h3h38prHGspL27fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367127, "uuid": "aca0a03c-c075-483d-afb4-c38999abcdae", "value": 1336832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367127, "uuid": "52efd485-a31a-471b-b204-5636ccff2bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367127, "uuid": "9353899b-b3ff-4400-873c-06dc30235597", "value": "8ebda871e879de7e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c0904b-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386359, "uuid": "ba4a7b0f-9955-486f-8912-5946faeab826", "comment": "Malware payload", "value": "14ddf10f08c530feb8f4fc34dbc7724f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386359, "uuid": "7c3d027e-8b10-4ad2-8146-4f43c976d3e0", "comment": "Malware payload", "value": "8f6fb1e3f8c52a5e4d17836f3b018bff075924bfa1b2b469e4640d4b77b31129", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386359, "uuid": "b09ba659-0137-463a-b03e-d759e1b5b928", "comment": "Malware payload", "value": "7870562b8d44f17d753a33d5e5eba697046b677c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386359, "uuid": "6913086a-b710-4eaf-b99a-47bf7767bf67", "comment": "Malware payload", "value": "5c60dc7d0a93572aeeb66c203eb4fd336eba972fe6faf6fed6697905948d60d54eac1f95b0d8115e0d84d5d656d01b8a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386359, "uuid": "e9a4b9ba-5e96-4c92-80d1-af1982f95d0a", "value": "T1BFF6AE31B3948136D5EF12B9916CA2B683FDED902722A3D7119432FD6872BC15E321DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386359, "uuid": "d9aaf539-17dc-404c-abcd-bfb32021e976", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386359, "uuid": "b05978a6-1d5c-4346-add0-8c10f0a043c1", "value": "196608:bfPIUZmgjUMLcul3JEjJQU41tBMxAoaD:DAHuV0JQoja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386359, "uuid": "f7274281-5379-4e40-8539-68556350a028", "value": 15528960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386359, "uuid": "d1ffd416-b755-41c3-b7e0-5e1768166ff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386359, "uuid": "275d60fd-8713-4608-8f23-38de44f73d19", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aaad9c-2761-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774343355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343355, "uuid": "21b488e6-6acf-47af-98c0-e9e356cd94a3", "comment": "Malware payload", "value": "1acc47ab31373099255195e0578ed699", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343355, "uuid": "764554dc-2674-4e9e-9c16-427c6f9112d5", "comment": "Malware payload", "value": "8fe473d2509db4da586d16f87fbd8b270e171fcb5e5f46f778c136204908df7f", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343355, "uuid": "fc48acb4-9aeb-4a06-9e95-dbcac9ab02b4", "comment": "Malware payload", "value": "04b2c3728b99c22b67aed0df86ef5ad3dc04c469", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343355, "uuid": "990e2b68-2873-44f9-be8c-17e211b36baa", "comment": "Malware payload", "value": "845209f61ef00be14a4e7cbd6816b3ddce67fa97886494fc407811a3ed4f6588664b2465b1111fde854878fecacaf47e", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343355, "uuid": "0036d7fe-450b-4401-bbcb-375d58f3846a", "value": "T15B0374C93AD2B0B47EA73427AD2B6026F5AD6C90744CC098E7CA645CF929738D179C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343355, "uuid": "c821268c-ad64-4479-9612-81cd82d352b0", "value": "768:knt0aS9+7jikFc7kzsSEHCi7yRspW6wXnMme:kt9S47jikFskzsSEHppWhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343355, "uuid": "4c0b33e9-725c-4e09-b5da-b461233b4d10", "value": 39710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343355, "uuid": "bd6512b7-c146-497c-adca-fc44dedf35f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343355, "uuid": "69207845-1c04-45ce-98fe-f9a35a87a04b", "value": "1acc47ab31373099255195e0578ed699.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149f0f5d-2793-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774364808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364808, "uuid": "16bcd0f8-373e-4719-9393-c9fdd50d9a4d", "comment": "Malware payload (Heodo)", "value": "8346d2ea5b1eec77502e081619cb7ae7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364808, "uuid": "7f66f01d-417e-486f-a173-958294451965", "comment": "Malware payload (Heodo)", "value": "911a4881341dc12dd59004e9133e8c0262dfb5ff5ed8c7f11f58367df65477bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364808, "uuid": "809e012f-521a-481c-9702-107ceef17840", "comment": "Malware payload (Heodo)", "value": "955b0ff070d41cd230ae9a1772048b8204618560", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364808, "uuid": "4b447f4b-8994-4c93-bf48-f1feab7a99cd", "comment": "Malware payload (Heodo)", "value": "b7bd3197d8ead2eef1fac7f4837f3e84ff6df39a740a407cd1b4399d5a4bf9d98494e10848e49e0af3056b82ed92cad6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364808, "uuid": "7534ad57-a703-49a7-adc7-3b283983da86", "value": "T177C3AF13B64384BAED45ACB490D6C6B9152BEA30C3978BD3F7B8348B5D33ED49478059", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364808, "uuid": "9a074a1c-5113-4824-891f-4f4e1473b150", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364808, "uuid": "d2c0966e-e943-4bdc-9fa0-389dbd5711e1", "value": "3072:zwBnSH3FbVlOoc6qF/pstBaDqwONnct43rBl3N2U:EpSHJOoc6qF/p/uwONct43T92U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364808, "uuid": "7e98fafc-e7ac-499a-8cda-97b374550085", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364808, "uuid": "f597f895-ce13-4816-8028-a31b40009fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364808, "uuid": "f0777fcd-f92a-4808-85a2-b42c3c4461ea", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4302847c-2794-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774365315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365315, "uuid": "38fb8a37-dfaf-47f4-bc5e-a6ef7684d440", "comment": "Malware payload (Heodo)", "value": "053e90dae319742f0abd16b043f8dc70", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365315, "uuid": "bae86eac-2705-40cd-8740-9d2e5fa1571b", "comment": "Malware payload (Heodo)", "value": "911d6563a5d67d135bc5e8c15ed2959411dda43c9de7c71f783298c04fef301b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365315, "uuid": "dd0a27d1-2703-431d-b0b7-49020a038989", "comment": "Malware payload (Heodo)", "value": "42e190d530576b71f7841733d44cde6adb028110", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365315, "uuid": "c0aa7bcc-7282-4a44-8de0-6f0cf80fe0e5", "comment": "Malware payload (Heodo)", "value": "7d377b3748614be74a00c815cee825732103b7440dce9b84c578c9401a24fa39b876e91249dfd21927c57da746f4322c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365315, "uuid": "7634e069-8abf-4309-beaa-8edaeafd2e8a", "value": "T1CC435C23B3E6D0BFFDDA44F761D416292BBBD931530795E3877224429D72AEA213403A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365315, "uuid": "08003ced-221c-4e80-9fc5-530c505c86d1", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365315, "uuid": "9bd9c66e-b9dd-4953-91ad-831bd1c515fe", "value": "768:SLo2dWDjlaLp9Se77vU6aiF1AKXo8aJOznT7TuIS0WCuFxK9PWVN:onWcs6aqzYBJQT3ul0cHK9PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365315, "uuid": "9fd6e1ef-f96f-420d-b824-370c6ea44d31", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365315, "uuid": "d0b97d7b-c299-477d-9023-a6171a3dfee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365315, "uuid": "84289f51-7e65-4963-b614-848e951c91e2", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abacc4c0-27a3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774371933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371933, "uuid": "6a8bb6ea-ca48-403a-bdec-cd39e4d9f97b", "comment": "Malware payload (RemcosRAT)", "value": "9746327a48ec4581135951ce06d6907a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371933, "uuid": "91e2f64e-36dc-441b-938d-23de7f5bc92f", "comment": "Malware payload (RemcosRAT)", "value": "91bc13f366256976966793fcca5d0d0ae15ccae4322f7ba95cd596576216128b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371933, "uuid": "1f396bba-0506-455c-9d33-5490d49d1441", "comment": "Malware payload (RemcosRAT)", "value": "0fdfcbcb0459cbda9610966a937b37ddda53a961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371933, "uuid": "1a40c315-dcc6-42b7-9a42-98c898d6c873", "comment": "Malware payload (RemcosRAT)", "value": "e8e3568d169a0f668301eeb6c3624496621884bb1e136f0c181e5d6632066027a8d898d28e464f0c72774458c1b9ff66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371933, "uuid": "1331c058-c215-4ea7-bc06-f89c1804f996", "value": "T1C77412063BE4C527DA6611701C35A37BCEF1EB2A9858D7072320BE1E79B87D16F1A361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371933, "uuid": "5361f79d-5689-4996-9e40-074596e9d53e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371933, "uuid": "49373070-d1db-4070-8d0f-7800c07e6838", "value": "6144:YMm4CCv9m5mhSeXVTGlFySeZ8AYVYlRefdsF7AoP5In3rxKGB3VySwem0i8W7Q4g:YMw+9m5NkVTMUSNLVVqFkoP5InRySwer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774371933, "uuid": "bb8f0393-2064-4240-b387-2567214ca03e", "value": 367294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774371933, "uuid": "5606aa64-918d-4a67-a7ed-812822416fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371933, "uuid": "673cb2f0-8756-4e87-a639-9d48e9ffd736", "value": "Bestellung 24014652.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d794d59c-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774343231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343231, "uuid": "680f267e-1eb0-49c3-ac50-dca387965c24", "comment": "Malware payload (PhantomStealer)", "value": "0e8b5d069ca9057edd3c6a44d7876f67", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343231, "uuid": "41dae5ce-d667-425f-822e-e2da9ad4beb6", "comment": "Malware payload (PhantomStealer)", "value": "92dcc781743e20dfd4cf110d93c16298f5d957150cddd0cd6f331a600783366d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343231, "uuid": "db61d1e0-c8f1-4c9a-8366-aaab9beceabe", "comment": "Malware payload (PhantomStealer)", "value": "908d1385fa37cb987c20ac91a38744f78743febc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343231, "uuid": "b5c261a0-af1c-4597-82d1-c566344f52bd", "comment": "Malware payload (PhantomStealer)", "value": "d337e4bd86496237cd2bc39d7c63bfad13ca3dfabfa1203bce4511d3b93a328655f1ab61e556933a42109fa0909cf3d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343231, "uuid": "78d5228f-5586-43c7-bed5-52dceb1b1b56", "value": "T1475512E949C655B2F35C0F79142224B24DEC293C691DABED3029ABCBDD15BC6CC38A74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343231, "uuid": "e8aeb17c-ef60-4ea9-9b29-b60044399f1f", "value": "48:4pgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgpgP:unNUXwFSgTVAct1+RIjAGrk9tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343231, "uuid": "87c6f1b0-56d5-4522-ad17-0511182d1514", "value": 1350104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343231, "uuid": "d836580a-7bff-42ff-bb87-ef4b0da16d5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343231, "uuid": "89cb8a30-11d9-4c79-bfd7-f590f50654ec", "value": "0e8b5d069ca9057edd3c6a44d7876f67.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59444457-27c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774385968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385968, "uuid": "12a765f4-bf27-47a5-82a5-7509d225ceb1", "comment": "Malware payload", "value": "38da0085b16042175de4e2d2ea6aa75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385968, "uuid": "a3baa019-7150-4f3b-9388-3a27ad130b49", "comment": "Malware payload", "value": "930df163cb5ea7e0b9a2ec3bdffd460a598cda23fe4bb8df5faf9bbeaad589f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385968, "uuid": "5d6dbec7-e20a-45a4-aaa1-c32ac5eee955", "comment": "Malware payload", "value": "2f2ad7cedcfe9e4ab5419f4f0e07a1ee72ae8a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385968, "uuid": "75d24742-2638-431c-8cfc-12b2aa7613e4", "comment": "Malware payload", "value": "4e92b795c50d4971c703cf07d7d0234ac79e7259330b538b576e29991c395656db962fe9daa3575c7b5c51d2ca796f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385968, "uuid": "3ae7b95e-4013-4ea4-b512-380da9069065", "value": "T13D07339A92B2CCC2E5D0647065D49780BE53DBBF4E4B8D303B8A2D4B1F3D367A523A54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385968, "uuid": "f9dce9c4-6db9-4d6f-b299-41e08c9291b4", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385968, "uuid": "93608def-67b7-46bb-879e-5b20544cb470", "value": "393216:gL5i+TLecohllhAXFN0MXf58d9RQSXOtuWicn5gxkN1zl:gl5TKce4XFuGf8uqDcOiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385968, "uuid": "67b84de1-4b42-4125-8a33-22bb40e21f7a", "value": 16874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385968, "uuid": "35564f30-81f3-4d69-b0fd-540f22890e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385968, "uuid": "faf1cd29-b008-4d12-8290-d0f5156e7b55", "value": "Installer_v1836_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea928110-274d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774335102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335102, "uuid": "2da2569d-6e68-4a35-9dfa-d97be6fcb066", "comment": "Malware payload", "value": "247472c0a49694f12fc8e0336cb9eb41", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335102, "uuid": "82fe035a-a813-440d-9313-e0b741a4a841", "comment": "Malware payload", "value": "976f6a36fff598b887bfd1bbce082c7872864cc28b1ca23ca913a37468a69818", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335102, "uuid": "b592f5af-b776-4d8b-b5d9-dcfd09ad23b4", "comment": "Malware payload", "value": "aa65330dc6f445c741e698313b276e3cdd2619cd", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335102, "uuid": "07a3245c-6b0f-47a4-8dd0-06d58daa8cd6", "comment": "Malware payload", "value": "b78f909b5eec9c25a8a7dad36940bc5bec32a342a1af6d13f84bb3d7719afbec672166685c4d5a5a17dc181dfe5fbaa0", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335102, "uuid": "21fdb0e1-6430-426d-9848-0af5c1ee144a", "value": "T1EA7409FA12236D8FCD2A0E40D04D0216EC74B87F71F855A8FE4496B058EA658DDF49FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335102, "uuid": "42496816-6601-4107-a021-5a1d5e336ecc", "value": "6144:ga+K0SbEKNTNjZzHfIJWrMRAvAxWe3zj6PgKAn:PnCdcizj6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335102, "uuid": "0124c54e-4753-4142-8956-382b0af79b0a", "value": 363874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335102, "uuid": "a35b1ecc-0f3a-484e-8c06-b207c6d104c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335102, "uuid": "2ac41c34-0dbc-4507-bb70-920e48cc5337", "value": "976f6a36fff598b887bfd1bbce082c7872864cc28b1ca23ca913a37468a69818.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c22efc0-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1774343507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343507, "uuid": "b459701f-6a16-4c9e-9b8b-c79bd7e6b099", "comment": "Malware payload (SantaStealer)", "value": "081dafa8688d3a4cf825b0777f56a083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343507, "uuid": "213ed2a9-639d-441d-adee-af1cca56c40f", "comment": "Malware payload (SantaStealer)", "value": "981056d254a14feaea99f2b971b7324a8593a11c677cec4d5bdfd73a85ab890e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343507, "uuid": "2e8d74f9-ce38-461b-8656-97980707bab7", "comment": "Malware payload (SantaStealer)", "value": "2a6267110847b835bc672feaa801ce3f00607a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343507, "uuid": "f99cf2df-5acd-4f55-b15c-5baf893727a8", "comment": "Malware payload (SantaStealer)", "value": "cbfe0542f12285129eee1690d38d4bc6a2dbe3256f2bbaf5d4965a86a08f4753df350f9e034fc961830d9e737b0a75b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343507, "uuid": "81d5e823-e83a-4282-89e9-4ce64a7bd1d8", "value": "T1CA74AF07F79320FCD25BC07446B7ABB3B532B45912257E7F56A8CF321E50D601A6AA38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343507, "uuid": "d0ea498b-966f-4eb3-9306-567cd19491ba", "value": "c91b5d1fc2b26d4447fb19a80a29cde9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343507, "uuid": "9f142e4d-6c7e-408a-8a8d-1d9eae523771", "value": "6144:5+oiuRnRy5JxoLojA8FPR3zOzGku55SW9Vtul+7xXS++t6pUAEORUr/O:uwRISojAaOqr5UW9Vtuii+KdrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343507, "uuid": "84fbc183-8a91-4cbc-87b9-2fa7efb42483", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343507, "uuid": "5caa06be-a5a6-47da-a934-aebad6165d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343507, "uuid": "676bb6f8-1dc3-4aa4-8638-afc71f40dc53", "value": "081dafa8688d3a4cf825b0777f56a083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7934badd-278b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774361541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361541, "uuid": "5fd9539f-76dd-421e-a6a8-0a01c00b3194", "comment": "Malware payload (RemcosRAT)", "value": "3bfd2b87a41b41043fb21c747a648d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361541, "uuid": "b01d499a-d041-44ea-8e11-00cc84a44978", "comment": "Malware payload (RemcosRAT)", "value": "987764596bdfbd4c30457522e3abc0ac4dc7a754c7dc40076ee95b1ec532ffb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361541, "uuid": "162d133d-ea5e-44a0-a309-abe107640171", "comment": "Malware payload (RemcosRAT)", "value": "b514a110ef5b78c9af5b552955a1761c969e5a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361541, "uuid": "13bd7708-3357-4413-8f34-77b04d8d7f18", "comment": "Malware payload (RemcosRAT)", "value": "50a903f3255ea64c2d87746029a7f3acffa70833c433e4efb0fa9be233287fed06e698760850364b56c0a46aa6fbf828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361541, "uuid": "c497569f-4453-4585-99ef-1c4887499467", "value": "T1D6A4E043FA409222C5350331A9B74E6C27376F646B72570F239CFE353AB72D26A4625E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361541, "uuid": "62ef0d63-486a-4e77-85ca-1b7d38913fc8", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361541, "uuid": "6513ff05-84fd-463c-841f-5366f1f30136", "value": "12288:SAAwYJoy52LzPuJ8rY50SDoOypYk/Zq5kTcS4:SAAEdWhwpYk/7QS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361541, "uuid": "db5e73f4-642b-441c-b5c9-67f1d1d4d47a", "value": 461240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361541, "uuid": "8bf1bc87-f0a1-4475-988c-995b73204c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361541, "uuid": "fc9de59e-9be4-49cd-8c84-2f16910baec9", "value": "BankDetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab291d4-278e-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1774362671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362671, "uuid": "2bf39889-94e6-47ce-8b50-b494e305787e", "comment": "Malware payload (CobaltStrike)", "value": "10b0d7a5be2735846881c10f76690c10", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrikeBeacon Payload: 32-bit DLL", "colour": "#364247", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362671, "uuid": "5c5d734c-e12a-460a-ba8b-458619a8c144", "comment": "Malware payload (CobaltStrike)", "value": "98e9d4c596767f809f9113f89dbb485149bdaad7a15b3e5d8e6f5dede067ce7d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrikeBeacon Payload: 32-bit DLL", "colour": "#364247", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362671, "uuid": "2e3881af-aea5-4313-9138-1a6599096409", "comment": "Malware payload (CobaltStrike)", "value": "e8c62e62a2810e6722def9bdc498758b9734ad6a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrikeBeacon Payload: 32-bit DLL", "colour": "#364247", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362671, "uuid": "b616f267-eff6-4eee-9ae3-29ff97f80fba", "comment": "Malware payload (CobaltStrike)", "value": "94c45b6f2cd4638e1d70220a30c279d01f152c76f2674a6088a36a968dbd0583698b96b2c57507382af77e2501068cdc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrikeBeacon Payload: 32-bit DLL", "colour": "#364247", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362671, "uuid": "a8f70e84-d80f-4e33-a692-4d631adac72b", "value": "T1DA147C617280D032D0570875660BC77F9ABDFCF416319493BBD45AA66F722E7EB2A302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362671, "uuid": "28471925-eecf-4b4d-9f33-fdd902a58037", "value": "3072:R78sdIooW7TQukjh9nSqlkY8zKuiWqscdU4X154:R7ZjcbhQikY8z3Kscj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774362671, "uuid": "483406f2-d354-4eb1-a132-c67a620383da", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774362671, "uuid": "18a57b69-fe7b-4652-a11d-a96871a49d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362671, "uuid": "a4a211c7-3657-4be9-9750-52c3a16a2fd9", "value": "CobaltStrikeBeacon Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14251504-278f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774363089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363089, "uuid": "768cc38a-7289-4452-b468-ce987cc8acd0", "comment": "Malware payload", "value": "6bebc189b5c0a37baa00b9f575005480", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363089, "uuid": "65fe7a83-4253-44c2-9656-4667fe7275ce", "comment": "Malware payload", "value": "9b9c18e73ad3d9c48a7d2a917e05ca65676380afb18d1f04abf22dee2b8add5c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363089, "uuid": "56ead574-0299-45e5-b1e8-06da323dd66e", "comment": "Malware payload", "value": "019135c22f2bb7fa96814252e4261976c510bf0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363089, "uuid": "d60081e0-6448-4521-b787-7d201fad131a", "comment": "Malware payload", "value": "326e3633e755a7060b01d6da9e65c178b1ff744a1de1e9f79d5e1b7f3bc2b14894356ee332d5c3d6c9c27d523fe6d9cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363089, "uuid": "c70eaf56-dcab-4305-b597-17cf54e7d4d8", "value": "T1EEA46BE9945146B1F8F221F0AE9D3F37829DC4CA4B60E4C342D0C9E2E5E66F199750DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363089, "uuid": "463dfbb2-7584-4c92-9c01-3877b49ab8e5", "value": "77eebdaed0179e8b897990c836a66a89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363089, "uuid": "7812f20d-b02e-46ef-98d3-da7d26aaa1e4", "value": "12288:YgUy4JbkrGT3z8IDe3PjpZBKx7Ua688DzUgLH/5Ye:YrNWGT3z/Gp/e7m8wgIf5Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774363089, "uuid": "07c38c7d-7738-496a-a423-ff5665285416", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774363089, "uuid": "f882ead6-8d75-483e-9538-148f8bdf59be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363089, "uuid": "96d560f4-f104-476d-9f5e-5dee451b7ccf", "value": "Unpacked PE Image: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46a40c1-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774343172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343172, "uuid": "48547757-f10e-48dd-9947-eeacf18bae98", "comment": "Malware payload", "value": "d913b6413a77b3ff9205a425bef6eb19", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343172, "uuid": "c0b78018-6e34-44db-b7b0-78d0f0cb4480", "comment": "Malware payload", "value": "9c3fd404b373a909c1cf33e57c55ff55c89e8af8e187873d42f594e3dd5f0373", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343172, "uuid": "cf963ed0-5554-4201-a5ce-910c7707c0ea", "comment": "Malware payload", "value": "fd3987ea60d95c2b66a4d3c25572972020cd786d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343172, "uuid": "13a42f49-6f5b-4b60-9260-49c04528b3f0", "comment": "Malware payload", "value": "8de3b58ddfa117667efcf1c6e871532aaff201ae1858aa12b294107c13f4b5519e5825a9ab443be085d1976105dae188", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343172, "uuid": "c352f14c-f260-4cab-bdf7-b2519f2a4bc8", "value": "T1D0845A0257EE411CF1F74B49AABB50614AB7BE5A1839C02D11A9244E1EF3E089DF67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343172, "uuid": "117a918d-eed5-4fb9-a4d8-81f45fcee37b", "value": "6144:fpkWjRnr4g4ziptCubhHCZpPP/Khjledr3ISRtsyEWWpt6r8B95WAvp6xwzAhJYY:BXjJ4gyiptFhHCXPP/4xedr3IctFmptA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343172, "uuid": "72f76516-09ee-4f9f-8f7e-08c82750abff", "value": 376280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343172, "uuid": "d035a488-8bc0-45b2-8835-2bdb2b5dbe6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343172, "uuid": "dc036951-6e96-4556-8cd2-5abbc9ee7629", "value": "d913b6413a77b3ff9205a425bef6eb19.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20d8425-278a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361233, "uuid": "29d31fe3-6cc0-4b33-a983-fcefade3a3c2", "comment": "Malware payload", "value": "38d5ebcb821a6c236e51a6547515a75e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361233, "uuid": "383aa8f1-18ba-47bd-ac92-83e1ed31cf36", "comment": "Malware payload", "value": "a12a1b3fd111b6ad03f830176b8742c7aead54a2a137d7944c2b067c04196cf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361233, "uuid": "5cdeed1d-e521-48e2-8c38-1295ebe8212a", "comment": "Malware payload", "value": "11690089ce8a886a0ceaeb81b31686b3830b0dab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361233, "uuid": "81b96a71-45eb-4d2c-9cfe-a3a36e3268fb", "comment": "Malware payload", "value": "aa235d2158fedfe5a03d2c2976893857aac48a1c6d257544d8815a31e44c50e86ad13a24963635a39b0e5f63dc1c0ad7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361233, "uuid": "a75522ec-069d-4803-a170-ca0322090c04", "value": "T143057C1276BA9F43ED4E4B31C0D19C242BB6E58467ABF33F918A1994880F392CB57D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361233, "uuid": "08384799-31b0-4e67-9b8e-a09309be6b09", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361233, "uuid": "21155fb8-50ac-43f4-85ba-595407083d76", "value": "12288:ooAE6udzbomlopspwF2dvA17brkbpQGi1SI8HwbH8IQaKaO6CapE/6vCkkcEUxy:gE6ua9p4fdvjQGGQaRCapE/6vKRUxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361233, "uuid": "be5492c1-b89f-4cbe-af66-013749090e15", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361233, "uuid": "1bae8e7f-626b-4ff8-b8fd-427de1beb910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361233, "uuid": "9664efb4-367d-42a4-acc2-acc192ae0e64", "value": "Unpacked PE Image: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b49619-279f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774370173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774370173, "uuid": "50a43231-1286-48b9-86e6-e2a60f535687", "comment": "Malware payload (Gh0stRAT)", "value": "487f55f6aa134ef49bf2f11d48c2b3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774370173, "uuid": "a82e6f43-cc0c-4468-b75c-f594460eb263", "comment": "Malware payload (Gh0stRAT)", "value": "a1d4ad89f895677d116bfac0379a0525390a221666311a295d4aa64ce0685a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774370173, "uuid": "27f0c353-00a6-47b8-accb-63668c671d52", "comment": "Malware payload (Gh0stRAT)", "value": "c2298ec56180ca312c80d81fa499c41f734d4749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774370173, "uuid": "c3b3754c-828a-47fa-b6f4-de94818145cc", "comment": "Malware payload (Gh0stRAT)", "value": "584f2577eaa2725b760ba109c5a497e5e67c31019a545e758eab83e8ed71ab2add596fb5eef6bc2cc40d5ecaafb3c603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Malgent!MSR", "colour": "#5C9944", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774370173, "uuid": "d281154c-8f81-4c35-9904-bc30d7048a19", "value": "T165273313628B253FF07A8E3A49B7E116543B7A3179038C67ABF84898CE160D52D3F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774370173, "uuid": "4cfc64db-0332-498c-875c-3a05c737b60e", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774370173, "uuid": "a8d079fc-82ae-4807-a037-2d62d3200a8f", "value": "393216:M3uprfC9yUd4i4oCcyG1ZDUYjsEMP1Ew5M7bEIlkE8J3jRf4hJ8qEMpC:+2fC9zLjyGjDUYOneEIlkEgYiWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774370173, "uuid": "50f7360d-3dfc-4576-953f-b186a192b831", "value": 21939532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774370173, "uuid": "41181a4e-62a6-46fc-907f-636860d471b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774370173, "uuid": "f44f524a-7075-4d44-9a7e-22922bf649ca", "value": "cloudflared_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e338b5c-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343349, "uuid": "3dda9eaa-9431-4cc5-854b-3be000d8f6fd", "comment": "Malware payload (AgentTesla)", "value": "04166013c5a9a348ce38bda07398c373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343349, "uuid": "2f6d56d7-4c3a-4d55-8b91-0a848312a5b1", "comment": "Malware payload (AgentTesla)", "value": "a3500414a4cf92133503625ac9d7e067e627a75040a51ff4956c806c3a201708", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343349, "uuid": "81fad9a4-7502-4e78-9bb2-9b4853b62002", "comment": "Malware payload (AgentTesla)", "value": "c72509594a23399f2a900af0dad202411b90ba9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343349, "uuid": "2c2bdc40-9ea4-41a3-891f-009dfabcbdd7", "comment": "Malware payload (AgentTesla)", "value": "c1dee9a2869fc5a94a4ed85609d07a0755ba6e5465ea628a5d48f688a6b64c815a62e0dd45e6d288cb3678bf9d195f39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343349, "uuid": "db0b54f6-6491-4383-8b30-288b0ce9ccd6", "value": "T1D565AE98CECD1E904E7DA50B18FB5509D7E031C60095B886FAE27F0ACB5F6786793E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343349, "uuid": "67131277-ea1e-4d16-9375-577ec440a335", "value": "24576:+krQy0d8OjIMHjSpXjdYUk+RyOrXFObuT:+Bjsmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343349, "uuid": "a5347c5c-7db6-4286-847f-8c54e27ff805", "value": 1456208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343349, "uuid": "f8bff77c-c6ed-4da3-a2fc-7c903416cd65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343349, "uuid": "7f2d1048-b73e-4406-9716-6670c92d6f00", "value": "04166013c5a9a348ce38bda07398c373.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46fb72e-2796-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774366338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366338, "uuid": "61c08c14-2349-4495-b8fe-948d3f4fd72e", "comment": "Malware payload (AgentTesla)", "value": "b58a490c41945352d6123c769dd3a0e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366338, "uuid": "3a155c95-267d-4746-ac52-882fee1ef580", "comment": "Malware payload (AgentTesla)", "value": "a46fe4eedf7348a2f09e85ecb679d0ac591668fd4bec85638b5440e5ad0b65db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366338, "uuid": "e2075796-c8b8-429d-ae41-88f6f3c0fba4", "comment": "Malware payload (AgentTesla)", "value": "1b1a352eb16fdc7c8755f4ff26000061275b89ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366338, "uuid": "08a7a3fc-b7b7-4ce0-b0ea-70f080499cf0", "comment": "Malware payload (AgentTesla)", "value": "2ccf81c8e39752f269dbc598b51e60ef765ce770dfce0d11abab91b1ee96f6f53a28ff75d0119cd08951479407451ba7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366338, "uuid": "11629a93-1bf3-4333-83ce-8dc389cbfceb", "value": "T15635BE027381D062FFAB92334B5AF6115BBC79260123A62F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366338, "uuid": "18e768af-d86e-44f6-a7e4-eb9052a6fd15", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366338, "uuid": "f95d973f-7531-4e80-ab4d-56c79952810e", "value": "24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXda/rUR/2l317:lPVt/LZeJbInQRa/rw/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366338, "uuid": "6c969ede-8fa4-4ec8-b963-752fdf64bdff", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366338, "uuid": "e2153715-5939-4705-8ecb-8482bcdff678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366338, "uuid": "26cf0d26-1e34-4238-9c43-0e579895a6ef", "value": "Factura de proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f3a915-27c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774385688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385688, "uuid": "9883c7f7-7d44-4ecc-8c3b-a24f488de1cc", "comment": "Malware payload", "value": "e8b560e03f5e4f5d22400f832dfa40c0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385688, "uuid": "d79af5bf-b235-4e88-803d-03d85b654fba", "comment": "Malware payload", "value": "a4c11079b34f3362ed906c63aff5be8b1153f05708f0bf4a2149779a38f2d204", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385688, "uuid": "32cf4066-3737-4e8f-add0-fad4295beda4", "comment": "Malware payload", "value": "637511f845be2388f347d1d2fb36ef624a72cb27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385688, "uuid": "a369049f-feb9-456a-bd45-be5e2faa610d", "comment": "Malware payload", "value": "c5b0044acf20279f2e606c86f512e52fb95b6bcf66ba4deba0f751cd7e4d4ebdb30251275e8fd9b46889af27363498e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385688, "uuid": "877919e6-3fa2-42c5-80e5-450a9a952ca7", "value": "T123925DB512896C79FBD1CE39AF3C6F4DADE8C2C42124E3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385688, "uuid": "bde74ac8-7c23-4606-888d-87d89914dd50", "value": "384:ZFcuQpWx+BL0SWL0gbzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ZF8i+BL0SI0YzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385688, "uuid": "dfc905c7-7355-435f-bb34-8f7772026bde", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385688, "uuid": "c3b3f9f9-beb2-4800-95a8-ffb00da22cc9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385688, "uuid": "eae082f1-c535-437d-8d45-b68fa72ed65b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04185705-27ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774376377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376377, "uuid": "41c0d97b-9416-4831-acd6-1c40b9b20418", "comment": "Malware payload", "value": "f424d5e86bc5d8d58bdf5b5c1c483132", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376377, "uuid": "b295bac4-4362-4e53-aa38-9880d5959813", "comment": "Malware payload", "value": "a4c267819d38e8c1e85e1764115032db61bf8985711d4a5a3384891404a176fe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376377, "uuid": "f4fe3982-862a-4baf-ad6e-6c02f1529b1c", "comment": "Malware payload", "value": "2622568b1f10676ba46ccb5bd5edadcbeed05a51", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774376377, "uuid": "92f02502-1489-45ee-b698-c497127051e3", "comment": "Malware payload", "value": "359d240a3457da77748a58eae8e0c0fb78a9f2e2a64e7518475a1216ae147007d573c18630f2d2e83e590d04271deff6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376377, "uuid": "681ab1fd-60de-41bf-a221-fce3d6c06102", "value": "T1377622239A348E42F8D668370B54D92293301E9507A363A2BD6DBF8F737DD43186D46B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376377, "uuid": "9ebcbe18-b0c8-4a91-8793-cef52fa8b86d", "value": "196608:UX/79JdEgSa9lGPfWkiauo9oMhC1ud4Q1C:UP5QxmDqo+CAd4QU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774376377, "uuid": "49154f9c-e034-4218-afa5-822a0f0fd492", "value": 7704494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774376377, "uuid": "ef18e030-28ab-4f21-aa43-d36093454a17", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774376377, "uuid": "7b19c84d-65de-4039-bdb7-def774674ca2", "value": "vd.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c245863-276c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774348124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348124, "uuid": "10bca770-7c01-435b-a3e1-20dd6e4eeb2a", "comment": "Malware payload (ACRStealer)", "value": "7270e484bc8c551241ca5cbd674f1d44", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348124, "uuid": "6ce94ca9-af7e-48de-aa5d-f3ddf5eacebc", "comment": "Malware payload (ACRStealer)", "value": "a50e64fb1679395bd7627bc0811b69cf013ff482bc9b2fe25d1d6e24fc34225a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348124, "uuid": "995818b7-6721-4dd2-abf8-8e50b97a6ae8", "comment": "Malware payload (ACRStealer)", "value": "cb3f6a3214ebb2710b35a363c07347cacc810429", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348124, "uuid": "f27ad749-0fbb-44f7-9ba9-6ceb862aacb1", "comment": "Malware payload (ACRStealer)", "value": "6e0df12c8543ef122257bb937c3cf04e59bcd84deeaf7b49c017db687ab2efbda5d4dd7cb0cfc3929c6f0f6966e85057", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348124, "uuid": "2d7a53f1-f74b-4122-9167-41c220755bd0", "value": "T18AE1107DAA79ECC403EEB0D05AA63E0620595B63D371196CF9D908D62D782C8DF3E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348124, "uuid": "b9fa3fd9-b0a4-4b34-bcd9-833db70e941e", "value": "192:rCP28BhakWrr/yLKiJ3jKcfCZVqSYdJ8v2GkxT2KqmFhyMCh:GP28BhakWrr/yui9KKCZgSYdJdGEqDoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774348124, "uuid": "7920562c-40bd-402e-b497-ae6792220d39", "value": 6853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774348124, "uuid": "c7b93bfe-ade9-41cb-8f7f-e53eebb78cc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348124, "uuid": "002882a2-fa84-427e-9103-706543d54ba9", "value": "stage1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9099dee4-275e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342253, "uuid": "f18b8c5d-0947-4b07-be31-04a792c75d97", "comment": "Malware payload", "value": "c7c33a777ad2dc85436d65527cfa38c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342253, "uuid": "167b56b6-34c7-45b4-ac87-1326bdd4a178", "comment": "Malware payload", "value": "a73d9209f036f7432fe8f83e3a4c0a38c2b26f1ebb6002053cd8b0de24679a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342253, "uuid": "a719ac50-d2b0-4013-bc1f-da74b9ef08d0", "comment": "Malware payload", "value": "2f4714db781af1b9a030f92950d6bf938b00e7d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342253, "uuid": "8d7bd615-bd1c-4467-8e51-d0845cea683c", "comment": "Malware payload", "value": "0717e95381d960c03b73eb9082a0818d9a39a9576150642e5028a750e4c0c951279689b9bc73e1d8ef8b7123287b92ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342253, "uuid": "268da902-0777-406b-9a77-64c853376f5d", "value": "T1C546223A3D032945C62C0BFC801BD68677F2924FB792DB5E3AED12588E027CBDB26555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342253, "uuid": "25d9c180-4646-464b-8a72-633e4431b1df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342253, "uuid": "0f37c4c0-1e44-499a-a8cc-21162c33ad48", "value": "98304:0vAKwFaf+2qORvUSJafxBNbAvBWeW3TpEsji:aAvFCqq8SwcB5ORj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342253, "uuid": "96772a36-948f-436f-b6c2-031d027916ae", "value": 5520384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342253, "uuid": "8b9f5050-fb48-4c75-b468-ec3f2369a0da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342253, "uuid": "47a8f168-3d9e-4be8-a854-d869086f16d8", "value": "c7c33a777ad2dc85436d65527cfa38c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89136cd5-2765-11f1-a769-42010a9c0008", "comment": "Malware payload (WSHRAT)", "timestamp": 1774345247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345247, "uuid": "d37dc608-104d-4228-b340-4bc15208f909", "comment": "Malware payload (WSHRAT)", "value": "02144e5fd85f12847d08f57b2533f0ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345247, "uuid": "c62f8695-7c7c-403a-996a-d95ca93d8bde", "comment": "Malware payload (WSHRAT)", "value": "a777bde7397371f85a56f76e3d08fc086517ee9715f9d9afe2fbcc455e2f8b6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345247, "uuid": "7c94ef8a-e8d3-4dee-83a7-5ecfa6f72f2c", "comment": "Malware payload (WSHRAT)", "value": "97704ef3d48ab79c1f1596f0bf2342fcfe4004e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774345247, "uuid": "5c2bd4f3-47ad-47b1-9d77-78b758f837b4", "comment": "Malware payload (WSHRAT)", "value": "2c2c5e509865e7dabdd7dec248617ca4a3ca759b04336f55c632cf27344ad8f5236f74440141703db71728b88cadf744", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345247, "uuid": "bac49d03-4709-4da4-8765-46a1414ea62e", "value": "T1707554183BBA4EDA4DC4105FFFA7AF0065736392EFB987DD55A260438C0CD845868A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345247, "uuid": "93c771e6-0d67-416f-a9f2-504b9f8e39a3", "value": "49152:I/2pOrtrB4EMegMMMM64bvUv437MtMMMdr27xyiHMtMMMN7TSHD1JjMAMMMI6OC+:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774345247, "uuid": "dde4ce47-22b4-497f-a7fb-eeb55ecf7b87", "value": 1583367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774345247, "uuid": "59148cc6-9afe-4b39-95a0-80d60583f45f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774345247, "uuid": "9a883159-9227-43d8-b5a6-f5bf3f81b303", "value": "kx05ot.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbbc960-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (Havoc)", "timestamp": 1774338059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338059, "uuid": "3ad4d8a9-1675-4af9-b55d-64c0347e12f6", "comment": "Malware payload (Havoc)", "value": "2a58cd795581dacb16f93101a8009459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338059, "uuid": "87b65295-3b38-4b88-a654-25c1364d0186", "comment": "Malware payload (Havoc)", "value": "a7fb7ce962f2b6cdbd92f97150b669e81893dc7b5fb06c28758f4041bf8244df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338059, "uuid": "a0061e1c-c2aa-47e0-9d44-ef749e2210e9", "comment": "Malware payload (Havoc)", "value": "a20f75238d72a712b1c3b920c741bd1151ab32fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338059, "uuid": "597cdfdf-b1e4-4da7-8234-96cbc82e9288", "comment": "Malware payload (Havoc)", "value": "eb4323626390982936ad98c766c65797c81f09708a1465c0d1292279efb99ebd006ae607a0ee7c108c4c0377cdaa493b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338059, "uuid": "97e8fa1a-a5ad-430f-b7b3-2d8f3260d1be", "value": "T152A49D87F6A292BCD159C074D31AA673FB36B88E05217A7B57E497302F69E105F2CB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338059, "uuid": "3716ade4-5395-474c-ad1c-d8e6c2e6f902", "value": "f589841b0213e93006bde418a4a5fafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338059, "uuid": "ab8cfb44-ffa4-4e2d-9465-6255c0f0d253", "value": "12288:ete31Ey2Rw95j4pxdzIgN2JUMIIunvZvWIU8Qr124:L2Rq5j4pxJJ2JUMIFnvtWjbh24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774338059, "uuid": "ec77295b-a142-4dcf-a705-3feabbd2725e", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774338059, "uuid": "4b760961-c945-42b6-baa9-f7b0d97edd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338059, "uuid": "3f05ad2b-fdc7-48b7-b171-81e6d9b3fe31", "value": "2a58cd795581dacb16f93101a8009459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e29783-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774337886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337886, "uuid": "8a075c73-70d3-4cea-a96c-ed94fd1d7d47", "comment": "Malware payload (ACRStealer)", "value": "28ea506db55ee1c0ca2ac3aaaabad574", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337886, "uuid": "724dc46d-05d0-43d5-be1c-c6464748e280", "comment": "Malware payload (ACRStealer)", "value": "a878815a34bf4022eb0366c3a34a6a47b50691e46af59d56b3fc1599d97af6e7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337886, "uuid": "4fee45de-07af-47dd-82c2-46f6c9bc5705", "comment": "Malware payload (ACRStealer)", "value": "62bcd116b529e487ed3ce30fd11be8aaa3ccf408", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337886, "uuid": "60b5bdd4-ff3c-404a-9aa7-20fc394fc641", "comment": "Malware payload (ACRStealer)", "value": "d00ee345407945ed633caa718e76e3cd2db9c6199bb7d621fd987cf773e69ff2e8476b9ab3bca6d609fb1a3cc7ee270a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337886, "uuid": "1b915402-2d94-44cb-a12d-dd5539a9d542", "value": "T15464B604CA12443AF1D653FAD7BA0ABD7DF82B51238010C3E3D15CD7D95AAE176368AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337886, "uuid": "70b03b4b-b415-4af4-9430-184002ed7dac", "value": "3072:iEJDAdJ9Rius2PuAfIccKOP97vCra+W3652f5WB7nGya3de7VXnj5o8RP:iEDIJPs2PuA/E97aa+WZDyao71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337886, "uuid": "7be587c6-2a30-4d5c-beb9-bcde4dd097ad", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337886, "uuid": "db2866e4-e61e-4e4e-8170-4783d7dd5c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337886, "uuid": "04402aed-12e6-4a2b-8075-3946327cca05", "value": "28ea506db55ee1c0ca2ac3aaaabad574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6a2b30-2750-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774336046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336046, "uuid": "2126134a-fd3b-4513-9107-9f29a03f5da6", "comment": "Malware payload", "value": "cb67f4455962f738f2ca4b40f94953af", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336046, "uuid": "aba96437-1575-48d3-9c32-6d1ce3a46dba", "comment": "Malware payload", "value": "a95dcb51d16090b33ff57b4ff2634ae74e32d9b4ad1750fd4e2ea20acf35ecfa", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336046, "uuid": "dff9abca-6839-4882-bf1d-6d3c20ddc37c", "comment": "Malware payload", "value": "10f93b2390b1dce95d660ab5a93a15c49e5422fb", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336046, "uuid": "7e61c61e-2fbc-4015-b74c-4f72dc5e6426", "comment": "Malware payload", "value": "6e2cfc26dc239ba4324f664b210cefaf39312aa10affff05fd95655a89d036d1cd91aca3599ea609f248bc07744ef06c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336046, "uuid": "7236dadf-a6d4-453c-9c3f-8c6e736fd6df", "value": "T135545DE467F02CF4F826113BF841912DF7E27C1A8B50D56B8366E55A2F235D128BAB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336046, "uuid": "364e2e8b-7aee-41f3-8e9b-acd8eab3f8d8", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336046, "uuid": "fa2de9cc-5df0-4402-ad46-4af1769a5c52", "value": "6144:mBfaB/yttqQ0XWhGF9HIkHyUVdA31Ww6:mfwKttq5XWhGF9HIkH33V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774336046, "uuid": "d51d6e23-04b2-4701-97ec-9be185be577e", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774336046, "uuid": "72622295-cf57-4f66-add6-d7c12d0c0bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336046, "uuid": "7ce4a711-7a27-4124-8eac-be4cfa37f2b0", "value": "2SearchHostService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e79935-2768-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774346364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346364, "uuid": "ff074ae3-2d21-4d05-ab6d-5015806fd3a7", "comment": "Malware payload (Mirai)", "value": "8fd5a1af61aea3c5b50ddf6950a6f38f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346364, "uuid": "a3f27bf8-94ce-4c70-adb2-d08b954d69f1", "comment": "Malware payload (Mirai)", "value": "aa706e29c04a68054fe8dad260fa432ff05612552ce4ff4a618ee7dbe4a892bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346364, "uuid": "7832b010-68bd-4597-a790-9602f6452230", "comment": "Malware payload (Mirai)", "value": "5e8e72e4b29b618fee59e60b10fb79d31b13cc30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346364, "uuid": "0273d33b-a889-4687-a21f-075c3410685e", "comment": "Malware payload (Mirai)", "value": "b39deb508dd76760040a44ab242d3ba85938ac4434cb29cb000307451e515da842dcb846e0b5a5d1232851c9191118fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346364, "uuid": "46500fd9-7376-467f-b260-b7bdbd70f4b2", "value": "T1EB242A55BC415F26D6D126BDFBBE81CE33232BFCE3DE7112EE0057103A8A85A0E26452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346364, "uuid": "bcf27196-c8a4-4577-85b8-10bb58636fd3", "value": "6144:LoWxOc657/+LZmpyQPhp/8h7oR7n2S9NVL1ameX6k1GYv/ihMgwmTTql:TM9/fyQ3/8h7oR7n2SvVL1aXX6k1GYvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774346364, "uuid": "072da8f9-7aa5-443e-8f37-823bfaf741f6", "value": 212160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774346364, "uuid": "cc97c68b-2c95-4fa1-98e1-8b968080a65a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346364, "uuid": "7951dd25-2756-4e11-b17f-749183620ba8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5b61d5-2779-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774353651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353651, "uuid": "6df2b508-90e6-4b8f-baa2-cdce94d17de3", "comment": "Malware payload", "value": "7eddf8cbe7e2bfb750cdd503eb912557", "object_relation": "md5", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353651, "uuid": "0bedcade-484b-484e-8b48-899398500674", "comment": "Malware payload", "value": "aadd85e88c0ebb0a3af63d241648c0670599c3365ff7e5620eb8d06902fdde83", "object_relation": "sha256", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353651, "uuid": "d3f4f7cb-f984-42fe-9f77-f0222081d0d4", "comment": "Malware payload", "value": "34b96e95202541d41dcf0ed9624bd39eb0b1462f", "object_relation": "sha1", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353651, "uuid": "bc80d2fd-b4bd-4a78-867b-6b96e8389e35", "comment": "Malware payload", "value": "f6405d72765174013b2c7800d97a6bbd3facc4d259466a6e83d86d4edcc3fdb452947a2b782e0812d8b86df890426144", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-13", "colour": "#94CB1A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353651, "uuid": "8ca74e9e-419e-4f03-9c42-1dedd1fb60ef", "value": "T14D335C156F68FBAAD26FC87C64521D01C2F0DA165612DB996ED834CD1DE33808B2D3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353651, "uuid": "4922e510-c296-46b9-b08c-d35a5a936e7c", "value": "768:VC/pnzYy6VOnFTDHpey4g+wPwxBo+N6XZOfq1/k8wyQH6JW6G6Meq:Vq9ETQFHH9YcZOn8wTHV6GEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353651, "uuid": "6765c87a-9b4d-449e-9b94-a61b989fdfe6", "value": 54392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353651, "uuid": "b9f2900b-c032-46f0-be19-1eff22a118bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353651, "uuid": "7ac9dfde-d492-487e-b93b-4682e0530fdf", "value": "aadd85e88c0ebb0a3af63d241648c0670599c3365ff7e5620eb8d06902fdde83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e4cc47-27a3-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774371904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371904, "uuid": "86449f16-b1f2-460e-9c78-4b2d6e66ee60", "comment": "Malware payload (a310Logger)", "value": "a3c1ceba7fcfe9c021e9d8832c69c25e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371904, "uuid": "7c9f1314-46ab-4b19-b877-de1dcbe0b682", "comment": "Malware payload (a310Logger)", "value": "aaebc1adb25e36099d05cbf0d4065a2ea70d09f9c8bbe760f0bb5123b95c4748", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371904, "uuid": "750417c6-eee8-4a16-8413-841ad01369a2", "comment": "Malware payload (a310Logger)", "value": "d59f7413f3c69acd4ca1769148fcc7bffa61b229", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371904, "uuid": "90232b2d-8039-49ef-b519-cc45d59b91b8", "comment": "Malware payload (a310Logger)", "value": "a41b9b4bff55dd838e5d1a634b8cf09fab49324490121d9afad3a8db402191bd672990186b6e80c566a7950ea8101d1c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371904, "uuid": "3099ca13-7fb7-42d9-8b98-8b73b37872e0", "value": "T10AC58DC0C9943FA3D3C96310B1983F6E73D5BBEB849BA11F5AE7A5061BFF2044A16485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371904, "uuid": "22a07ed9-0c42-4aed-8f18-daab625f1911", "value": "24576:Vw/P31V5x0lyzNClwu3CbLh6/TzIl4z912zHfVIakkJ73pF5bR03ARVW4S7phmZf:AxZ3Iq5F6iPPAMtdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774371904, "uuid": "93868771-15c3-47c3-8178-9074facfd9a6", "value": 2687787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774371904, "uuid": "21966ea7-4acf-4fae-ab50-2e3546f94257", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371904, "uuid": "96eacb39-b200-47cc-b5cc-cecb7ce1f845", "value": "24.03.2026_DEKONT,pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af9a17d-27d2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774392092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392092, "uuid": "601f7fb5-3d58-4a48-a909-98ae7e3d7a7e", "comment": "Malware payload (GuLoader)", "value": "ba830e58388900f50bf27e6b6c0fbd0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392092, "uuid": "c2a4bae2-daaf-4386-aac3-4045ac3cf3ec", "comment": "Malware payload (GuLoader)", "value": "aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392092, "uuid": "c6c177b6-da8f-43f8-87aa-e4e29cf78fca", "comment": "Malware payload (GuLoader)", "value": "31333b9ec43dbb132e5806c6003383c465ab67c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774392092, "uuid": "b832d3ee-3e82-4be5-8c99-127711b11432", "comment": "Malware payload (GuLoader)", "value": "6ed95ac499ead223bceed447511c0319d3f02799c2ed6ec117e9cd143fdf0aeb0f69e9d8a2bb9f2f4567d7da53df686b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392092, "uuid": "1b7a891b-665c-4576-813c-fd87e376c795", "value": "T16FB4020137519265C6B4CBB090D9E3F3DB6C651E3D62AA377B40DECBBA6D1DDA022324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392092, "uuid": "78c6d322-10e9-4964-9e17-864554d59dfe", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392092, "uuid": "6f42b03a-33a2-4de9-a385-daf6daaa284e", "value": "6144:Zp+ggNsm8fQErfR76M90vdnTwQ3K7ZC6F6s0fLQpSQdCISDRMDQsplhrA6:PjmcrrxB05kQAC6Is0cSQAdMDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774392092, "uuid": "e42003b4-e365-4d8c-a78d-b5e76c6fc875", "value": 504226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774392092, "uuid": "4c35d15e-1677-4947-8bb2-86aed95e3ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774392092, "uuid": "7218de35-e331-414f-9667-ea45399ccad9", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d24bbf7-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1774342891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342891, "uuid": "0ea31f40-191d-458b-8270-fe99c4861b67", "comment": "Malware payload (DarkCloud)", "value": "83e967aa5ee5752bd06cdbb05625c69a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342891, "uuid": "71e70c1c-cf44-4b94-ba8b-97095e12466b", "comment": "Malware payload (DarkCloud)", "value": "ac392e8876ee37c4b39f995f6793437423ed3128fabe059d956615c9708b05fe", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342891, "uuid": "64bacd67-0466-47f0-99b6-d9ebb04f3a4e", "comment": "Malware payload (DarkCloud)", "value": "5011034c82141b9807f3d61e8846bc75b4dff9dc", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342891, "uuid": "9ebaacbf-a2c9-42fe-9b44-06293386faf7", "comment": "Malware payload (DarkCloud)", "value": "4249ae701dc54cc3e9aa371efe37f614a0b9a7f250987181681161c8bc2a5fc525b2cb59b1c8f474fe9d960a2d4b5179", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342891, "uuid": "c79177c6-1438-4d29-9f4c-03cc28e8aa6d", "value": "T1F9C5D0D6118D2B21CAFE121EC2A9894111B00EA5F9C75E59B7367E83EDDAEC01F4943F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342891, "uuid": "df699b94-6de5-4074-aad9-fcc5bffa94fb", "value": "49152:62zWcmQs7ZeEKauvYu59Xva3cpbcCy2btUO+3XPg:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342891, "uuid": "ea748222-7fc5-40c0-b3b7-9ee14087fe1d", "value": 2522760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342891, "uuid": "4d55b272-3224-481b-8573-f94e2a28f7f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342891, "uuid": "5fd308db-e16c-4177-a6b7-5d0b5c5b4792", "value": "83e967aa5ee5752bd06cdbb05625c69a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d91c91-27b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774379889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774379889, "uuid": "105f657e-cd83-4c06-a627-55dff04b3cad", "comment": "Malware payload", "value": "dd5f6bbdd1e82f4cac0c4fbbf6005940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774379889, "uuid": "09efa0e2-5af5-44c9-adf0-b07ec02143a3", "comment": "Malware payload", "value": "ac63d5a3b427a15327efb3687f646079dc12685b4c4394d5c633fa1000b0d193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774379889, "uuid": "114ecc8a-406f-4fd4-a00c-2bbf4a3e9680", "comment": "Malware payload", "value": "0f8df1f554486b153b190d4b516a2b8bb48ce5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774379889, "uuid": "e315fa5e-733a-462e-b088-9fb063ddb1e0", "comment": "Malware payload", "value": "1208ac585070682f374a658aa34af806227e2b9fde29936bcc94cfe712c9c795e440de75799e6bc83448cc324d0a82c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774379889, "uuid": "8f86a477-9488-4f4e-b016-42fd0898a11f", "value": "T162B4DBD92EC1F15D0F82A933F21AF02DE1F599F0536A4C2AB0DD6C48EC616D4ED69239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774379889, "uuid": "a55ae4fa-1b79-482c-80e0-b411f85d1f87", "value": "6144:gnZRLZ1qtKKpiU89/rZ21Tg8yS0dLEGuZ+8Hj5w2SuypW1YQMxaUmpDmBF581tXU:YR9x9guxtD8Hj5wd9Qbpfjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774379889, "uuid": "1974f530-500f-4639-9bd9-4cf53e522735", "value": 521472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774379889, "uuid": "9a55020c-bfbd-40e5-a00b-55f58af29043", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774379889, "uuid": "d444f5b0-5558-4de5-9117-22acb3cdb674", "value": "ORDER SPECIFICATIONS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97e3125-278d-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774362561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362561, "uuid": "18b0c9ba-ff9a-43de-ac02-85ffdc321a2a", "comment": "Malware payload (Heodo)", "value": "5d0fc6b953e9eb6be4d3fa8dd7688410", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362561, "uuid": "c9fcef6c-ce12-45aa-8c32-224c4121b0a3", "comment": "Malware payload (Heodo)", "value": "acabefc5923cee3030c68a69a356b2bfbdda0b55e14c088694995f1737793fa5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362561, "uuid": "5c2874fc-2e99-465b-867d-c1ff53c8878e", "comment": "Malware payload (Heodo)", "value": "6f39fc66002d1649949e3c9629148f12d876329e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362561, "uuid": "f1ff9886-22a0-4e6c-88b8-bb002dc48126", "comment": "Malware payload (Heodo)", "value": "9a503447209805995394a2519528f6678aa9d08eea49c5000be1accceb2041ec521989da7f0af8892cccd8838cf37c1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362561, "uuid": "e2d13912-c15c-460f-a00b-967584a06db5", "value": "T1A3038D028A4090F7E88B15F395FB6BBC9A359944036A9CF317D838C59EB52C47B352DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362561, "uuid": "08d6dafd-d48c-4c46-b189-9c45d594b6a8", "value": "ac089824fa3b9b8c4bd2c460029ab9bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362561, "uuid": "33660125-961b-4e84-8052-b20740f43c41", "value": "768:Ubo+lq4YRujBRT3LM5DoVQOOlznoGAkf80ruIAB0aymzx:ynq/Ruj/oxKk00/ABPymzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774362561, "uuid": "629b116c-1f31-4016-a781-f4feb233c4e4", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774362561, "uuid": "5e7d213b-9c95-4cba-acaf-fa195d988383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362561, "uuid": "fe0812c6-4bf4-4589-8823-6610966b58ba", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079fede7-276b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774347606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347606, "uuid": "08485f97-5734-45da-9475-0472dd3b3820", "comment": "Malware payload", "value": "1438cbd9db15bd30f6765c95ebfe645a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347606, "uuid": "748faa96-e1c8-4b47-8f16-3c983852e5ea", "comment": "Malware payload", "value": "ad7e6a858a601cb8771ca0bc91e6df36f085ece0b3f3574c8acdc5ed1b9534ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347606, "uuid": "b0a1b348-2e98-4b66-bd7e-13f30a11d23d", "comment": "Malware payload", "value": "48abc741eae395ab3ad7ced13ed30ec244f57796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347606, "uuid": "d268c108-f4dc-4337-9189-b935d7389d9e", "comment": "Malware payload", "value": "91f8fc2dde9142c3ba4b156754d4a9f711ae7d99ed97ff6a9ab3097c52083f64d5ce243e49193f3dba3bb047ccdbd590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347606, "uuid": "5cf342d7-c3d6-48fa-926b-bda3bc4ae41c", "value": "T10DD6331A7191046DDDE4E9BD8212C07BE263BCF2DBB5D18A5EB7F0272E3B6910C3A541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347606, "uuid": "f0cd460f-d701-4736-a4de-16fd8c205199", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347606, "uuid": "2654e6b4-9c53-43c2-b02d-3f0f4e2ab4dc", "value": "393216:hX461+TtIiFq8uARuAkY41z0JhtokbVpDOS:71QtI18uAUY46t3bVtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774347606, "uuid": "e3074746-41ad-415d-b19a-dde4cffb17dc", "value": 12955912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774347606, "uuid": "e2751836-577d-49c5-8373-9a893a3e70fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347606, "uuid": "8e955121-fe05-4dbb-bea6-7cc0d7a32e8a", "value": "TM_SecPatch_v2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2581cee8-279c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774368702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368702, "uuid": "9d6fc432-2525-4c20-a10f-6bcb2150aefb", "comment": "Malware payload", "value": "8decd80d89c75cd507c30ed7868e66db", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368702, "uuid": "c29fe415-789c-4a4a-9938-853ff7da5da7", "comment": "Malware payload", "value": "ad99a79ccc41ab90eb634800bacd1db6666eceb0077e33e4930c2943e5ba50eb", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368702, "uuid": "510452c8-7f57-4ddb-a59a-64fdc49a0f63", "comment": "Malware payload", "value": "75960bba6ee7bbb467ad6d2cf4bd8ff5a7829d89", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774368702, "uuid": "d3de30d8-e898-488b-9619-b2a2a9372e1a", "comment": "Malware payload", "value": "f4794bec2b1d1cb576dbb84573bb07eea155c370a1650330feb864a2030ab11bade0a538878ce8e7dfb022f9016c9e3d", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368702, "uuid": "3d89361e-4351-4e1c-afd7-e197451b35f2", "value": "T1BED6AE203599660BED7E9BFEF997B8940F6AA2E2D7C2D4FD1842028D45D1F00B91352F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368702, "uuid": "e485045f-883e-4c1d-9fbb-40c152736d62", "value": "196608:jSS2UKoYM9PWnlnEN2MOGWz8E7nhKTirMlsxvi0r4xwmh1uVvIDcf4:v2U1Y96/Wb4irJvi1xwS0gDe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774368702, "uuid": "12eec932-3231-4cff-aaa5-4df3e0f49dd1", "value": 12690944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774368702, "uuid": "e9d85b07-33d5-44b7-84d1-9381f6b5e4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774368702, "uuid": "56b6d85b-82b4-4dae-b5ed-2b1d5e52e592", "value": "ad99a79ccc41ab90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329d1539-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383756, "uuid": "4d5091bd-6375-411a-a0bf-2398c1e613a3", "comment": "Malware payload", "value": "72cfbf79ff366da11b98ff8a42cd081a", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383756, "uuid": "38cd26fd-0747-4635-b580-c6161227a068", "comment": "Malware payload", "value": "ae456e90f894c0f039b58550240f71f1b243f5428402178f47d586406ebe9622", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383756, "uuid": "c7c6f85b-c99d-4944-b303-f1a2494251d8", "comment": "Malware payload", "value": "34515afb8155982b770ecbb38a0524d9407501be", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383756, "uuid": "ddc4a5e3-9553-4a89-b819-338a548c3ec9", "comment": "Malware payload", "value": "931ee831d945152e50b951cfa282f8456a954e1a0fa2bc770c20b27a632ba674107286ed19f0c11cf7c672053f5dd462", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383756, "uuid": "ca5a8bcd-0905-4888-a5d4-70663fb126c6", "value": "T14014918D59F322114563B2B99B6FA40E2235E103690ECE147F5C93916F8C63C9AF6FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383756, "uuid": "6a413c20-17bd-4f52-9536-6a992c7a4f0e", "value": "3072:WyE0VWmfmQZJz3ME4bkCoitvtrHLqrOIs5KWoq:RE63mQZJwE4bkCo+vtrHLqr/AKWoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383756, "uuid": "8607ebb7-a16e-449e-b121-f7a2cd59e052", "value": 200920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383756, "uuid": "5eb37320-d88d-49b5-9aca-443c8e50f1e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383756, "uuid": "f7c06ffb-b6e2-4689-b32e-d5ffcb7ea660", "value": "memo_win32.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2927ea81-2735-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774324470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324470, "uuid": "8a3d80dc-2b92-40d0-b8e4-04725f23de93", "comment": "Malware payload (Mirai)", "value": "645bc7a7535c07baa8700927e99f9254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324470, "uuid": "35037229-8eac-4487-a24a-7a832e91178c", "comment": "Malware payload (Mirai)", "value": "ae6e2038c280626cf509840648ce735d5cea69fa5a251c81c4cf1771ad1a8e06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324470, "uuid": "4dad8954-4d5a-4b24-b2bf-f3660a8880ee", "comment": "Malware payload (Mirai)", "value": "c623b0558a5afcc2cc122494d978e7083c5be861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324470, "uuid": "1f3c803a-64e2-46cc-82f1-2ec220273a88", "comment": "Malware payload (Mirai)", "value": "36a203bfc67371bd59a7a3c90c17229d7d6354ccfa0531b0a7c1321d2b2db6cc0bb77c7ee86c6befee9cf982909f1ced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324470, "uuid": "54c9f173-2b6b-4597-955f-ecce6cc0f67f", "value": "T1EC1429457E419E23CBD0677ABFEE42CD732223FCD3EA7112EE014B16369A51A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324470, "uuid": "b35d995c-c70b-49e3-b26b-429144d0fe29", "value": "3072:lUeC5xbBJX+1GY3pkp3xWUklRZakDGZav95TPGO8ORO65svFQTIoNj9rx+0afisx:lpC5xbB5+1GGUQlRZ7GZav95TPGO8ORU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324470, "uuid": "67933c9b-a78b-4289-8065-12e9972242b5", "value": 190972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324470, "uuid": "aee45e38-89e9-4c43-8223-b5c5389ba891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324470, "uuid": "6c148e70-67b6-46b2-9e73-e3ca14d6cd88", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a6fcd2-275e-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774342426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342426, "uuid": "192d599f-1c8e-4142-9e5f-0b1afb9ac3c6", "comment": "Malware payload (NirCmd)", "value": "308a6c9a772b45c739416d7d1c2405c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342426, "uuid": "244184c4-ec6a-438c-8791-5ad187ba4915", "comment": "Malware payload (NirCmd)", "value": "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342426, "uuid": "5176206a-03e6-4864-900c-a29ee3ccd83b", "comment": "Malware payload (NirCmd)", "value": "0f8b89508282697a7df0203171ef261333c67759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342426, "uuid": "a6011501-df7d-40f7-b949-d25546ff89dd", "comment": "Malware payload (NirCmd)", "value": "27aeba49f9763976af337502f02a5b58dd503d02626fd44b238c556c60f775a8d96dd4b17adfb4fa4505220397f0025c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342426, "uuid": "a18c2e03-4b3d-4ba8-943f-edc0730e1f0e", "value": "T10DA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342426, "uuid": "e3c18832-7c49-4473-b16b-01b7e26d36d2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342426, "uuid": "643b255a-6018-47cf-8b88-090f0c857f90", "value": "49152:ABRSTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aUTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342426, "uuid": "91c587e3-b3a7-4565-bff0-0929dd806dd6", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342426, "uuid": "c0eeaaf7-c8c4-4cc6-8504-e72ccb7e5d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342426, "uuid": "0e382d96-7217-4f31-84e3-1fe19a5575bd", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f4637c-2734-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774323978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323978, "uuid": "c9cb03fa-054e-4e37-8add-fa1720485d8a", "comment": "Malware payload (Mirai)", "value": "f72d3c1e522bd63632006b4fc4975644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323978, "uuid": "6b09461e-1d0a-46af-859b-25532e4dcb73", "comment": "Malware payload (Mirai)", "value": "afb17921f416180d1c1382c60915edb91b436c4fbd1f599074b993830d46aea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323978, "uuid": "1d5db1b5-c90c-46ee-80bb-4fce46def63a", "comment": "Malware payload (Mirai)", "value": "014e8a50c411c6f5022663dd436cae42245825af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323978, "uuid": "32cce1a9-5733-4c28-8777-79d70f962f6f", "comment": "Malware payload (Mirai)", "value": "d465276ab1eedbed1c82cef3935b996942f07a80cd45b3aa57a6d0f9dc30fec06c86fc49be2e8a59d2fbf1cfa8ff7068", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323978, "uuid": "eac401d5-338a-474b-999c-6eca55057ae8", "value": "T1A3633B56BC815A12C6D122BBFA6E028C372653F8D2EF3213DD256F1177C691F0E6BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323978, "uuid": "585187f5-11b6-4339-88bd-a430689b00f0", "value": "1536:O6ZldTguLBB/1FpxGitq6HqPy0TI+jGchWi8sQJ9OK3qaQaH:O6ZldpBHpHxQT8s213T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774323978, "uuid": "509b454a-3656-46c1-990a-b8f352650338", "value": 71644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774323978, "uuid": "b0397aa4-495a-42e1-80f2-ed192da7faea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323978, "uuid": "cd6eb5d8-3f37-4055-81e3-a882a42d0a11", "value": "tux.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdf077b-2788-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1774360151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360151, "uuid": "369eef03-9262-4e0f-b4f0-3c7e9e93a093", "comment": "Malware payload (DarkTortilla)", "value": "6c60e36c638fa4b31ea85db15344a018", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360151, "uuid": "8c3e6799-2b9d-43b4-b714-d0d6b295200b", "comment": "Malware payload (DarkTortilla)", "value": "b1d12e87ce9cda9056644c162768ff0d4eda80cf43a1d74875657233dad64928", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360151, "uuid": "d5417d8b-8d48-487d-ba1e-a19125aebf63", "comment": "Malware payload (DarkTortilla)", "value": "0262f538b1527e08da22e12b944293361b4bf2cb", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360151, "uuid": "a1ab0834-4545-4af8-9676-42ad2acfbac8", "comment": "Malware payload (DarkTortilla)", "value": "6eccc7cbf81bc1d159fe917f07dfa80bce455669ff70042c5ae18b340ea2df2727acdae9491dfbaac4a30ca4a3ff1731", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360151, "uuid": "2ccb0fa2-41bc-401e-b5cc-6617b5a702a7", "value": "T12FC4A57D3FA15A2BDFDEA23284418219F1B119737A41968AAFCF17DB97523C26D02CC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360151, "uuid": "60a259ed-f1f5-4d42-8b9f-956d07e08262", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360151, "uuid": "d30a2cae-a22b-4ab9-b7d4-b80c9aa64670", "value": "6144:goNC8DOx/FKXPnKGS+MBn56y4sXcV51FOgGDl5zudbOSXDyhvMd:goNCZVO7FMNm6xJxYyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360151, "uuid": "0f72a245-e2e4-4990-a714-132d771cd0d4", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360151, "uuid": "528714e1-0578-4a9c-961e-3b3462af0780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360151, "uuid": "47056bc3-c4c1-46b9-9bf1-b7079787d042", "value": "RedLine Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d56bc6-273a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774326930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774326930, "uuid": "5293c626-b828-44a5-aff0-f443d285d246", "comment": "Malware payload", "value": "9eaf3b9cd85b3b97102726dfb9c0fff1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774326930, "uuid": "29be8a60-0eb7-41f9-a870-c30aa5da3d64", "comment": "Malware payload", "value": "b23f68dad54fd1a65db2f21f0d26aba3b973628220cfaa2258a4246b817090f8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774326930, "uuid": "20df6802-49b8-4d07-9301-307a61be9d69", "comment": "Malware payload", "value": "74185651ecfa97b41ef149de26708914ef05b9e4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774326930, "uuid": "05f266c3-d43a-47b2-b8d0-6223150b86b9", "comment": "Malware payload", "value": "58d8f0a200e73ea83f8a83281e2aba2a7a0273f69cec1c398e4811d1f4bb471511a844a34fe57b27d199157c84b96c21", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774326930, "uuid": "96f642ee-7a3b-4324-9d00-dca411608bde", "value": "T12011578738CD4D7AC225AAE6C5F3A54211F242834C806FC8B4D42D58BFC6FE89728D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774326930, "uuid": "e38b6292-3346-43cc-b695-3eb6557dabbd", "value": "24:VYlde8YE/ZanyZbGWcZahRMZ9RP/COCV6qPHftdaXo:VYldeX4Z2yZbGWcZWRMZ9RP/COCV6qPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774326930, "uuid": "1227c35e-af1e-4459-b717-e4297aa8e3fe", "value": 935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774326930, "uuid": "a53ac459-e4fe-4122-b536-3d37cbfa48c8", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774326930, "uuid": "30da72c8-1e4f-4c12-a612-b38d62acbf07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50cc7bb-2794-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774365560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365560, "uuid": "5d4005e1-b8b1-4d3b-a8c4-63b02b1b2c15", "comment": "Malware payload", "value": "7fff5ea1b522f1bcefef82dad08293f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365560, "uuid": "5ae76824-fefb-4f07-9d4a-b38415b595f4", "comment": "Malware payload", "value": "b56193b7e81689a451f01dcc5956fc31f20ed8facf59e67da3d59796ee2cb54f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365560, "uuid": "384544f3-4905-4cb1-aba1-286ca2360008", "comment": "Malware payload", "value": "19d971f5c15e76fa4614156fc94dd2e5cc2c7b4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365560, "uuid": "26f4d73a-3dbd-4af9-8649-c1b01843b4e1", "comment": "Malware payload", "value": "5f39dc0f3cbab632ed38777d1be281f7a413436d9a683ce00a4b41813771548450d7084fd651142bc9b9e79c76ac46f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365560, "uuid": "88c41964-7282-447c-8a39-c0b2e1fddf17", "value": "T132A27D7620F08A735A9015C4B37317A15FB2955B45A320B8B4FE2B399F69B03B4FF621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365560, "uuid": "3bbbbd17-2dc0-442e-a290-fcde727f6bfa", "value": "192:c5uU06L4hvZ5mN9oKNpivjFV3+gukIFzITh5oeyeVeO:6L4hvZ5mN9oKNpivjF9+gukIFzITAXGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365560, "uuid": "585ae881-2b19-43ec-9742-6b4a91c7c76c", "value": 21938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365560, "uuid": "99319c72-e1bf-471a-a220-957ba72d78a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365560, "uuid": "a218b6a1-5015-4030-93c0-42ccf0525660", "value": "b56193b7e81689a451f01dcc5956fc31f20ed8facf59e67da3d59796ee2cb54f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c7e1e8-27c0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774384488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384488, "uuid": "720668c8-94a1-4500-b83c-137cef718c88", "comment": "Malware payload", "value": "464c995d4448147757946aa64984fd06", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384488, "uuid": "755fe3ed-0bce-43cd-885d-3dd203784c3e", "comment": "Malware payload", "value": "b6dc5c1e1ddef7a543288e080b40a8c6acc143fe258c7889ce68d57ab153dee5", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384488, "uuid": "55b75f0c-9d6b-4bf6-a4ab-2df6ec45bc7a", "comment": "Malware payload", "value": "fd000da4dc623010a13a93f6055e363546f78098", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384488, "uuid": "11224855-cb6c-4e7b-9ae0-aca353100324", "comment": "Malware payload", "value": "95a1269ecde78333693ac80c43563de619032adaceb2f70eb4a79a3ab7bad856169fd58785779a925e3befd233711a81", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384488, "uuid": "d7d6792b-a63e-4ebe-97be-0944c560348e", "value": "T1E1558E6E97A31291DA7AA70422AA391D433E4C5F14F23B497F0D2FDD1F14A7A17B809C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384488, "uuid": "4d1bc123-08a7-4c4f-8b7d-90b15c7ba8bf", "value": "24576:Frs7yxKk0/u/MjMRR+Athg+T14bWumF7yxKk0/u/MjMRR+Athg+T14bWumg:FrOC032C03D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774384488, "uuid": "ffb8750b-6d69-4c49-9210-a1319100ddc2", "value": 1300895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774384488, "uuid": "0c6c9db4-2c3d-4c18-968e-d719e5ca8d87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384488, "uuid": "34d8d328-4c91-4e6a-a9f3-a67368a667b1", "value": "NUTA_darwin.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6722a8-2795-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774365841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365841, "uuid": "125bafa1-9f74-4ef1-adcc-e32845ea2484", "comment": "Malware payload (Heodo)", "value": "91c58619bf8cbbba360b6e66cec293a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365841, "uuid": "289354ed-ffcf-4149-bf58-fc8e4f8b3add", "comment": "Malware payload (Heodo)", "value": "b85edd0293e86aac225f74bf738fcd6b682c327884d39f7adbee94a6d327c0bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365841, "uuid": "1c448436-e570-4c2e-9979-071aec1bfe38", "comment": "Malware payload (Heodo)", "value": "e0a95978cc6f1ee876ed7a93530604c49f345e0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365841, "uuid": "63cb4cc4-2ef0-41bd-aca8-569d88d60d38", "comment": "Malware payload (Heodo)", "value": "5004bd76f42f4663f9b1eaf2c125ac49838d6ac9906413e9e5037dfd9d1675c685c5da81ba64e9ad7ea7b85037a8acff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365841, "uuid": "de5dfcc3-1414-4cdf-af98-dac691fd0b48", "value": "T1FDA3AE93F2C1C9B7EE6924F672E513120937C9364347C9D72BB4288C4DB2DDD19B8689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365841, "uuid": "a38be44b-b39a-4413-aeb7-3806a9a8bd70", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365841, "uuid": "27dfd556-1a2f-437a-9d76-edae4d646fae", "value": "1536:GnWk70QVney6hemqIQ4+Gc3QPq4ZbQBPDWqvbf2q8t:WQ8MheXHr3MmRWqvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365841, "uuid": "880c368c-686e-45a8-8386-ba19d2609f1e", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365841, "uuid": "f95cc515-b8e7-4fcc-af14-60f8e5f1332c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365841, "uuid": "5cd51c9c-0c49-4883-a6ed-e276492f087e", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806bba1c-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774343514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343514, "uuid": "3e738d54-6e85-410d-925d-f95f2e0d1335", "comment": "Malware payload (ValleyRAT)", "value": "239fc04b7599629b821e8e6f017c8c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343514, "uuid": "af044246-6b16-4e4a-abd9-ff436b5dac05", "comment": "Malware payload (ValleyRAT)", "value": "ba3450c84925b8d452637c6c84f03259b4c9a9fc0efd90a66ee5bfeb9931b1e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343514, "uuid": "8ad57150-bcd1-49c8-958b-c26a1121ec30", "comment": "Malware payload (ValleyRAT)", "value": "c04c15660a70977d4f52a4df53e8380fdb0a34c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343514, "uuid": "744a0eae-7245-4363-aabe-6451cec99b8d", "comment": "Malware payload (ValleyRAT)", "value": "ecabfc0b9700982928c807c747da6410b553d479d4a2d96d2e17ec169e2fd09acd8e520ccec951f0b593cdf5ebe5c20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343514, "uuid": "6ed39efa-da82-4142-9412-617f87ae8331", "value": "T14F74AF07F79320FCD25BC07446B7ABB3B532B45912257E7F56A8CF321E50D601A6AA38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343514, "uuid": "124f03bb-4932-4af1-86b1-4e4a87a44912", "value": "c91b5d1fc2b26d4447fb19a80a29cde9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343514, "uuid": "0c4f0d6e-c6db-4f02-92d3-a33d9c236960", "value": "6144:F+oiuRnRy5JxoLojA8FPR3zOzGku55SW9Vtul+7xXS++t6pUAEORUr/O:SwRISojAaOqr5UW9Vtuii+KdrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343514, "uuid": "9772c895-6fda-41a3-97cc-719d2d93198a", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343514, "uuid": "04cdb720-68b3-4526-8cbf-8cb4d7a801d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343514, "uuid": "cd45b515-5e60-450b-9428-2800c86493c1", "value": "239fc04b7599629b821e8e6f017c8c98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f980c8e-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383778, "uuid": "ed104416-0fd7-4199-9b4d-720b11a2f377", "comment": "Malware payload", "value": "dce9cfa95b1eb1c815887058bf9d3f2f", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383778, "uuid": "1c5f1fd0-e9e4-4951-8d7d-c6c42de6177b", "comment": "Malware payload", "value": "baeeb416eb46e13927c462dd392bc03f7734a70bcb7a24c873e1b3c42f04304f", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383778, "uuid": "dab9bc81-7392-4e21-958e-602564f256b8", "comment": "Malware payload", "value": "1a446913c72521d4ca8ed4e1f52f3ca0878c4d22", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383778, "uuid": "efc89552-20d6-463c-89de-e68f3b3a8772", "comment": "Malware payload", "value": "c147da92670d4c4e1a9edbaee1e9548de1a869cb6469bb943eaf0cfc4f6d0bba73e31d658803509e0867803998d8f72b", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383778, "uuid": "09e1d1b8-ecd5-4edd-a99a-9bf962ba6872", "value": "T11C558E6D97A32291DA7AA70422AA391D833E4C5F14F237497F0D2FDD1F14A7A17B809C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383778, "uuid": "337698fa-89fb-4d0a-a822-8b58a2a866a9", "value": "24576:FrC7yxKk0/u/MjMRR+Athg+T14bWumz7yxKk0/u/MjMRR+Athg+T14bWum8:FrEC034C03v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383778, "uuid": "24623e10-0c16-428b-9050-20eb556853be", "value": 1301097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383778, "uuid": "1cb2ed85-5b3e-45a7-a5ee-f949e276f238", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383778, "uuid": "0b02760d-9a4c-4181-84a8-dd033c0c380f", "value": "3e4T_darwin.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830f7e21-2794-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774365423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365423, "uuid": "c1089fa8-5849-4a2f-a12b-f3439efdc0cf", "comment": "Malware payload (Heodo)", "value": "8b76363424fce72df1f5b7ec2081b69c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365423, "uuid": "8b68f2f4-8c29-4292-b738-0c491974f9ea", "comment": "Malware payload (Heodo)", "value": "bc5c22289244aaf9918844f24121d4c5012feb63a270d6f40a386017155881c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365423, "uuid": "3c2e750c-b7de-46de-955e-e57d784a0724", "comment": "Malware payload (Heodo)", "value": "224bb3fc28bc3d3c1138192d3da65c5f72b9235d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365423, "uuid": "9e1f81cd-1314-4f26-9b9d-b6077adaf740", "comment": "Malware payload (Heodo)", "value": "1868f8ac186a68c9c8dcd06291ca8bb840fef4cfa492c57a9e41c4da93e292eca798dc37eedd6d10cba2e3f585e0fc9e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit executable", "colour": "#69CC2B", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365423, "uuid": "e1a864c2-1789-492c-9348-da07d8982777", "value": "T159432A03BB81D8B7DC5E95B912CAD59A2A67EE7003071AC383B334B31DB1DEC14B4989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365423, "uuid": "e36cab0f-8881-4b99-8fbf-eda3f63dca69", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365423, "uuid": "4b630232-c420-463d-97db-955acf00cad3", "value": "1536:tnW/+MPwg0GwVdaT1mgojaAhB3w7EHEFkb3iRPd0bi:/GhBmge30p2Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365423, "uuid": "7e6a1d70-7cf8-46e9-9077-57676beaebd6", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365423, "uuid": "c5854247-b2a3-4434-b15b-145911dfb0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365423, "uuid": "02a42e6d-6c0e-4482-8780-0e2862480baa", "value": "Emotet Payload: 32-bit executable.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b31cc2d-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366940, "uuid": "9fa02cf2-50e2-4fd7-bab7-5b66c606f4be", "comment": "Malware payload (Mirai)", "value": "f58e90979222276e1aa568425d8dcb13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366940, "uuid": "98f3cd18-67e1-4608-bbb8-38ff7a0c2a4e", "comment": "Malware payload (Mirai)", "value": "bc891655e089c845fa3cc0976c42c8559f334888f218906cd171dbf2141a3f84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366940, "uuid": "1d8b4eef-7de0-4b45-aa3e-3d41fea4a874", "comment": "Malware payload (Mirai)", "value": "f75e561193802d1b191604f344a7cc3895af66d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366940, "uuid": "b55ceac9-cf6e-4a02-9674-893a75198b59", "comment": "Malware payload (Mirai)", "value": "f698567de457c78eea83ce8eee62667055dc103cb34f9d9ec59d6614a1251eb1d37377f8303d898d440720831bd354ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366940, "uuid": "38f9d302-a38f-4afb-b2c3-cf4f934b293a", "value": "T124432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366940, "uuid": "0d8c068d-9685-4e2e-9036-a82bb236fdd6", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIrQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI1BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366940, "uuid": "5e0f752b-9f12-490b-adcc-d3af3f05c3ff", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366940, "uuid": "09e791b0-b6fd-4087-a863-91c094531fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366940, "uuid": "b893aa86-1fc5-487e-82b3-9b6b1688d176", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775dee37-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358961, "uuid": "bea89632-4858-4e73-a168-c97b58f9a7cf", "comment": "Malware payload", "value": "767f1f2b1f0ca6f1b6459d958a8b5338", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358961, "uuid": "9c686696-6fea-414c-bf04-4911df96e6da", "comment": "Malware payload", "value": "be93b74c53d755f75a20c938c4029cd692fcf7840a6587ee560ccce886fae32f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358961, "uuid": "a7c56cb5-ba9a-46d5-b691-d016d7fe7c7a", "comment": "Malware payload", "value": "fa34b9a1811d7b095b78adb1cc564a9b17899523", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358961, "uuid": "847a57fd-047c-4afb-894c-a5a453f26d81", "comment": "Malware payload", "value": "19d4b6b817e8c8d4a0bcf9789c1eb7563d8b07a065e141277501de074e11e91275bcd9cd92fa327f10c53e7d72afe942", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358961, "uuid": "273596a0-d806-4bf5-aff5-0f8172471268", "value": "T110C5F2334E24192381C7CD25C50B9A84757C5826FBF05A8B7EA14C9D86FCED99FF6888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358961, "uuid": "0784e33b-5d3f-4fdd-a161-baa54ac68c94", "value": "192:9QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQL:+jPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358961, "uuid": "0486b4d9-b334-4694-b5c4-e1d994fe74a0", "value": 2580785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358961, "uuid": "97f881b0-500d-4185-b56c-bcdcb6dfd867", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358961, "uuid": "d9919510-ce22-420d-bde0-9abd75264359", "value": "767f1f2b1f0ca6f1b6459d958a8b5338.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea57e32a-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774343262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343262, "uuid": "148180c5-674b-4520-a41e-347185998220", "comment": "Malware payload (Mirai)", "value": "b6bdd9175bad611340f8a448c9878076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343262, "uuid": "b50a613b-2c20-435b-9a5a-87c0d82908a6", "comment": "Malware payload (Mirai)", "value": "bf2f32cf70d2783d25d1df96f63a0bb00c6fd8cc12f55339c962e11f08326732", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343262, "uuid": "4c5cc9ae-4b12-4cdd-8eb1-29324799d88d", "comment": "Malware payload (Mirai)", "value": "4b689def5b53b94afc24e6da9609541185551df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343262, "uuid": "ee6fa8a8-165c-4a0f-9658-29ffe02d0872", "comment": "Malware payload (Mirai)", "value": "c6a0aa8eb10f3f5e7f32f57a136fe199058679ae84e9e8167c908bf05d67b24e48a824a45757547211d838666e16851b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343262, "uuid": "493ce34f-59e4-44d4-a0d0-a22ee19a2d5b", "value": "T16A733A55BC818E12C5D112BBFF5E429D372A13E8E2EB3217DD295F64378B86B0E67201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343262, "uuid": "08e53692-a968-455e-9e1f-bd42e309af54", "value": "1536:B/btsS7p+P93m4LsrrO8zu9585DawjETGiu9nzZO1dfFTSEQyEWE:B/bv+oWsrxC95OzjEqisATSyE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343262, "uuid": "828495a3-c30b-4e78-8f7d-a9aadda84c32", "value": 75460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343262, "uuid": "bf6dcff1-0d43-4d97-9078-819bf8ce8a4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343262, "uuid": "f2831a76-c3d0-42ac-8fca-550aae70b729", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb5acd3-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386462, "uuid": "ac8966dd-b4c3-487e-ad07-c1044a0a0e18", "comment": "Malware payload", "value": "f4eba2c06bec52f9c525ee441b5f8910", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386462, "uuid": "508d2131-42ed-4a4f-9b97-8511ca72d80e", "comment": "Malware payload", "value": "bf664aecde67824142fd5cc34bd7230afbf99a0d4018df13e96b9560be073e6b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386462, "uuid": "1a02f7ea-3234-4f61-b2d0-02c6c34d3d6c", "comment": "Malware payload", "value": "96ba053d9881dd4c05809a75b0e52578e0e7eb0c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386462, "uuid": "d6d3c641-344b-4cf3-89df-a55a3ba21766", "comment": "Malware payload", "value": "60f0585d844ad97776c7f03e9c8f1d072825c891b3bdfe6253cd3803bfa3d64441632b3d7885f233d4cc4d5e1c319eb7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386462, "uuid": "1110e619-6737-44cc-9d26-8c4a9b43df5a", "value": "T13FF67A21B2548136C4EEDFBB9168A2B64EE9FCD01712D2D7619432E96C73BC11E3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386462, "uuid": "fcba3ca4-c426-4bff-8ff1-301fc08ca939", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386462, "uuid": "b33f76a0-62aa-4321-9096-2ee7397e237b", "value": "98304:60X51GxhiehH7MZcniemZ6jjUMLgGuTQcT2TCIpz2EBge3JEICRJQU4AiTBBM2Fj:6APIUZPgjUMLcul3JEjJQU41tBMxs0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386462, "uuid": "18d03a0b-cfa0-420f-b4c4-44de10f3597e", "value": 16756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386462, "uuid": "b6c1eaf4-58f1-4a0d-b6a3-0d53235b28bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386462, "uuid": "40144beb-3fbc-4f32-8d93-8c5dbede8b64", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad9af51-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774342887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342887, "uuid": "36845bbe-0a32-4746-adf7-3a78dac57cd2", "comment": "Malware payload (GuLoader)", "value": "2d3949fde69d9b09395f0467fadf44bf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342887, "uuid": "e57a08ae-e560-4665-8212-774e1b3d14e7", "comment": "Malware payload (GuLoader)", "value": "c09f37d646ea6299fce0ee26180364652a212d57dad0fe6f6d1c82eb09100e1e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342887, "uuid": "075e9df8-0437-40ef-ac86-98c5905d127d", "comment": "Malware payload (GuLoader)", "value": "ef00abd6d16e3a0b978e35b4b20a4c433e62c4d7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342887, "uuid": "dc55e2bd-40dd-4007-a875-784d83fb75eb", "comment": "Malware payload (GuLoader)", "value": "55c3b443b237e2ebb1a23699971084087014d541ff533bb530afc8ceb4fd0733e9d37451db3f8074a3c5b50370b9268a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342887, "uuid": "b6ae6ba1-320b-4c91-be51-3acbb8b124a8", "value": "T160B4130572ECC493CFA24B30AD689A73DBD6BE110428E6036710BF6EBD313A5950776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342887, "uuid": "26eb1d23-5ec9-4c14-bfa9-8edfccfffc7f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342887, "uuid": "1f162931-b3df-4ade-9825-ec800bafbff5", "value": "12288:sgiOOe4x/WJqKKsXY5S96FCrlZEayoN4nVlZ9ctdKmemJ1cV1:1Oe4oqKKBGlNy84HUImPcV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342887, "uuid": "14e7e0e7-7200-49f5-b3ed-d5f61d657caa", "value": 512048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342887, "uuid": "64b7a3b6-b692-4c1b-aeff-9b5bcfcd5914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342887, "uuid": "48494dcd-2e35-4ddd-8a72-12c4004b2c4d", "value": "Awb_DHL_bl_original_shipping_documents_doc.uue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d9cc83-2777-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774352940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774352940, "uuid": "f98f3892-9b4f-42af-90e5-3573f47d6028", "comment": "Malware payload", "value": "a3bb510d12d3e2b071179df7a2304add", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774352940, "uuid": "9e0378b2-ea03-4f69-a52c-8044386501b5", "comment": "Malware payload", "value": "c1717dcf52322b7f9cd088c0bef474f41f60833b8c45f75b1fd28fe7fb96a17b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774352940, "uuid": "0c66ef06-b43b-4032-94cb-f5758dbab947", "comment": "Malware payload", "value": "bad12f49e49b4607f5d83ab424a8d4c7e4b7c414", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774352940, "uuid": "11679274-c399-42d5-a3ed-026f20891e86", "comment": "Malware payload", "value": "f506653aa1adcff72494046f4418679dcfaa3b827a0eddf8b6742536b37e23f3a459dbf8851423f48cc72dd83dac20d5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774352940, "uuid": "bcb3c921-bc8e-4220-b38a-f29e75723a32", "value": "T139F72312B887D3FED49A02390547DAAB4B6D9C0847F6E4CBEB5E75270C360C8563B6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774352940, "uuid": "46db931e-47d9-45a6-b99f-c29b5cb03a35", "value": "1572864:74G4WL9a4JBOxfBhLZYm2HBecMdiiBZDiQxwP/xujxLhx:7v4W4EcNWecI/hxm/xujx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774352940, "uuid": "fced4145-1c02-4c9b-bcbe-8c84b9245641", "value": 76259328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774352940, "uuid": "22f405c7-fbfc-4694-8794-3465e65161bf", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774352940, "uuid": "f499a42d-4c97-4716-abe7-70fa891e4162", "value": "NetopSecurityServer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4637e78-276e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774349211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349211, "uuid": "9309e908-7145-43bd-8580-8b3c93490698", "comment": "Malware payload", "value": "eb089b494297510afbca0b3990eeadad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349211, "uuid": "de74b951-e3c7-44ef-87b5-88389f8198cc", "comment": "Malware payload", "value": "c23947d93c6add656e128bae1bb828eacbc622c27b080202a98c8ce1664293e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349211, "uuid": "4a9c12f1-574a-418d-8794-e4bae9c65cfa", "comment": "Malware payload", "value": "c5da86f1502a243fbaee606a907c862c71bb2937", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349211, "uuid": "1d10dc4a-d757-4c61-b5a3-895178ee3b08", "comment": "Malware payload", "value": "adf3a285d8a30b2212f1769c91fbde81d11ae7667f76fdb325b125b7264a5522d2a8baa4b2e1afa7c7ce51522e7d8176", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349211, "uuid": "30c1111a-0c7d-4666-a93f-0b485b45a0e7", "value": "T180669DA4E0A355A0D9070CB4857FFA6F6B255E299220CCF3E7E4B954F9F3BC0570858A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349211, "uuid": "7dff4cb5-1f8c-45be-a703-a83fdf5888c1", "value": "f11716690dc3b1ac312b344caaf28102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349211, "uuid": "5d462cfd-4fba-4ae7-9d25-3ec41c692704", "value": "196608:YLKQ5UsLthxhmnVrf7V4hl4jhRUuiJJ9HOe5:Hf7ml4jhRUuiJJ9ue5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774349211, "uuid": "98be27bc-5d25-453e-befe-ccc260ff6cd7", "value": 6892968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774349211, "uuid": "31a21529-7242-4ac9-ab3e-e96161a14d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349211, "uuid": "ea50cc94-f9c2-4794-93b7-92f2a265afa7", "value": "c23947d93c6add656e128bae1bb828eacbc622c27b080202a98c8ce1664293e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2830a00-2787-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774360026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360026, "uuid": "45457b82-0ee0-48af-8698-d4b3252fdfb0", "comment": "Malware payload", "value": "6f58b5c4b0545eb5fbbcf78f547918d5", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360026, "uuid": "459b2807-cc0c-476d-a331-92b508aae0f6", "comment": "Malware payload", "value": "c23c9b0248323334f8706fa7890d8b8822fd3dba2aeff10aafd25033de646fa2", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360026, "uuid": "f8618c71-1841-4d32-aeb4-410092e2076c", "comment": "Malware payload", "value": "365828e2a38a9872977bc5c50d223b39901bfe6f", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360026, "uuid": "0c2a7c13-2916-45d4-ba64-0051ea9ff6f4", "comment": "Malware payload", "value": "f6048d4783dd14c93bfd5cebe4d4cf3033e88f2513965e1e59880fb82151cb2daf0a1c58379ba70a7f4afaf293bdb916", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360026, "uuid": "33136947-8396-438d-85be-b41587e72865", "value": "T16314131D4E362F52B8F5762205A92D7ACC41BC122772FD84787946CE8A37B347A38F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360026, "uuid": "e29719c4-da53-4265-ba25-b79c4a3b3222", "value": "3072:T9h1/y8LCyGNdpq7NhcL1821ttbKLlPekmfhhSjprUJfNiR/+O6z3wJsWqoQmUVX:CNKNhCrtRKLNlgXyrmiR/+V0iV1fitW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360026, "uuid": "8c545d6a-d49e-4ee5-8ce6-e82cdc4e745d", "value": 196570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360026, "uuid": "c986dfdd-30cd-4333-84d0-ffa76a271ffc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360026, "uuid": "2b7747ef-ffbc-4e3c-9023-6fd79cfb391b", "value": "AAM UpdatesEqn.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc91686e-2735-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774324744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324744, "uuid": "8005cab3-0f4c-4095-acb6-a347f00fbb47", "comment": "Malware payload (Mirai)", "value": "f27097859d09235a57bc6df2958ef322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324744, "uuid": "d2ab643d-aeba-41ce-9053-654f41db0c7b", "comment": "Malware payload (Mirai)", "value": "c2730e947a040529c26bfdac395bdd563dcc505317b1e6e3967b196c8a9de69e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324744, "uuid": "87a973a7-b390-42bd-8f96-0525de6b7fbf", "comment": "Malware payload (Mirai)", "value": "9e18c61d9297289a410d5ec9d6ecce1234ce813a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324744, "uuid": "a408a8ab-d161-4854-9534-d30f530bbb5a", "comment": "Malware payload (Mirai)", "value": "ece1c75c4e031eac5513fe519185b59f1e816fe6ac90423a9966bbad6b113d2feef2bd35b4df2e304a49c13181803d90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324744, "uuid": "e4763ca2-852c-4593-bd82-393a047f0ac9", "value": "T1CB93C80E6E319FADFBA9833047B34A21979C33D626E1C685E19CDA011E7034D745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324744, "uuid": "b119cce0-bb9f-4879-a03b-b8709a7f98ee", "value": "1536:okpSZ796xrSdeD6WD6F0vuRIbiNsHW5cZ8zHq3ICAGYUXAg6iq5LCoH1xJepUlaR:bSZ796xphZGq3ICvXAg6iq5LPHnjp7VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324744, "uuid": "2fc594b6-2f14-4fd7-9c1c-dd99dfdf9cc9", "value": 93016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324744, "uuid": "b40c5ddc-7781-4a59-bdf8-ebd1e40e1fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324744, "uuid": "33f2d80c-aa30-4b62-801b-a1490cdaae2b", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2eea3c-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774367024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367024, "uuid": "777fb121-c86f-44e3-b6ce-4719d822b6ed", "comment": "Malware payload (Mirai)", "value": "5e91b14eaadf0c980096921a9933b115", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367024, "uuid": "ff55c712-1073-4d58-a1c9-01a7350fb4aa", "comment": "Malware payload (Mirai)", "value": "c2e817e3ab4e20662f06f0463cc0c6e8a59eb18a593bc64025a73b7cd9eeb476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367024, "uuid": "a3406d3c-c1e8-4896-a370-77a4b3d849b9", "comment": "Malware payload (Mirai)", "value": "66313b25588e5317b92971b888c73bc7329ad497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367024, "uuid": "14f5e556-e546-4f34-a0f8-2a989ee8aeb3", "comment": "Malware payload (Mirai)", "value": "3663aed20c820741d65deac42451d1b7c7e13f7a2e77b8b85bddc125e25adbddf66b8d69318fe37ca02d5ba9a6aea889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367024, "uuid": "40f956be-e00b-488f-a957-b63c52c908ee", "value": "T1DC630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367024, "uuid": "dc62b926-bd01-43b8-ad1b-8fd84517f254", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFl6r57uscvIGiojd70k7h:VqVMkWV8PP99Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367024, "uuid": "df00cbf9-711c-408c-b60d-99372ce4d48d", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367024, "uuid": "d0c8f629-3512-4a94-bb15-bd460a2d6548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367024, "uuid": "99badb21-56e3-46f7-ab62-db021a544135", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e607b419-274d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774335095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335095, "uuid": "8facbf95-800a-401f-a485-b4e0e7fd2fbf", "comment": "Malware payload", "value": "b0946a799baf78be0b659e8f39e289a5", "object_relation": "md5", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335095, "uuid": "b155a05a-10d3-434b-9107-fba9b7cd11d1", "comment": "Malware payload", "value": "c34bd7424a6d79a38693087455220f0832c3b100c064057961267ca22ad1d45d", "object_relation": "sha256", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335095, "uuid": "eeb96040-c266-403a-8e40-7f04bb8b7ea9", "comment": "Malware payload", "value": "0f08d41866c2b0fc11a9a203ceb4216b997157cc", "object_relation": "sha1", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774335095, "uuid": "553b486c-6805-4cd1-9f4d-c772cce5b182", "comment": "Malware payload", "value": "c21119e9bd56988d66bc3aabb9c04a04e6a21ff2ac9bfd780df5c92f06c6d079e182a32754e6516fd7ee2744d362a666", "object_relation": "sha3-384", "Tag": [ { "name": "45-61-149-150", "colour": "#ADB6C1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335095, "uuid": "e4084898-822a-49dc-a9a0-4d8e97c068dd", "value": "T1AB759C97AAB820A2D2A2888DCED0F86C4E0DB44924F52FFC759B49F50731555CF6CE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335095, "uuid": "04991986-1123-430c-8355-82066d6ac0b2", "value": "96:zddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddi:bSpOgvi1EEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774335095, "uuid": "4b883640-0f43-40c2-830f-262d33d59998", "value": 1646196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774335095, "uuid": "bd760ab1-9e4a-44e2-9d38-ee6c0efeee46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774335095, "uuid": "c84cc369-199e-474f-b2ec-409e2da123de", "value": "c34bd7424a6d79a38693087455220f0832c3b100c064057961267ca22ad1d45d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f280069-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774342921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342921, "uuid": "fc72ecbe-5575-4011-b113-866743cd89f5", "comment": "Malware payload (AgentTesla)", "value": "c80302c72479a21e8b43dd85829f74c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342921, "uuid": "9ff4e75c-462e-4982-a018-8f36d952018c", "comment": "Malware payload (AgentTesla)", "value": "c39d645738752e76058e473bd4a652aab90678b20714fe53d3bf7c55880680f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342921, "uuid": "9b547d7b-1f75-4f6a-bdc8-1c7a1aa81009", "comment": "Malware payload (AgentTesla)", "value": "45de69bfab9c2aab4a37c6f10e8d306ed544cc65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342921, "uuid": "9846dd5b-6acc-4105-987d-369e19b86465", "comment": "Malware payload (AgentTesla)", "value": "698ba9810a9ce6ff8f0abc79b8138b3a927b4d1d3cbf5322ec7da767b7688ca51fc8477eb56cee8ab7a6f0333731b7a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342921, "uuid": "a4063c5e-7bf3-49d9-9d71-83e5459be6b1", "value": "T1B853FDE00D0ACE94B1C46AF2CF759C65CCD025DA2E5393AB135228CBAF7E5878C56736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342921, "uuid": "75c408f4-93ce-4028-b057-c64e3932677a", "value": "192:60xhaKqXfLuIzOU/9jY+UAKBURvIh1Skh5pcQ9UuzZs92gpHwnu5AMNJ1wCnUk4t:6rc2Ra13ONJ15/395tIAVToG+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342921, "uuid": "87d56627-93fc-402f-9e51-4b4a10a73610", "value": 62529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342921, "uuid": "fd7fe7ee-5157-4b1c-81c1-650136591523", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342921, "uuid": "4e51bb09-97c5-432a-865f-3e0b0430d747", "value": "BL & DEBIT NOTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae16a09b-27c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386111, "uuid": "e2b05b88-5bd4-47fd-bdea-f283f5d74031", "comment": "Malware payload", "value": "f455362f8bc92a5c1242defa0e5ccc50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386111, "uuid": "a30aa512-ce68-490f-9b05-a0f7aeb8ee4a", "comment": "Malware payload", "value": "c5baf8fe00350ce8d1117384ad520583e7742797f3b57d7dcc1a9d759172d2b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386111, "uuid": "79743036-a486-4f10-857e-05bab9ba412a", "comment": "Malware payload", "value": "bf2a97d5837e754f03da5ba26a12f33c0a98c8ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386111, "uuid": "585d6683-b51d-4557-a1a8-1c32f146e284", "comment": "Malware payload", "value": "a58a5ce1e5fa039f0a45b205ec238e20749b8a085cfa817ec633e4cc55861433f551f12e2e3123df07a575962a8a1f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386111, "uuid": "9fce9a99-9f1e-4b81-b678-5e4656a5d6e2", "value": "T15AA5D03FB28B653EE06E5A367A72E210983B666165134C1697F4C88CCF254B01E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386111, "uuid": "97c71539-2d73-4cc7-a9e0-add4b0438baf", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386111, "uuid": "caf48ef6-ccad-4b51-86d5-681cb68ab845", "value": "49152:tuI5hDRzMPRk7396ldq/2zyqzkx0Wm2XN0mo8rsvG4m0+d:t5/DSZswq/Ezkx3m2Npo8r6GM+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386111, "uuid": "717e5dcb-b56d-4ff4-aff1-7b89965a2df5", "value": 2262856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386111, "uuid": "7fe0e4a2-6002-4952-9368-96e904629ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386111, "uuid": "303a8317-b628-40d2-89ea-86b27bd76ec1", "value": "TradingRadar_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13074051-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366953, "uuid": "81256fcf-9145-4f13-b0ad-5146595b8f30", "comment": "Malware payload (Mirai)", "value": "2ea041ae91dd63c1414c312d902a1a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366953, "uuid": "ab3432a6-a3a0-4692-8163-04887661aa88", "comment": "Malware payload (Mirai)", "value": "c65ec056f6ef6038b5876c1fe21671911556f9e5d7a9fc86f2456401459180f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366953, "uuid": "cf6da754-30af-4a31-b31b-84bdf53df0bd", "comment": "Malware payload (Mirai)", "value": "08fa305f950144135783d97db8912f29ca37bfef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366953, "uuid": "863ba153-4af3-4e56-9e26-e2c497e0b155", "comment": "Malware payload (Mirai)", "value": "1c0e7ddcf823f393e5ed5b72899f6f596cf71efb30ff324597969b19cc59f0154b35d44fef4c0197a31e696812239b70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366953, "uuid": "25a1b1a3-cac7-42ae-afb1-0a6aaa76daa9", "value": "T1DFA2D055A5AB3BA1F6742C3CC9AA850237075FF8A1F4317328406DB2E5893473EB4B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366953, "uuid": "c33c99b4-efd7-4da2-9a22-13db9eb1fd97", "value": "384:TvtIoZxrSniaXs+qx+bwqPXdYBRsirKVooF8hwoQFIqn1vWiwhymdGUop5h7:TvQn4j+ysirK+oFToN8dWiws3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366953, "uuid": "37aed165-6981-4caa-a9c5-d184a2732a27", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366953, "uuid": "7b260b96-0537-49fc-84b3-8ad1836a63a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366953, "uuid": "062a9998-25d6-4159-94b7-feb15b2a6354", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad33264-2796-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1774366161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366161, "uuid": "aaf700d0-839b-4875-8205-116578c0cb84", "comment": "Malware payload (Floxif)", "value": "1c8209a81751620b66f2599033cdc443", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FloodFix Payload: 32-bit DLL", "colour": "#BD2BD0", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366161, "uuid": "c07fa5f4-f240-4afb-bb10-319032360f88", "comment": "Malware payload (Floxif)", "value": "c6bf217cef89d4f7adadcca70288dbdc2b6f892f12ec95830e3468fa0871fe15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FloodFix Payload: 32-bit DLL", "colour": "#BD2BD0", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366161, "uuid": "afcd1cdc-c5ed-4c7c-94dc-acb194b4d4b0", "comment": "Malware payload (Floxif)", "value": "3f78ee852259a30350e5e20df089cd68fe89f0d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FloodFix Payload: 32-bit DLL", "colour": "#BD2BD0", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366161, "uuid": "22ab9389-5899-4257-834b-d1d7a3ef10ec", "comment": "Malware payload (Floxif)", "value": "8d8a74fd527f3eddaa6fb73483516f17a4e59c23b99468322c7c62362ef9cd47515dfadc32f8ed87a88b9ea0a1272fd4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FloodFix Payload: 32-bit DLL", "colour": "#BD2BD0", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366161, "uuid": "147b63d3-b206-4285-80b8-8099c539bc2f", "value": "T1B9047C256612CA7AE19200B924AE477F46AA7933131F10C3E3C45D5A2E749E2FF35F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366161, "uuid": "6c068b56-dd75-4f44-9cfc-818cd0348931", "value": "6525f11b3ea23c875495455305482df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366161, "uuid": "63c91fe6-9808-49c4-aa70-94d224686454", "value": "3072:WJ8IMILmCa3yx6oFEdgVXnFdFC9Ugfxm3J9cCt:lkmCaiEoFEd+FKtxmZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366161, "uuid": "4822a0c1-1f42-4e15-ac33-34719799cbc8", "value": 186408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366161, "uuid": "cee8b9aa-1758-49d8-bef3-4cca55cf966b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366161, "uuid": "5a612824-94e3-4185-9f5d-b84cb3c5ecb9", "value": "FloodFix Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f76f875-2734-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774324105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324105, "uuid": "ff97bcfb-4f93-4d1f-829f-38b0470223fb", "comment": "Malware payload (Mirai)", "value": "8915e6f8cf52febe62e928e7b1189c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324105, "uuid": "cc087870-b5e6-4895-8dcb-89841a88e549", "comment": "Malware payload (Mirai)", "value": "c6c92abaa5e6089d5d6fa626481fe6d2318124a7ba6781843d98515dfe914bf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324105, "uuid": "0b8f6727-8566-4eb5-86ce-e73388330751", "comment": "Malware payload (Mirai)", "value": "2ec270c7c270161354bfdd44c5da9115263ab0fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774324105, "uuid": "705e97b1-c9dc-452e-b1c8-cbdf5b2da807", "comment": "Malware payload (Mirai)", "value": "f770d00aab539ec1ad968c77c6ce3f1764acecadb35e17036b833dd282552cc8c9282bff04d5605afa77ce6e3e1df5a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324105, "uuid": "dd3d70d1-b23a-43fe-ac9d-d03df8a3900e", "value": "T101731856F8818F11D5D512BAFA2E118D332317BCE3DF72129D20AF24778A92B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324105, "uuid": "8523bb6d-00bb-450c-831f-0693709e2431", "value": "1536:USnY7JfS2eMM+AFAFrxN3wTbLIomYgDzgas62R3XM0ig1wAMkY5YYSava:UFS5M7Ac/g/LdKDzgasn1w3kY6Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774324105, "uuid": "c1a458c8-3244-43b4-aa69-cd5bbe73743c", "value": 80592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774324105, "uuid": "5a7a8d02-edde-4fd9-b05f-0544a9b004d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774324105, "uuid": "17991f67-ad1d-48e7-98c8-ca67d417e1cb", "value": "tux.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9669141-278b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361648, "uuid": "6dd16f55-403a-4de7-89cb-8f8bea9d2040", "comment": "Malware payload", "value": "c240feb76aa0e1d153201d72b363a2e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 64-bit executable", "colour": "#EB3F8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361648, "uuid": "b6f0f905-80f5-433a-99a2-8116a57d8a33", "comment": "Malware payload", "value": "c740061da4971cdf36a102637f80fc23dbff5769c1ec2156fcd90764237d51e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 64-bit executable", "colour": "#EB3F8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361648, "uuid": "df86c2e3-7dce-4e4a-ae02-21158a591df1", "comment": "Malware payload", "value": "8afa396ebdc9f3b1e9a03e6875f1633efa1020a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 64-bit executable", "colour": "#EB3F8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361648, "uuid": "77e7faee-729d-4a4d-83e4-0fa3c2699331", "comment": "Malware payload", "value": "4080c5ff895deb4f396d681d04689e71c984de15bb1f7f38d94fc1ed46cd541afb47aa55aa6fb268788d94f2f2841cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 64-bit executable", "colour": "#EB3F8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361648, "uuid": "b5f5075d-d79b-43ff-a77d-34a7be6200c2", "value": "T1A1848D0AE770017AD9678174CA279E0FCBF6BC4913209A4F47A57E976F37B21190B329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361648, "uuid": "6c1f73de-8297-463f-9874-a2da0dc479bf", "value": "066b3b46f07bc8ba4f60894d481bd6a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361648, "uuid": "50bd320b-1d50-42e9-88b1-74f74651a37f", "value": "6144:T/aQQeHuezLr8tmq6IV9y8kNY1AS0cfDFC/gGIFZ4O9f/eewsUZVFDPVpr4opQzB:jaKamDIVwybsIXUZVH9vUSj/TBS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361648, "uuid": "c525866d-07a8-405c-8093-8042d994020e", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361648, "uuid": "c2043619-52e0-43d9-b881-d89479eb41d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361648, "uuid": "d4d848fb-3088-4ddc-b81b-781aac36f6dd", "value": "lua51.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c719e401-276e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774349216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349216, "uuid": "ccc8fde0-a22f-4a44-8bf2-5223a2580297", "comment": "Malware payload", "value": "05299617317e60bafa497c93067fe745", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349216, "uuid": "25bee872-fde2-4a33-aebe-2b3ecf9140e5", "comment": "Malware payload", "value": "c7aa94a5b60a7ebcb1efcd3649e93fcdd9c9cc7555b217af26055ad37dadad1d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349216, "uuid": "b91c9d81-9672-48fb-aa47-6cb7ba650ab2", "comment": "Malware payload", "value": "0aa8520eaa1bc85fc06698da2f91f167e4fb1147", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774349216, "uuid": "ca191f3f-c4c6-43fa-a69a-e181c58acb3d", "comment": "Malware payload", "value": "72e364bf3e0de6f6ef20c7d287a79fd50600887e1c5a4c76cedb069c7c2dc76f2c3a85a923cb7897d3979092fc04409a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349216, "uuid": "243bfd96-0f24-4a8d-b94c-7f294eb096f2", "value": "T128669DA4E0A355A0D9070CB4857FFA6F6B255E299220CCF3E7E4B954F9F3BC0570858A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349216, "uuid": "8edba688-231e-4097-9a89-9f049d5c97b1", "value": "f11716690dc3b1ac312b344caaf28102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349216, "uuid": "d91739a3-6e0d-4e20-8e94-38fcb0ae3237", "value": "196608:ELKQ5UsLthxhmnVrM7V4hl4jhRUuiJJ9HOe:TM7ml4jhRUuiJJ9ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774349216, "uuid": "63c95752-6147-43c3-9a36-6ee49cbb30ee", "value": 6894592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774349216, "uuid": "8d089ef0-7c18-4bbc-ab8b-d5107cfb8ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774349216, "uuid": "84b40a15-6bd6-4653-99eb-2aec1c0ea307", "value": "c7aa94a5b60a7ebcb1efcd3649e93fcdd9c9cc7555b217af26055ad37dadad1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b502b23c-2791-11f1-a769-42010a9c0008", "comment": "Malware payload (Emotet)", "timestamp": 1774364218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364218, "uuid": "237439e6-c697-45a2-992a-310e6d1b6163", "comment": "Malware payload (Emotet)", "value": "cf6fbbfb8cab550934dcff59e08c4e06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364218, "uuid": "fc5cb85d-0336-4600-8e18-fdb1f3e68af8", "comment": "Malware payload (Emotet)", "value": "c7bbc23fcf86f5397b98f79d10511dbd3aa7df2ef8f8eb73e2c08164c8521d50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364218, "uuid": "db776c4e-99b6-4e2b-bf3d-8893e13ef21b", "comment": "Malware payload (Emotet)", "value": "dc128794e90b14075b98e3b9546c280a21451f33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364218, "uuid": "573681fb-de94-4d94-a95f-a40bf3122bab", "comment": "Malware payload (Emotet)", "value": "cc6054af4ccce97943beacabb9e79b5ad590cfe9d047f350b7802f995a31ed04c5d99e2b1418b79be87850675ddd8d92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364218, "uuid": "23bf5634-ee2a-4714-af13-10f3cbe738f7", "value": "T145432713BA81D3B7EC99D0F912E961365A6BE83153434EE3537834D2CD22AE42C7438E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364218, "uuid": "e6989daa-8dbd-4abe-8217-8224248fb843", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364218, "uuid": "41b0357c-f55d-42cd-9b9e-12ed36a0e927", "value": "768:JLo2dWDB4TAjkyUEfZGvPpNPqzvuhR/2Q293H7lbqne6ZlOS/1XlkcROFsNj423:tnW1YpEfoHpNSzvuhk9XxMe6/tXlLd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364218, "uuid": "a040f181-c629-4068-8d93-165041d9bfe3", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364218, "uuid": "fcfd5061-ef6d-41c8-8063-99a20ae77c0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364218, "uuid": "803fcc8f-a161-4edc-a426-3c72d555270c", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195ec20b-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774342912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342912, "uuid": "7cdcefc9-460e-4d14-9e12-d3f4b951a1dc", "comment": "Malware payload (PhantomStealer)", "value": "0ca836734f974bb34efa8a7ec2403bc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342912, "uuid": "885d16de-324a-4b6f-b091-507f6401559e", "comment": "Malware payload (PhantomStealer)", "value": "c8491005172140f1b05736e4e1e3fa8bf2d360fbdbe17dc6bf5d4d5b02745308", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342912, "uuid": "5fc7e207-c60b-4ea2-b793-4830f4d6885a", "comment": "Malware payload (PhantomStealer)", "value": "bc5da83205c9d56734558681db22d0a38912f5a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342912, "uuid": "6246bf7a-c256-44b3-91ed-0a5b1d02a9b1", "comment": "Malware payload (PhantomStealer)", "value": "d46f539d448385957db9fd53189f90586e276aa1de73fb79ba173eb96d1ece330707da78747087918684a04b7b3f6e77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342912, "uuid": "37309e6f-8ab5-401e-95cb-89ec2f928829", "value": "T1064517624A3058CBDA34E1C40B507DE9FCA6D14481F5DA5CBA4192E99A4BF4FC6E0EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342912, "uuid": "5e440c38-10ab-4c8b-854f-0beb43cc7d75", "value": "96:xtfBuuVzGGAskTv7TMvxFiyfIicBwikP9OEdkvo/ihyhdI/Uba12iEg20tLib7GA:3ko/ihyhdI/Uba12ip20Ri2Rikef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342912, "uuid": "2c1fd7ba-98f5-45e4-a1e8-ffcb519d37ef", "value": 1199313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342912, "uuid": "1324d1ce-9717-4c15-a439-471b506c68e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342912, "uuid": "6070975d-64f9-4859-a806-d0e10fab28f1", "value": "0ca836734f974bb34efa8a7ec2403bc8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e559292-278c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361952, "uuid": "c36b23c6-7575-49f1-8b55-7f12bd844b35", "comment": "Malware payload", "value": "064acf6cf6c26d3202862fe6495be448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361952, "uuid": "c49dddb6-8f1e-4758-b4bd-2ac687c9f236", "comment": "Malware payload", "value": "c8bafdc9b010a5d0ea4d1bebe404e1f824e2cc31c7485aa2acf70df5a4f5f3fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361952, "uuid": "faccbf4e-4e53-4d6a-9679-8b91c0695850", "comment": "Malware payload", "value": "c78b73d3d3d09981c211b1617d880c2df06dfc77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361952, "uuid": "39cf04b6-c7ce-4a6e-8cde-2228e35324be", "comment": "Malware payload", "value": "b54a2ccc94601509c4875988eff249a79bbdc7443e86461c0fe4c9d948d15dfefbedbae2d2c5aca71d5c43b1b041a0e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361952, "uuid": "c921f563-3cec-43f5-b601-a8be805540dd", "value": "T166068D8BF2BB53B8D4B3C13482E7915BE5713C02AB7456DF1258A7181A736F05E3A398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361952, "uuid": "04f02e94-bc53-4aab-a090-4edf5ca4ddd8", "value": "17d28cf8478c20e28135b1de3bbe2553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361952, "uuid": "9778236a-cdad-49a5-a7b3-c2253ce124e5", "value": "49152:lneepWLENYDi8lV0pBnXcfJiQHMtkBmDtFJsv6tWKFdu9CdPTvG7apHFhh6DhqaD:dpsxwLSyJsv6tWKFdu9Cdioj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361952, "uuid": "313450a8-3791-42a2-bbca-6fab3dfa8116", "value": 3876864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361952, "uuid": "cc2ebe78-63f5-4593-a15d-eec8bbd7c30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361952, "uuid": "42579218-69fd-4c12-aa69-b55df9927cc3", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091c41da-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386264, "uuid": "3d0bc559-3fd5-4d77-8f02-53ec45696905", "comment": "Malware payload", "value": "9d0552c4b993f797482a2e4a67acf7be", "object_relation": "md5", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socks-proxy", "colour": "#C16A06", "exportable": true, "hide_tag": false }, { "name": "tunnel", "colour": "#A83641", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386264, "uuid": "1f14482e-8e44-40e2-ab10-d883b0725f1b", "comment": "Malware payload", "value": "c9444fffb98de28ee1582aac098c2677ecd2b4bb1c6578fbb782c1c338889007", "object_relation": "sha256", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socks-proxy", "colour": "#C16A06", "exportable": true, "hide_tag": false }, { "name": "tunnel", "colour": "#A83641", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386264, "uuid": "b9f0fb1a-05b9-4c5f-a746-6f3ae8e59367", "comment": "Malware payload", "value": "671024e349adbf32cd981757daf9e56510cf4f17", "object_relation": "sha1", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socks-proxy", "colour": "#C16A06", "exportable": true, "hide_tag": false }, { "name": "tunnel", "colour": "#A83641", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386264, "uuid": "57d4a854-07cb-42d5-851c-79b42843f096", "comment": "Malware payload", "value": "eac9dbbf240cff7ea699dc12d63147b38998e2e62f128a6892995f271555201478922c45a6185d29fabe46c34082e89c", "object_relation": "sha3-384", "Tag": [ { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socks-proxy", "colour": "#C16A06", "exportable": true, "hide_tag": false }, { "name": "tunnel", "colour": "#A83641", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386264, "uuid": "e68e76e4-e6eb-4950-aae6-67a6f3a4a44b", "value": "T1AF920008A6FB3025F23370194E6754013225A903178ADE1C7F6C47E8CF727B469A6FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386264, "uuid": "78deeeff-e035-4357-b9da-c831ffdc4e2c", "value": "384:fSrgFmlTcArbso7Txyh0yYgIH4yD5kczlb:fUsBArbsUxyh0yY9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386264, "uuid": "ea12f145-25a8-4fee-8cc9-b0f2cad1aae2", "value": 21017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386264, "uuid": "d0867e02-d0e9-48ee-ab43-92ce2164dcab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386264, "uuid": "1164c23a-58f7-433f-b2e5-60a5d1267935", "value": "module_wrtc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da0e4e5-2773-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351240, "uuid": "9192f36f-326a-41e0-baec-8d1628c0faaa", "comment": "Malware payload", "value": "29485b0a70f4ebd00b0f8bac0bbc5435", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351240, "uuid": "f8a56abf-0cb0-4ef9-ab0f-884636b97c19", "comment": "Malware payload", "value": "c9882720ac7095d416d2f80cf997b55217e06fb597e84f30a4a38027be30467e", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351240, "uuid": "07b77692-9851-4a00-99c1-eb8b2584348d", "comment": "Malware payload", "value": "3ab14fd228c07caa0256c998fda99b5503b9b4e0", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351240, "uuid": "34ea6f65-c54a-4c9d-814a-c4eef2af21b2", "comment": "Malware payload", "value": "8f4d7425386d53774ca4ca2c1654cb7145dc1d2697b78f46a230e48d3204e2ae07aa59f17a9596211de01f30c85c290c", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "23-227-203-123", "colour": "#4D7AE3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351240, "uuid": "da712506-17a7-4656-80d6-ff21987bc36c", "value": "T15B46F162DAD9D528ED3305BBE5C64A96363F01D9EC0B407D03F869CAC779C0A1FA1768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351240, "uuid": "acdcad9a-d837-4a8e-9ca4-198ddf6100b2", "value": "98304:IyHFAzbVIa9bkaQ2xv6/haJWPLlsz267Rvy+9y9clgviaGwakfmQNuCzwRRe2uU:IylAzhIRat6wWTepRvZpGKaokXNuXRRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351240, "uuid": "f4ca579a-5151-4976-8489-9dcfdfd5b979", "value": 5381452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351240, "uuid": "88995e44-9710-4b19-9714-5e962176521f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351240, "uuid": "34545df2-bc33-46d2-84dc-703dc94882e2", "value": "c9882720ac7095d416d2f80cf997b55217e06fb597e84f30a4a38027be30467e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7eda267-2789-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774360814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360814, "uuid": "1f3f6695-f8f1-422a-bba3-0494a795e10f", "comment": "Malware payload (GuLoader)", "value": "85fabd9c5399de3461e13f9341e4e522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360814, "uuid": "2370ed6b-50dc-4921-a207-cca376727279", "comment": "Malware payload (GuLoader)", "value": "c9e58c529a5029e1b31667c63b7276d8fb4c65ddc2f88c643d9cb8e1d65479d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360814, "uuid": "0da3181d-9383-4d63-b197-46d7920c3006", "comment": "Malware payload (GuLoader)", "value": "df752a042068a438161d310698ff26c208c1bc64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360814, "uuid": "ad704217-b015-4079-99ed-ff144cb95123", "comment": "Malware payload (GuLoader)", "value": "95ee106101add614b4c124057188906d626e806bf52ca87c7786038f77dfcdff762ccd6ff02abef01bf4adff543c02e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360814, "uuid": "019a2bc7-e42b-497b-a16c-6e79fe123f6b", "value": "T1C9B4E0872D40A0D6F9378BB3743DD93916616D7EB254210A3BC0BBE9A9F3615C326E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360814, "uuid": "78580bfe-046e-4bd2-a370-a752e051f1bd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360814, "uuid": "39956748-9f05-4b79-b52c-e1beb8e372bb", "value": "12288:FYhuGxk6PsRAvtbuQ9csNZSh1Ffad+Bb2ohjo5ExMxebw:FYhuGxkBIh7NU1R5o5sM4bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360814, "uuid": "3759671f-3cb1-470e-bdf4-ba5576b90f00", "value": 534704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360814, "uuid": "19f77c3f-8810-45de-beee-4c78636292ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360814, "uuid": "4611d9af-44bf-40fd-8cf6-a895f41eabfb", "value": "z1LSD2109UR43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037d212f-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774342875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342875, "uuid": "d8fbf807-8571-44e0-a50f-5e670284b1f4", "comment": "Malware payload (Formbook)", "value": "dfb94dfe129956043a3b59719b3bb600", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342875, "uuid": "b6ad2a60-a66c-47b1-bdaf-f3160efb56cf", "comment": "Malware payload (Formbook)", "value": "cb2bad725d87e54ed1c83920db28c87dbbea1424f109efeb3af0ff43d1ef4e09", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342875, "uuid": "9f2ef34b-0528-402a-af53-60142696afee", "comment": "Malware payload (Formbook)", "value": "095a0e8a4cadbfd29b1756474f29b1855bfba25a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342875, "uuid": "e4b70991-b2e8-47ed-8360-81708a8a2d50", "comment": "Malware payload (Formbook)", "value": "c2bc15a08bfaca28a18496f5588df51fc4065dba21685a021e84b344e979c03b0e3787788e157a239a5bedf5730182db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342875, "uuid": "198abe00-cdea-42a1-b9a2-d0b8540fea9d", "value": "T12DA59E21C54C6BFFE6886E4B80FD2A0B7BD473A4C9A3150E3AE5F44B5EFA50461017E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342875, "uuid": "7c737bf8-0387-427e-962f-3b8b60b8211a", "value": "49152:AZp0lLGmA+81ImCTQUueGkgeodfol1+x5xaU+w0ImBQlzLXUd/7VBQjg:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342875, "uuid": "21c18102-3710-4b3c-a8a6-360c8a9d8e8e", "value": 2066524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342875, "uuid": "f29783e8-7925-445c-bf2d-7c7f11371c67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342875, "uuid": "5768cab4-207c-4f89-85d8-7f152982a2a2", "value": "dfb94dfe129956043a3b59719b3bb600.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ff688d-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774343332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343332, "uuid": "1d75d5de-51a7-4f2f-a97b-419aebe6970a", "comment": "Malware payload (SnakeKeylogger)", "value": "24b80a70c8d5b2a92f1af0a6b61f83ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343332, "uuid": "02e55d18-35aa-4618-bf27-db3d7c370f89", "comment": "Malware payload (SnakeKeylogger)", "value": "cb5288318c7458cf7652c1ed563adbdd79352c52cc0179f109a040d4c4f8944d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343332, "uuid": "4a5871b8-eb84-49d8-bf02-e2ecaf976ef6", "comment": "Malware payload (SnakeKeylogger)", "value": "dadd2370c269a81a780c260e0e6c3f04b074947f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343332, "uuid": "1035049d-95f4-4e21-b0d1-f3687c9ba9e4", "comment": "Malware payload (SnakeKeylogger)", "value": "07b9a31499dc774f6b93e694386af32e580e573ab6f00add5be3235b45f2c9aa82d67b606fe85a3fdf514b5e3064a130", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343332, "uuid": "b5aae7d6-0850-4424-93a4-b22feb256a16", "value": "T13815CF8951E80AA646184C37F0F696B15A793FDD48312D1A3FA49C6DEFE738092DF18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343332, "uuid": "19c38ba9-f2a8-4657-80fa-0f8bcf8b34b9", "value": "12288:MqC18GSqnQJsgqNFqQOvE31UCW+X6Tr2vuT:zCGGnQJLqNEQOkUCW+KTr2vuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343332, "uuid": "1d6af028-9b74-4bed-87c8-42367833a7b1", "value": 941720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343332, "uuid": "d46bd188-6bfa-4d6a-9964-a8ad433474db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343332, "uuid": "6ecbdba2-2d11-4413-b122-efd03555a716", "value": "24b80a70c8d5b2a92f1af0a6b61f83ee.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6b7241-279e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774369569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369569, "uuid": "2d3bd75c-f8a4-42c5-8260-7bac0c938470", "comment": "Malware payload", "value": "5870a6c0d875004f9afd625d501527dc", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369569, "uuid": "6b76f8e8-b6c4-4c1a-ad0a-c583bc9f4f2a", "comment": "Malware payload", "value": "cbaae93473e4f07a01c70ec8bc0398949fd45615d3e44cfdc8732b3a51e5b6e6", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369569, "uuid": "3151f89d-2273-457e-b1b5-6956153437d5", "comment": "Malware payload", "value": "6d148a1d653e2f4c672c37b917e05f862ea42232", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369569, "uuid": "a3d87541-de11-4d6c-b673-21eb79376b3a", "comment": "Malware payload", "value": "6343c4d0037a195da9ed128c013a725a17a10ba210a7a7b2f054be3ba5e811b8fc14a3d986efd5f7e9cf8a1d26500a9d", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369569, "uuid": "d21fa633-8b03-4b22-87a0-82933781fb88", "value": "T18C250111B7AED813C9BB1BB42651E03903B5AE1EE129C7CA8EDD3DEB78B67011905353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369569, "uuid": "86560203-51a8-4fd2-ade7-833539eff20d", "value": "12288:cMPhB7pN8FtJxvCxMhvOsdXF5RS4uOaF700CG3wixIzKdygt5vaUq9RqYb5LdqxW:NDMJlbReCG3Byc/jvapnqYb5msqbmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774369569, "uuid": "7506cc6d-debf-46ab-9552-d06e04e07e9c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774369569, "uuid": "fd8d4e84-b7b2-4721-89d0-14b5bf1a2d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369569, "uuid": "a051c422-d8a1-4422-9b33-01a4e83cbaf9", "value": "cbaae93473e4f07a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671ae216-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358933, "uuid": "454795dd-c732-433e-b7ee-a010575c0f9a", "comment": "Malware payload", "value": "710f1ece6fdeaf8a0860fae0b011a6d4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358933, "uuid": "ccbc7601-c209-484c-ac27-2315e0dbd1fe", "comment": "Malware payload", "value": "cbc7cb531ae855a3fd5c6cb36639d7e2b2adaafb63c5c6794a242c24f65ef439", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358933, "uuid": "c69550a5-8ff3-49c0-bf63-a929257e717e", "comment": "Malware payload", "value": "0f8a73b30a652690bf161ae6ed26a373fbf45cec", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358933, "uuid": "c917669f-2eb4-4108-a92b-e44d4b4f1070", "comment": "Malware payload", "value": "b957fcb6eb46fca85b2c79a573e47daca58ddc742fd25db4154b3f61b716f21c97f6d00c980965c1db40584e29a8f34b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358933, "uuid": "0c81c5c5-1762-4205-9d67-a9c90c97ac98", "value": "T11E450123994C69E0F502B31A6F776C24CAB5361FE43DA68EF5DC84C634158CCB2A19B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358933, "uuid": "e5193621-1af1-462c-924a-1a76276ba545", "value": "1536:15FQfWKqkUzXXnXfR86nkhcPhu2vUuPzAnwJ9Br9p3A:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358933, "uuid": "143288cc-d455-4c13-8faf-fdf8e180652d", "value": 1221934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358933, "uuid": "e7f0e743-fee5-4353-a37d-de4505a43a1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358933, "uuid": "a3e03c2b-8837-47b8-bd43-a176d1d6a5ab", "value": "710f1ece6fdeaf8a0860fae0b011a6d4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedec7be-2755-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774338545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338545, "uuid": "f9d435e2-6b13-439c-b110-ac04e7b9e101", "comment": "Malware payload (ConnectWise)", "value": "32a07f3d88e5b55eff3ed63579875037", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338545, "uuid": "fc4a78e3-2911-4893-8ebb-69ca541f45b1", "comment": "Malware payload (ConnectWise)", "value": "cbe607cd3f2bb8a3719a58c34c5fcdca44633948cebf477204de818820638511", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338545, "uuid": "1d62d41a-3ac7-4618-b308-2219cd0e890a", "comment": "Malware payload (ConnectWise)", "value": "51d343f6e0098f53d88fb0492f4f3ac4b6719678", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774338545, "uuid": "30dffa29-4800-49fa-a0a3-940f50a907fa", "comment": "Malware payload (ConnectWise)", "value": "b3dd01ebf53b3c7c5dea4f450c7ac90e9c3f058c4ab23907c772d42d867e7e1c7e37d3b97bd8c766a665280e29d78b20", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338545, "uuid": "21e5e272-2e8c-4db4-87af-4977b2f5db1c", "value": "T1B3646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338545, "uuid": "652e7964-1eaa-4010-86db-570fd22eca0b", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338545, "uuid": "c8cb0c87-737b-49c4-b45a-789b35343997", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9a:h1iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774338545, "uuid": "d900a174-1359-4c22-9bf5-b2dd902bfbc3", "value": 312656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774338545, "uuid": "82e5d5a2-db47-4527-9ae2-e8c5f343f14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774338545, "uuid": "f89af231-5758-463e-a803-69f6ea69e135", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f0ef02-2790-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774363711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363711, "uuid": "557774bb-aab9-42b3-994f-c99adab259d5", "comment": "Malware payload (Heodo)", "value": "da4a1a23e1bce6069a0f0bff69a951f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363711, "uuid": "67f682ea-52e9-46aa-85ed-6fbf965efdb5", "comment": "Malware payload (Heodo)", "value": "ccfeb50d9a9eadf66635a9506c1b3b1eeff8139b7c47f81301693d86786007e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363711, "uuid": "bdc612d9-a174-4046-a2dc-df1e5308bad5", "comment": "Malware payload (Heodo)", "value": "3e1596d7c3e27d0b0daaa1815aecfbcc5114c17b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774363711, "uuid": "cbf5e979-b05f-45af-b229-0d6fb00bd0ac", "comment": "Malware payload (Heodo)", "value": "287e18a9a62bd6e923baf56b1473c395c9f9f421e6e287036b9e75141fa3d99f5ecbd561d165e4f55d699b491d38d18a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363711, "uuid": "acb35ba4-2db0-4dfb-9596-5a5fb49becf3", "value": "T197833903B643D2B6EC988535A29A5B2C8F27ED31C3C359E363B13596DD3EEE81934449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363711, "uuid": "1220bf69-37f7-48c6-bfc5-1d26126a0a2e", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363711, "uuid": "0eea0c7e-d30b-4c27-92cf-f2fdcbb6e10e", "value": "1536:9nWX2tuLReicV0j7GR2cLQ1RXNUURDoq4OZZZLlCIib:O2tHt0j7sLo1RD68wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774363711, "uuid": "5eb28940-895e-48a5-85bb-19ff3375be7a", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774363711, "uuid": "11695f18-0a8a-43f5-b5ef-fe09d1204934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774363711, "uuid": "b28b6299-ccb1-4b0a-8870-0adef4644e13", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5f228e-2788-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774360474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360474, "uuid": "0a1977ff-748b-4e57-adc0-fdf77deaee05", "comment": "Malware payload (RedLineStealer)", "value": "970ed42178bbcbcda269281c7be4170d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360474, "uuid": "a2ed4a7e-ffe9-480b-b34b-eac6c2e7060a", "comment": "Malware payload (RedLineStealer)", "value": "cd68d04be942df173a7931454b4f2338fccc09bdb7cb227a6500403eec0f98ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360474, "uuid": "adbe005c-3bf1-44fd-89bc-0d55464320b0", "comment": "Malware payload (RedLineStealer)", "value": "baac6b5086a64c8e07c981e0f0276d45f0a67799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360474, "uuid": "d2dd38ad-4c4c-455f-bd7e-22eebff5575d", "comment": "Malware payload (RedLineStealer)", "value": "04fd3c82f31e20078cc2da5fe80e0e227fa92dfb68335fe22da2fcda3271a7c24f1984316e6cf59b7bb189298d64ac8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360474, "uuid": "3a482c66-7e02-4048-b8bf-3789d4bf9f9e", "value": "T132B45B1923A6DAB2D7DD83B09025C9842630DF5B5A83FB1F6898B6F77D32362D407D42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360474, "uuid": "0f39bb4d-7268-4e04-a70a-6333ccf6a573", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360474, "uuid": "92ac3c01-2cc3-4a5a-b739-2748b0ff92a3", "value": "12288:fyCHLX08o6t8VOkjzOfauuEMVmEnVmqnr:fyGcJVOkjzOJud3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360474, "uuid": "e86911cc-01cf-4975-a617-39ea47eb4560", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360474, "uuid": "186cd258-0a00-42df-9e63-9b63ab1cff77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360474, "uuid": "6eddf040-7df8-417d-8451-29824c2fa485", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f6bdda-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358958, "uuid": "71ec5caf-91fc-4b2f-8849-1d8c75f2817c", "comment": "Malware payload", "value": "ec4ae35e71e456be1a75a3b67e0ad8be", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358958, "uuid": "6a35b517-de06-4b74-a8ff-7426841e727b", "comment": "Malware payload", "value": "cdbc07c29074ec86f3ef1baf57b7ff443a5dd8fc35380282a096bd4a01e7933a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358958, "uuid": "57d048d0-6c92-424e-b07c-2c41f9eed6a7", "comment": "Malware payload", "value": "8ee8f2e8887619cc109c24394a7a15a8182227bc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358958, "uuid": "4e13adb4-8b15-4dc9-a589-3816752e5e15", "comment": "Malware payload", "value": "ce4ccb6a5eddac857257c9e10595e3cb2a78c8e6d824141a678aa9162fbdb35374ea55c6abdd4556beacdcc97a077c9b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358958, "uuid": "8448aa48-bc26-4ad3-9ff0-a66ce0f6d3a6", "value": "T13D4502388B3ED84B8DA953D15E246647BA4EC12F58E2F92D9B98CD070D3E2D747E81D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358958, "uuid": "6cff1174-af43-49d9-a65b-f21b9688b12b", "value": "96:FOAUvdSiVbJpX6jvtCdfp27+V7MF50k7WZDVSj69aWdy:kdQVRw60k7Wut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358958, "uuid": "b8a4f9fc-adab-427d-ab80-73822715851c", "value": 1195449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358958, "uuid": "aa487df3-e21b-4c38-93ac-0d7d1c6faedc", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358958, "uuid": "f1e89566-48ce-49e1-9a4a-aabef5988fc2", "value": "ec4ae35e71e456be1a75a3b67e0ad8be.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f6b309-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774337777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337777, "uuid": "b23442db-1526-44ed-95ce-69f54337ac19", "comment": "Malware payload (Vidar)", "value": "ee7ffcf65b93ee56399e65da6c739892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337777, "uuid": "2fa6cf4c-4567-4fd5-b14a-6e806fd97f56", "comment": "Malware payload (Vidar)", "value": "ce8c6ebd45c266666b610268ce1c481c4402d9617d1bf22b038a44940e37ac0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337777, "uuid": "7386ffeb-be01-4a36-a6a2-8db42185f7ab", "comment": "Malware payload (Vidar)", "value": "95a3efec86583201ad2e8d02da17fa6eb2623e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337777, "uuid": "734379f7-eed4-4e7b-b644-f220770fb9e3", "comment": "Malware payload (Vidar)", "value": "308d69624b4471f79c3374a315936c71f3ee4e3024ca27600cba3cb38a795517342475cfc91ccbd83adda0cae7c566ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337777, "uuid": "4b039a5d-2080-4f3d-9d29-20b34187b2d1", "value": "T1F6A58D1B6CD549F6C0AAA73288B72191BBB4B8090B3233D72F9076782F767E46D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337777, "uuid": "c91c6fc1-4a7b-4c70-9d4e-1f1bba08a088", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337777, "uuid": "c9de2768-c5e5-4209-a3d3-ca3e83f6c13d", "value": "49152:cZKLG0H9d/cGGbYszHCVAYKBBu1YRLkoSvCCy:cLKkG9d/1YhtACX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337777, "uuid": "3e51a4c2-adec-4d0b-a8fd-f3d6b6520a78", "value": 2233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337777, "uuid": "b0bce068-ea32-418a-a15b-e3cda5618830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337777, "uuid": "d1caf7ad-8959-4fe4-84ba-6d5a29aa2107", "value": "ce8c6ebd45c266666b610268ce1c481c4402d9617d1bf22b038a44940e37ac0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f30ba23-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774337767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337767, "uuid": "5bf99ea9-94b5-4b83-b36c-2d38e92c5dae", "comment": "Malware payload (AsyncRAT)", "value": "aeebc2dff56c363e13855aca13353621", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337767, "uuid": "6510cebe-7c4e-4233-9e5b-3c1e4fd2011f", "comment": "Malware payload (AsyncRAT)", "value": "cfb702308d9e1ce192bb572bfc2553eb5c58b2e09793b6c9c1e00c6c9f31f6d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337767, "uuid": "02c50ad4-4491-4d73-a5e7-e6add0eab092", "comment": "Malware payload (AsyncRAT)", "value": "414254c629890ec8128bf846d3d9f3935d5f1933", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337767, "uuid": "0fa9c2b9-1758-4d5f-8f5e-9d28edead30f", "comment": "Malware payload (AsyncRAT)", "value": "b4ebceef03f4e90fbdb3dfe8295fb059b4db0b71607a22e856fb2b0cd9212ad3b9079162694cbe0e29a0dc8e8b19b1cb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337767, "uuid": "579006b9-b04a-465b-9dd3-ca921914a085", "value": "T1B6949E1AE7E805F8E4A7E1B48D974A02E3767C4907719B9F13F466562F233A09E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337767, "uuid": "29b7d8b4-027d-4d78-86a3-ca193f3dc30e", "value": "8b4d0760d426c9138154c52a7dcc4339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337767, "uuid": "9f5a3274-6031-4701-a790-daed36cbb7c9", "value": "6144:VlXzZPiLUAMRPtsb0JggDJ4fk+trCWGdQkb/+wnKLrYcWEbCLxPCxPAGshcEnk:xKg+gDJ4fHrZGdQQ/+SarYcWlRCRWcEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337767, "uuid": "b963ecb7-14f2-4c25-9351-d7fb0f62818b", "value": 440124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337767, "uuid": "bfb41195-ecfd-4fba-b93b-293f11959c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337767, "uuid": "d8c122ae-6527-4153-ae59-7e11a2bb8f60", "value": "xcfb702308d9e1ce192bb572bfc2553eb5c58b2e09793b6c9c1e00c6c9f31f6d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c8a6ef-2732-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774323231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323231, "uuid": "5606a1e4-a025-47c1-8d01-61031db02da7", "comment": "Malware payload (AsyncRAT)", "value": "863caa37394927dafc0ee3b33ab0b88e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323231, "uuid": "45d6f2d4-1d77-4fcf-9843-291d5571100d", "comment": "Malware payload (AsyncRAT)", "value": "d001b653d2bffac353ef0213053577a0bae90e53b857e17fbdcd64942e1c64a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323231, "uuid": "e71f5de9-586b-4af0-8b53-ffd2d2c42a24", "comment": "Malware payload (AsyncRAT)", "value": "27f4e23539ff316d80eac82cdac39c30cb1f51e0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774323231, "uuid": "1c338eb4-7849-4d40-9f8a-46468ec57558", "comment": "Malware payload (AsyncRAT)", "value": "92673c8c601d0f45c067e7941b445bcd9f8e1b340656862611dfb69c7a9d8210bd77037d5c33bb00ffd79bd9b2582813", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323231, "uuid": "c0bfc1cf-1479-45de-b08f-1a16ff9b6056", "value": "T173753305E1B1E361DCF3437969876B8BBB7899544B4F3150328EABA2831B3C361C26D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323231, "uuid": "7d454df1-d195-4b0a-89cf-25f0491dca7a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323231, "uuid": "2debdbe0-c658-4ac6-a2d3-6e173f06d415", "value": "24576:HvKr4mCZbKJbWSlrbaMU6FNfQtfKp5p01tgyCk7k+HVuzEHMKv0AcczQ1kQYIdLn:PBZbKJ5+MN8j8yTVFBvDdzGYELM1cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774323231, "uuid": "1bd39b88-7286-44bb-8470-14ff2f943982", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774323231, "uuid": "21c984af-2413-462f-b99b-30558bb12ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774323231, "uuid": "29bd7827-bdde-4d9e-8c8e-c92595430789", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faf4fb5-2778-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774353311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353311, "uuid": "efbe50cd-e67f-4b35-88ed-8e4bd5e3eb14", "comment": "Malware payload (AgentTesla)", "value": "224586725eacb3dbc6b97df22423920e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353311, "uuid": "44bac406-98bc-454d-b7e5-6d06ff14dc7d", "comment": "Malware payload (AgentTesla)", "value": "d050b8b3aef85cac19548de99912a88945caa74f7b6bdae2292436761ca4b22a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353311, "uuid": "cece291a-5296-4458-937d-8dac6890d29b", "comment": "Malware payload (AgentTesla)", "value": "3a4f9a3721a0229e6b08313387e43b07c4efd4fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353311, "uuid": "409711a1-f83f-4248-942e-8413342893af", "comment": "Malware payload (AgentTesla)", "value": "7ad5d4b12dc0a07f578b4339ceb67b038bc992b3a5fe93c2717aa655241d2f1fc8ebff71e02a44d7a369700eea507bdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353311, "uuid": "f0853f96-0f0c-4078-b6dd-10195b20ccb5", "value": "T19F353A2D8B5F8E2617B554D0ACB310C20DF059AF38CEFED65D963968DA315A2026F43B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353311, "uuid": "3b1fc1f0-4baf-42c0-8f3d-ce1f0fad7803", "value": "12288:xv8uB7XXmIJcknhbS8H9pObGt/MVPSz27NLVkKKLyGtIvv7AGX7+Zqa2j1dDEq8J:xkuB7Xw0bNH9r/+SzSLqWD5+rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353311, "uuid": "fad9f299-93eb-4b6f-9a95-f8489a83ea62", "value": 1082737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353311, "uuid": "86e6e628-edb2-415d-a879-e00453247246", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353311, "uuid": "ea72f779-8f39-4715-8c80-f28104677ede", "value": "d050b8b3aef85cac19548de99912a88945caa74f7b6bdae2292436761ca4b22a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af2af3c-278b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774361544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361544, "uuid": "4c822d4f-d662-4995-a487-c7b179175459", "comment": "Malware payload (Formbook)", "value": "0b904db06c440f2e39f162f423358dae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361544, "uuid": "fbbf3bc8-a65b-4da2-844a-0c78575db997", "comment": "Malware payload (Formbook)", "value": "d05f9fbc29c1c7eead855daeddb8e7014f5ce664a856c8540cf78f6e8b54ebb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361544, "uuid": "0d810592-6829-452a-9e82-f105763195d4", "comment": "Malware payload (Formbook)", "value": "724a1c741da9ffc4feff557f0379c7f5f15da3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361544, "uuid": "1a69b30b-035f-4501-9043-f2096ededd75", "comment": "Malware payload (Formbook)", "value": "59b160f5e1d42e0c14f027acdb941a8e938202b25e623d2f34137c5b559c4f63a6ee620f503d35ec941c95fabc1c207f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361544, "uuid": "19596e2a-53a4-495b-b2e6-1898901d8219", "value": "T16035F119AA48D902C5A19FF85870F33443787D686A14DA13DEEEFCDB79396C634042AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361544, "uuid": "fb345aaa-f0e5-48e2-8500-13de677133e7", "value": "24576:rMXdFpdcvkIbciaxrUm2YrJnz2Zpgpz6PJEiOg9z9iW7y:Wcbc/rU6Jz2ZA6hug9z9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361544, "uuid": "e8301f03-ba0d-4538-9671-eefa6ad1ec0e", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361544, "uuid": "0faf92e6-3bd2-49f0-b45e-7c90370aec6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361544, "uuid": "1fd2a430-636e-4f9a-86be-6959ba4a8409", "value": "INQUIRY INR326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba922767-2787-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1774359932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359932, "uuid": "69271ccb-ef7d-423b-8f15-4f0c5f4bfee6", "comment": "Malware payload (DarkTortilla)", "value": "1004039eb0a7cd9783c671239ffc42ae", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359932, "uuid": "e657985b-37c9-4476-9e4f-bdf6861333ab", "comment": "Malware payload (DarkTortilla)", "value": "d1156dbb3b3355d9decf9af50beeab52e3214557fd85be73147feddc57ef11a8", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359932, "uuid": "d808f821-a821-448e-a560-a0baa17fe422", "comment": "Malware payload (DarkTortilla)", "value": "9e07802d9b621d846391ab25cca8c5d7636ae069", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774359932, "uuid": "c0d15e80-53b9-4442-900e-75b8fcadfccd", "comment": "Malware payload (DarkTortilla)", "value": "4502dc43c305dd5e2949858cbbfed58386b0a15a72ffdccc6759145bafdf18cfe1b07211ef66fdd69a79bf1c28e3f0eb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLine Payload: 32-bit executable", "colour": "#E7AAE9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359932, "uuid": "a38ae69c-dc34-4d78-a95b-c375bdf8d3ff", "value": "T16895A4E71DE93911E5733036BE1A863D2B1C6C3BBEC171E7144F5046DDBB2898A992E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359932, "uuid": "891ab9d5-70e5-4c5a-bac0-bcaad1fcf146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359932, "uuid": "13872ab2-0685-49c8-88ff-ffcbed60b235", "value": "24576:/9sQDSz3eoh5SpYkrjZarAfY9sQDSz3eoh5SpYkrjZarAs5w:nSGjZakfcSGjZaks5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774359932, "uuid": "0160edeb-6d06-4bc9-8100-27416e87f58e", "value": 1934848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774359932, "uuid": "43ee49a6-dd4c-4dcd-aba9-af4710a2070a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774359932, "uuid": "09918e06-68f8-4779-97da-5040b078cbf7", "value": "RedLine Payload: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b22f57-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366956, "uuid": "61a7501e-22e7-4750-8e44-103580b82ab4", "comment": "Malware payload (Mirai)", "value": "2f0d1f9bc1a063b0f1108384d90f26d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366956, "uuid": "ee9eede9-f755-4df2-a693-d1f36ee33c57", "comment": "Malware payload (Mirai)", "value": "d2ec32a04fc072cd699f3b347cd5086d9ab74be54e004dd6e0d8b0420b2d1e32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366956, "uuid": "7c8b367a-ff89-4b4d-8bb7-b05b35956c5e", "comment": "Malware payload (Mirai)", "value": "0240d5b76b7fca6f0d847fd254cc7b69c2044e72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366956, "uuid": "6d753562-1012-4874-9aa0-3f14fbccfec3", "comment": "Malware payload (Mirai)", "value": "b5052e8235deb2cbbd104b4ae1d7cb8f77d03b217162c50b5c4ffef102d02dfa2c19540cb2a8567c8b3abd93e49347fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366956, "uuid": "651c101f-66b4-4bc9-a7f9-70efc351148f", "value": "T1AAC2F160FAB05D71CB302EFACEFACFC72D854AB9D16B793714150925A9C501BA7A018F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366956, "uuid": "3ce39e02-5dff-4987-bdaf-f44fcb459536", "value": "768:+MKyhegCCMqfpFPg6G8I3T3bxG0Vihy9q3UELuF:tKy4qfC84nYJhnLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366956, "uuid": "d792c856-71e4-4228-b5d9-f7a2577cbe18", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366956, "uuid": "83c1028d-afb2-4ba4-ab71-cb68885641ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366956, "uuid": "9a0bfa3b-aef8-4551-93c1-c305ca7da3f3", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f04102-272c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774320725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320725, "uuid": "bc5b2a3e-3437-44a0-a1a7-9ad6cfd77aa6", "comment": "Malware payload (Mirai)", "value": "bb4084d94b46fa745408695522476508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320725, "uuid": "2741a4bc-26a4-4c58-8e45-13cf735171e1", "comment": "Malware payload (Mirai)", "value": "d301dd6d3cdfbf249f78b803575844f5cbde6762ad96c6708d2c7962a3550072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320725, "uuid": "825beb8a-a1c0-4d23-9a0f-6b92ee52139d", "comment": "Malware payload (Mirai)", "value": "69499e8ac97aa1c15f02d6790edf6e03bd1eca4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774320725, "uuid": "b32aa35f-688f-4c59-8f69-d4e2dd62d33b", "comment": "Malware payload (Mirai)", "value": "1c8921ed24724fd93b466e7536389c6bc5176ac3b83079d3911d62335ac80fdf9e3867dd390f20255ed7324112690865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774320725, "uuid": "8c06a4cf-844f-4ba4-9ff1-06bc90493fdd", "value": "T1D1636C42B31C0943D6625DF03A3F17E183BFE99021E4FA896A1FAB464171E72158AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774320725, "uuid": "120c6f27-8af0-478c-9d00-9244ed917034", "value": "1536:419x0iGn9FnuVNAF3vi17h+PxuilkJ45aPG:GYC6F3vgEuukPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774320725, "uuid": "b1b6abb3-12a1-47f6-adc9-f9816b2a3275", "value": 71200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774320725, "uuid": "d5a23a63-46d3-457f-a260-d81629bcfcf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774320725, "uuid": "3329746b-f882-477f-aacd-aba4b1bd83c3", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0d162f-27a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774374085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374085, "uuid": "222d2ff9-0965-4913-b01b-d2bbb99c4cbf", "comment": "Malware payload", "value": "bd8e578c425118a50447b1af3ee6fece", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374085, "uuid": "9cf19a17-afc5-45d3-bbfb-f055ae7e2a2a", "comment": "Malware payload", "value": "d39f4e7a218053cce976c91eacf184cf09a6960c731cc9d66d8e1a53406593a5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374085, "uuid": "7077686f-2b92-42ac-9cf9-f3a59d174aba", "comment": "Malware payload", "value": "da466d3c630d6bfea0c5b82d6cad388e443dbe92", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774374085, "uuid": "1abbfddc-ab48-4937-9bfc-b13db9d52e24", "comment": "Malware payload", "value": "5cfd47d7ed447c3aa04813865f71e97bb8beee5bc2e6bc78df47a82339a7e19331fe9bf0449401df1fee8d6604d67108", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774374085, "uuid": "f1e11e21-4997-46c2-8852-45e2052199c4", "value": "T1CC0733662CD79BEB588D03BF49F86F8EE65274E8305481602D42D6B6D52F1801A30EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774374085, "uuid": "30b5b685-80fe-4090-aab6-2f72be736c4f", "value": "393216:Iknskt0cq55MwNFrU+4Kss/BNr88eXKMVTNidkPbc9nCnvK9tuv/TNCTs:Ikskt0Z59U+Xs488edVT5zOu/Tws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774374085, "uuid": "c4c1b704-9094-49a7-891b-5c36441b13ac", "value": 17401988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774374085, "uuid": "9ad218ce-4b14-49a1-82e3-98e792e13095", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774374085, "uuid": "bdca0fe7-b287-4df6-ba5f-1499873dfaf9", "value": "litellm-1.82.8.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f5a170-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1774342906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342906, "uuid": "38d77a0e-b4f6-4be6-981a-7440261b4f25", "comment": "Malware payload (MassLogger)", "value": "95f865880b679453a78e49fdb9d3b1ed", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342906, "uuid": "6384190a-51bb-454a-924c-796d6b91ffa1", "comment": "Malware payload (MassLogger)", "value": "d459705efa4e0c96d3851547ca06ee2ac1f39f13d972973918fbe4d434e3f929", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342906, "uuid": "32274250-b357-411d-a109-06c33daa0d63", "comment": "Malware payload (MassLogger)", "value": "282bd5ac841e0e599744d3a92fd562041b71173e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342906, "uuid": "75bd2282-8a6c-42ea-8143-5be8bb8991e8", "comment": "Malware payload (MassLogger)", "value": "81463549f5d730a04a996e12302468558366d2fd89ab43ac8a0f85461af21f82f8d0e9bc85f276ea04c432156c34ab48", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342906, "uuid": "65b0fd87-0edc-4bba-90ea-1c2ce5e4e1fd", "value": "T1BBC5E9F7F8D5211B9378E48BB62AC936D069DF73075B1F088DA624C46E8B60D19DC8D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342906, "uuid": "71b027fe-878d-48ab-9d88-1611d77aeb1c", "value": "96:8AkxKWJ07A3qMUWqGUpAzBXgqREfRTwH7m:qgWJ09lGcERnbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342906, "uuid": "32389f8b-4e92-4568-92a6-a02d4adaea79", "value": 2729696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342906, "uuid": "c5ef64c1-a3f2-4f0c-98e8-13f0f6aa93ce", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342906, "uuid": "55ed2359-6783-4216-8d6e-33718129d1e8", "value": "95f865880b679453a78e49fdb9d3b1ed.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dfe37d-27a7-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774373724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373724, "uuid": "a7fafbd8-789f-4eff-be81-45b0c0d77452", "comment": "Malware payload (njrat)", "value": "8d23b5ea428b986cad34ef94cc74ee6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373724, "uuid": "cc4cd9f9-c1c6-4237-98b5-9060760f7975", "comment": "Malware payload (njrat)", "value": "d4b11e561a2cd703c012d2aab2e69d5bf3529f05cdc1a831371c1a3a829c3ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373724, "uuid": "cfc9b3fa-7109-46b7-ad68-c97cf255466f", "comment": "Malware payload (njrat)", "value": "3a1e0c824f749395cc8ea8c659de7fd095142986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774373724, "uuid": "faea5cbc-396a-4e17-914a-dd5f606abf33", "comment": "Malware payload (njrat)", "value": "ff8f939acf6d3e5fff5a680512dcba067516b4cea71051288a21a525cba89043553b838417e0794839044d4a02296c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373724, "uuid": "39bfeebb-72f0-4192-873e-40650d4133cd", "value": "T10694E79170585883E81731F1DC9FDA30225EABDF5239C70E3653FB1A5A9336620A7E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373724, "uuid": "d510a133-4598-4d9a-a978-75d287119f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373724, "uuid": "c6579c28-cd1f-462f-a1f5-67144d085ab4", "value": "12288:1aGCuzrYt+6HvMj/jMt/Zp3jut+zb/VMhE:1aGCq6UnMxjEG/V8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774373724, "uuid": "a6bf3443-3d35-4ab7-8ca8-e3de3f0f0f2f", "value": 437656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774373724, "uuid": "eeb154f9-f363-4db0-90da-b1f2c140ae87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774373724, "uuid": "47ca3746-9527-4a35-bb47-a4768780ca2c", "value": "Crypted-Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917cf6e3-27b7-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774380479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380479, "uuid": "64fd1584-b1be-42bd-a066-5113fa9dc1dd", "comment": "Malware payload (LummaStealer)", "value": "65424417d2e6c88181422dd21a9dbcd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380479, "uuid": "1dd9ea1e-a636-494c-9b6e-d63b0bd5f8e5", "comment": "Malware payload (LummaStealer)", "value": "d4fc06be972bb8541cab55e87075de3dbd75a0bcf367e80090cc4456677c26a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380479, "uuid": "216f10a1-b816-44a1-837d-a720f418093a", "comment": "Malware payload (LummaStealer)", "value": "ad0fd4a9d9e8c9f07689dc1c47b71a6b21912f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774380479, "uuid": "1ed574c2-fef0-4c51-8686-a5f9c1af680a", "comment": "Malware payload (LummaStealer)", "value": "8e66f0a0dbcd816d916b033644d8aee02fd03c94ce3e40aa751f267378f65ec6de9cd4dc1e364fb6919b0afa65b86729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380479, "uuid": "181ed6b2-3b68-4974-8605-fa79b85f997f", "value": "T186C47BC0BD4260BBC4965C350125A77B7EB80F615329DCEFC11728E0E6B5EBB9272927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380479, "uuid": "7a50aeec-841d-4fd7-bc4c-23cbb8c8857d", "value": "6313a99fffecb8759e5b2f8e8aff2a59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380479, "uuid": "8a957642-cc65-4b9f-b9fd-96d2cb01a2e5", "value": "12288:GLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQfXnjoMC0YA4l:Qmv66b32F7wQr7e5BnT6qkzsHMzl4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774380479, "uuid": "958191b2-73ea-41c5-8f5c-c188af6905ae", "value": 563024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774380479, "uuid": "04d68eeb-235e-4f63-8ebf-d8566c3d5898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774380479, "uuid": "81427e56-ae6d-4229-8ee1-727618f703a9", "value": "d4fc06be972bb8541cab55e87075de3dbd75a0bcf367e80090cc4456677c26a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b02512-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358949, "uuid": "29e20b89-18e3-4111-9319-483499e947ba", "comment": "Malware payload", "value": "10dc6f27d0ee27aa82c87c9472dd4de8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358949, "uuid": "32d630e3-e414-4e92-b264-627c4bb68e87", "comment": "Malware payload", "value": "d50cb2b6350337f4069fecfc3226a0de45ee68fd065fe2a259afb14089a5a35b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358949, "uuid": "c05d4fd7-40b9-41c1-bfa3-388166e7c373", "comment": "Malware payload", "value": "a86ef030ce5c5ea91a1f45d7ac2c2f2097b7c81e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358949, "uuid": "eb3b18e1-c607-4f0d-a83c-5676ed1f13c3", "comment": "Malware payload", "value": "5fa0d4aa0d0877e44d86c5562882a5a2ea8b8f451f338eb32c34e163c55ffc4db794ac456701e4adf5484bc2c03fa06f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358949, "uuid": "efd73cdb-a455-46cf-8f6f-8928aada4f81", "value": "T18851C41AF46B5E3AE0657C050EBF985E06605BBF397AF8C0368C57D1921247B47C8A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358949, "uuid": "f7812af0-5e08-4c7f-8906-7f15a2bd480b", "value": "48:zOPkKv5sTkL2s/WPcCFHrxRWRdrrUn0xNA+GYuAb2rQng3stZ4yT:zOPkK2T7PlFLxRWRFUn0rsYc0rtZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358949, "uuid": "1e39b2ba-3844-4290-9c7e-192dfdb706ba", "value": 2898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358949, "uuid": "ed760194-fde4-4b24-b28a-3e33364b8cf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358949, "uuid": "8fffb4e9-705b-4995-ad1e-2bf86a243b94", "value": "CarVerticalReport-974HY4885-Alex.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39db246e-2722-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1774316337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774316337, "uuid": "aae9da18-4292-4df3-8711-b5a1f34e17ec", "comment": "Malware payload (Joker)", "value": "330a8b6408e1cfde185663e35da61554", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774316337, "uuid": "45637a0d-c451-4221-a5ce-88eabdbe0345", "comment": "Malware payload (Joker)", "value": "d787c7dd04ddb7ff7904970df06b24ffe4c5326581c1e273a00253bc0b9afae3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774316337, "uuid": "45d28185-a25b-45b7-8752-7e09fe9fc231", "comment": "Malware payload (Joker)", "value": "21be91f8cb11884de53a25393c8d2eddd12c218e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774316337, "uuid": "45fa706a-aaf7-4038-9192-5ce4fb4cb04c", "comment": "Malware payload (Joker)", "value": "6cf9ab2b5f710764f0a622d4e8acb4acce14b93a80b17bdb8d60df46e1918fb10b4f5b1e0561a7a4fc819fe1071a67ee", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774316337, "uuid": "b1508565-f060-48c0-a206-5e3ae46146cf", "value": "T19907226BEB24402FF4371F3954AF6230C9565C0F9C52DBD79924730859BBA843F6AB88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774316337, "uuid": "caace6d9-d31f-4255-9505-d4847273f49c", "value": "393216:r7U2VQWke16FBVeEXoO8l8K49r4FJELPnDIq3DFB2HJ/:lKrVeEYOU2EQPnTFB2HJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774316337, "uuid": "d23fee0a-c242-471e-813a-4d22efd51e7d", "value": 18457284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774316337, "uuid": "d50865da-dd22-4412-b666-1dbc8b308c49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774316337, "uuid": "733d8774-91ca-4202-9fd3-0b425e365675", "value": "Daily Phone Cleaner_1.4.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009676f6-27b4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774378948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378948, "uuid": "4189ad26-722c-41b5-8607-6dcf3d92d22e", "comment": "Malware payload (Vidar)", "value": "efb456df484e3912da73626f0c10b696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378948, "uuid": "658f24be-3f82-4d8f-9600-89d84c516700", "comment": "Malware payload (Vidar)", "value": "d84b217de511dcaf7c935831fc9164adad3e5569ad603ef6923f80a9b0edda5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378948, "uuid": "e493040a-8689-4971-b68f-37c7f1dccf76", "comment": "Malware payload (Vidar)", "value": "f3d58c6a7205db74828425223f3779d34bc540d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774378948, "uuid": "937a927c-a24c-4d41-b1b2-95dda8ab5226", "comment": "Malware payload (Vidar)", "value": "0f5acfd3a9f7e0490387c4b4dbbe9c6f9a0401465a69eae1b2e226834cb3a728bd5f3994cb341655052207d35521a7f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378948, "uuid": "9ee98ab3-7a41-45e9-8305-66a6d58e5141", "value": "T114C57C0B7C9549EAC0A9A73188B712927B75FC4A0B7623D72E9177382F727E09D39344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378948, "uuid": "a260c23b-dbcc-49b6-aedd-921bca3af747", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378948, "uuid": "c4cd582c-3316-4a99-b1e7-3f0fe21ca519", "value": "49152:DLHgoqBBVR3vdzj05Cn3QJZicWYE7ibj6ql:D7iz8R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774378948, "uuid": "b8a20344-458f-40ad-adf9-5c887f3c4191", "value": 2611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774378948, "uuid": "f9854d5c-427f-4935-abde-b7431637ae15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774378948, "uuid": "dc69c2fa-f4a2-4222-abfe-1136242518f7", "value": "Video_porn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7563896f-2791-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774364111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364111, "uuid": "7bfa9d93-13c5-4511-8788-b069435d28b1", "comment": "Malware payload (Heodo)", "value": "d3e690f21d0306258c4b9d257017e6cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364111, "uuid": "277a1783-a26b-4e68-87ad-177d3b2b18c3", "comment": "Malware payload (Heodo)", "value": "d8c0423df1e916ba240b74112599bce944ab17bf55b03a7912f63718ff8e6c53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364111, "uuid": "b416a4ee-8c89-4df8-9b08-7dc915322c8e", "comment": "Malware payload (Heodo)", "value": "d7f09001add257a5cf8243e1859aabd37edcbb66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364111, "uuid": "c415451f-1113-4ef4-87ba-bde7760d4c06", "comment": "Malware payload (Heodo)", "value": "4bdb63bf11cfa150b5a59c0b16d5320ea74edf0d4004b132d756ea9e220fcc42760743f15360c981304183bbcc43aac9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364111, "uuid": "0f0ea241-24f4-4fb8-9ec8-b16047c7814c", "value": "T1CB432A03BB81D8B7DC5E95B952CA95992E67EE7003071AC383B334B31DB2DEC54B4989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364111, "uuid": "1b3332ab-4190-4e51-8f79-978be3aa56b8", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364111, "uuid": "be1bb505-a563-41ed-8916-c989cddc676c", "value": "1536:snW/+MPwg0GwVdaT1mgojaAhB3w7EHEFkb3iRPd0bc:OGhBmge30p2Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364111, "uuid": "55eeff90-f020-48e0-b93e-ae40e685cf57", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364111, "uuid": "e921b4e4-9e94-4ebf-8cde-1dc92eb45a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364111, "uuid": "1aa6e5af-177e-49fb-a826-74fa08892a3a", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c815df4-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366969, "uuid": "e582e4e7-7f95-472e-8412-dfa867ef8086", "comment": "Malware payload (Mirai)", "value": "697fd606661539e63e4e81613116e149", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366969, "uuid": "72f09e75-7a8e-4e91-82d2-bc12f5bd6285", "comment": "Malware payload (Mirai)", "value": "d8cfd9133b8d9499f74b128b17ad353a02e5d69327e6b230ab53601577387a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366969, "uuid": "b4202be4-0906-4542-aaeb-3a44e53ccca3", "comment": "Malware payload (Mirai)", "value": "d7ec5bbf3a3c24ad6ef68ecb46a719a4878ee377", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366969, "uuid": "99ad38cc-fb84-4e36-a185-d3980c37c2cd", "comment": "Malware payload (Mirai)", "value": "82297a610845a1034c4873b44c34c27eda78ed9b21adeba0a8d69aabaf85d25886049263bc329dafdeb9d5f176cfd780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366969, "uuid": "74163977-4137-4ef2-96e9-8ce3122303cf", "value": "T1C02309C8F443D9F9DC4A09742036FB2BDBB2F6BA2329DE43D7A495236C51742A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366969, "uuid": "2278d1e6-68da-4ca4-86e2-9d96f8458538", "value": "1536:6nJRT4QPfZfW5XTOeY3DvetAGAZq/4Qw7bn2ide:Gv4QPfZfW5XTOeoOz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366969, "uuid": "91fd8ad4-0277-4b80-8ee9-4dfc5c81deb1", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366969, "uuid": "b2a48bd8-90d1-4fea-a3a8-2813aacc51bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366969, "uuid": "5202be58-6b8a-489e-a604-c1a654272dac", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831af6ed-2785-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774358980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358980, "uuid": "efcfd9d9-6e6f-465e-95e9-949032bdd44c", "comment": "Malware payload (RemcosRAT)", "value": "090290e3477e737c343531a7d0e94147", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358980, "uuid": "35727147-6b33-4126-9114-bd5f41a5ab9f", "comment": "Malware payload (RemcosRAT)", "value": "d96b3ab60eef73a2047bb1adef62a69e072342ecfa78ee48c13ea3efc8254430", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358980, "uuid": "7bac2086-2cd6-4d68-95a0-8f02e4b3bd8a", "comment": "Malware payload (RemcosRAT)", "value": "464b235c98d555073b1fe355962f0a0ac45ef02b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358980, "uuid": "9c51f51b-f356-4320-a28f-5ce1c4802dca", "comment": "Malware payload (RemcosRAT)", "value": "58387aa4407f5c7d82b13b2c5191d139db796f8807b09df14d9098b4b6804a99e01f11e398b766cdb79f70d837a9491e", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358980, "uuid": "12018d36-0964-4f09-bab2-81cbddacd01c", "value": "T14D051213FB95B56FE10689312693968A0039AD63B605DB0B2F83B64F5A337F1FE71904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358980, "uuid": "15835af5-434f-4a88-af4c-5c4b958b063a", "value": "12288:sldbY2zF9VnxanB0fgUlZOHmbGNECrdRN+snRBolgkaas32A3f/TNixuHS96:sldbNzvVnytw2mKtdHR9dPHQUS96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358980, "uuid": "890cb2fe-4335-4ab8-9387-1550e3bcbb98", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358980, "uuid": "b249b1cf-d23c-4bf0-9056-93ef545e9c90", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358980, "uuid": "e98911c2-775b-485e-8936-80dafce79c6b", "value": "090290e3477e737c343531a7d0e94147.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6281a173-2799-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774367516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367516, "uuid": "821290e1-811d-4064-b77b-96060857601c", "comment": "Malware payload", "value": "be18923a86fc8d63298a796fcce4e6db", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367516, "uuid": "86af2a35-4b9a-4b2b-a938-94850f1ff478", "comment": "Malware payload", "value": "d97cf6cc0b4a8f63e19a0277756ea7c28c55db5bc81d8bd90293f9a077beba4b", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367516, "uuid": "be14085f-45dc-4e75-9d8f-5aa7502c2cce", "comment": "Malware payload", "value": "ca979add99462cbd7326b2d558a6533df57eaf5d", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367516, "uuid": "09f5f0d7-ea20-401c-ad3c-74f5f3df035e", "comment": "Malware payload", "value": "db3060d16d2e0152d22aafec6295eea251c1ff748bf5a98cc337aefb62c32ad7142fd2b38d460c4402e6dfd7852c898c", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367516, "uuid": "23cc5bc2-729d-4366-9c76-c6ed085d2efa", "value": "T101D64C1EE3A840A4D16A9578CB518509F773F801C7729A9F11D0CB7E2FB76D24EB6322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367516, "uuid": "92fe51e9-2def-4138-ad66-9cc95f812060", "value": "6cba232689cb6a7527b7e5a8065388ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367516, "uuid": "d36e2c91-39ea-4ca6-a7a7-fa013b47f366", "value": "98304:qmRUcfT1611PFZzY8zWDaDHiQ8QThojbCFk/fUqrOiOc53CFk/fUqrOiOc5VGKGG:mckPhR1F+CiKF+CiNGKGLP0UP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367516, "uuid": "7030ffe0-eacf-4f8a-a440-e9bf877478dc", "value": 12669232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367516, "uuid": "8ad0b638-6db5-4783-8c8b-8538d857c210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367516, "uuid": "01114125-2f7c-45ff-bd97-450d356945d8", "value": "d97cf6cc0b4a8f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc3e0f1-276b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1774347962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347962, "uuid": "72536165-a337-40d6-b268-c7a0c0007dc0", "comment": "Malware payload (PureHVNC)", "value": "b8f93cadec39b27228164c498f0361de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347962, "uuid": "a78e53ad-26ba-4b35-87cb-ef26794f1910", "comment": "Malware payload (PureHVNC)", "value": "d9c520ecaef6cba0e1be4c789a63ba67b680da3865441bdee1fd7ae5ae639314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347962, "uuid": "1001b003-342a-4216-b14c-581ae3773854", "comment": "Malware payload (PureHVNC)", "value": "9bf35318d25b6ce9798c8852857d3ab6a3ab8848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347962, "uuid": "5c9ea0d2-4c6c-43c4-a951-95c85e6f0b53", "comment": "Malware payload (PureHVNC)", "value": "d92fafd0755a845dbab436c68b0ea45df0e2d0a17f17547156510492e911901b9d10933643adc77acf27e90451cddeb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347962, "uuid": "2fb8466c-a2ea-4606-b522-cf1a6d4d01b8", "value": "T19FD49D7776174E21C3994373C1C74D41DBA89286B6A7E70EB195239B24063FFDE0A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347962, "uuid": "ff569099-3489-4582-8617-56493282a208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347962, "uuid": "0eef0ad4-0a63-4d7b-84e5-2fe26bc260fb", "value": "12288:nmqSvSeG6JMJz5lKcSYqEivmJXP02MIIYK:DeHiz5lKCqEzPYII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774347962, "uuid": "860c3d91-68fd-41f5-9c5d-0fe2fc6816c2", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774347962, "uuid": "89c9c081-5955-49be-8d29-0be0ccd2df1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347962, "uuid": "6e4d01f2-e84f-413f-811a-aa555cce7a39", "value": "SecuriteInfo.com.Win32.MalwareX-gen.49157134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7923bf38-2785-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358964, "uuid": "3bdfaede-0091-4d8c-bb36-22d728932d94", "comment": "Malware payload", "value": "e3089f9c1e6689f55a6ecf23cee5adec", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358964, "uuid": "db4f53ac-9a06-4e88-a512-c5517915b521", "comment": "Malware payload", "value": "dca1d5bff02747a57805067fec90bfa2845c051186c3473de158c5db5e1eb31c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358964, "uuid": "331e8a97-c76a-4aa6-a968-54d6e3343d6b", "comment": "Malware payload", "value": "272dad460ec9fb668d12f8c5d3052c7087d1b3ac", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358964, "uuid": "41850256-355c-48f9-95db-b54cb106ae90", "comment": "Malware payload", "value": "b291832f25b196d0ad0152fe26180308cf0ba8a18770495004595fd6d2f89610d5f0991fd56a124c1dba71babbc1d166", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358964, "uuid": "e6a534d6-b2a2-44e4-b671-e3bd14fe090b", "value": "T16CB5A736E704E827F8C76EEC6C9E320AE76A801D575D4ED41DABE608618D0C79BC17C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358964, "uuid": "931203c5-8c64-4660-92f2-dde00788f478", "value": "96:fAL2FbyFajFBFlFWFKyG+m/MPNKeMiUy301zO+2yYzLdz72FWNWP1Hz+K1uWvhhv:EoQqS0GL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358964, "uuid": "4af54d6c-2e5e-4c04-804e-85b371f2ff2f", "value": 2462635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358964, "uuid": "fd52ec90-2329-4c7d-b954-ffa72589891e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358964, "uuid": "40fbad89-5a80-4af5-adc7-bc28ee6804f2", "value": "e3089f9c1e6689f55a6ecf23cee5adec.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5022de-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383771, "uuid": "b134f170-3fe4-4668-a1cb-1cc3f64208c2", "comment": "Malware payload", "value": "fd5f7caf5f94e195c89b0a7fe2f34238", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383771, "uuid": "fd1c540b-da84-48b4-a77d-9de6756d4a5c", "comment": "Malware payload", "value": "dd3e3da55a9be4e601f7992b5c4a82f816707e61434a88d04642544f5713c273", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383771, "uuid": "fd315b96-7e3f-4bf5-b817-3f07f3926839", "comment": "Malware payload", "value": "7e63fc935e173272f85f77fd12fb0db6d5acc856", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383771, "uuid": "e1ce9972-d609-4bb6-85cb-bb3fede9bba3", "comment": "Malware payload", "value": "7d6213ed20ed2211b70db1fb6f4ba52efb5eb540415a23ad3458f9bcfd5105952315374dea40fb1d7752b9b84c41112f", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383771, "uuid": "a7c5bf2d-4423-4129-96e4-57b77e22572b", "value": "T16214918D59F322115563B2B99B6FA40E2235E103690ECE107F5C93916F8C63C9AF6FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383771, "uuid": "541c7d68-8c18-4148-9d94-eeafec7c6781", "value": "3072:WyE0VWmfmQZJz3ME4bkCoitvtrHLqrNBlBKWoM:RE63mQZJwE4bkCo+vtrHLqrHLKWoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383771, "uuid": "d1a87fec-658d-4ffc-881a-34d49e2c2644", "value": 200900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383771, "uuid": "f0c822a7-65f2-4591-801d-7327c397f49d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383771, "uuid": "6948f744-8a8f-4dfa-8e65-20744fab9450", "value": "Aq9U_win32.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb80fb6-2789-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774360798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360798, "uuid": "5c9e4145-8e5c-40d2-8a44-5bfbdfc51236", "comment": "Malware payload", "value": "c82089e5704ce168933bdf04686e44b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360798, "uuid": "0e73d222-87e7-4bd3-9f6f-be169516dbe7", "comment": "Malware payload", "value": "ddbcbecd28de4d49a67ac33b27abd4ac886c53cd2c79e260d4a496b067475458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360798, "uuid": "a26b719c-9cad-459c-b4a2-58935a2edef6", "comment": "Malware payload", "value": "dbe0d1c9d4f5cdaa2ed54f949e03d9c11ff801a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774360798, "uuid": "22e14778-0deb-4867-ae53-2023a49baa1d", "comment": "Malware payload", "value": "2f6548ceee862af8eea80daa257f892bfd3ec6ceb4fadcd03e13caade571f0466bd742c9328b074aa5cf3430d79ea1e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Injected PE Image: 32-bit executable", "colour": "#310F4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360798, "uuid": "595aefed-2f61-4058-abad-db17e8aa733a", "value": "T1546412F5E6DB339AE9A1A9B50D01F2C490E4592B847322371EC86F2C4D4C2C15A6FD7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360798, "uuid": "966520cc-073c-4a73-aea5-adcc62c45816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360798, "uuid": "c2fdf439-8c59-4a14-817e-5b261fedbd77", "value": "6144:KY9jyEorNonoYye0oNUNEQ3sjCvKIhIjOM3aTfR7QMBCJWrynl2hZ31sC:Xjy9qoZEQc2vKIkOMKTpQMCpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774360798, "uuid": "166f2f62-f1ca-411e-960d-05270f698dfc", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774360798, "uuid": "72a8f576-fd22-4f9e-b98e-96edbefd5a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774360798, "uuid": "6bc10ae8-e52b-4042-aa4f-12a6961b2ac7", "value": "Injected PE Image: 32-bit executable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d4d291-27c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386786, "uuid": "3e1a2827-2108-490e-953b-81869e62b264", "comment": "Malware payload", "value": "a755207e3145b79215d81c12e2ee6dd0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386786, "uuid": "1ac0c732-2334-48a7-8e7b-b4c25994b988", "comment": "Malware payload", "value": "dfb36fb8e67bd229f7d49d7c617cac3881b2decbe41b0b1f1c06b32c2af437ce", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386786, "uuid": "c977131e-385e-4ce6-a9a0-a5ad6fa8e00e", "comment": "Malware payload", "value": "4c16f7cfce5a831b472fcaf06482b1e4968c274b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386786, "uuid": "ca16ca7e-cc7f-451a-8430-c56fb93995d3", "comment": "Malware payload", "value": "6be042ac37f2e2f3d293d0f71e44b90b52eeee8ec20d2bb2dccf7f1f212038354b8179cd26829ef4f41ef862aa20ae72", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "wetransfer-icu", "colour": "#678344", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386786, "uuid": "66f872bf-8ec6-4020-909b-e9721c5e3498", "value": "T1C86733D8DC678B4FC03AC93E8025574E9AD1AC78581208A761AFB78E5CB73E12B3545F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386786, "uuid": "c66e08cd-156c-46cd-9079-dc880873deee", "value": "786432:/S4d0vlCCDdyfI2tKRuFGGai8lele8dj:/x0vsCDdyQ2tLFviD8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386786, "uuid": "d3a530b0-4339-45ab-bfc8-b5a4f610a4d4", "value": 29814784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386786, "uuid": "0919e987-74cd-4bc7-a6eb-24e9a4ef8879", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386786, "uuid": "7b166fb2-ce49-4781-a1d3-5735e6d9491f", "value": "Download_Movie_Maker_2_6_For_Windows_7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108124cb-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343326, "uuid": "c719b705-e0dd-49fe-a8f1-c195ca2afe47", "comment": "Malware payload (AgentTesla)", "value": "eaad3ddf6ab135baa8aeb6498198e8ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343326, "uuid": "fa0b1149-b454-4ff5-b205-2714e7522305", "comment": "Malware payload (AgentTesla)", "value": "dffdea445a5a3ba026752a56c124c0926cd5bc99604d6d1195505102a7576b7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343326, "uuid": "2ffbec1e-7361-457e-b57b-3ba2dafa8947", "comment": "Malware payload (AgentTesla)", "value": "a17fcb0226e55393cc3c2c73233379ab30466691", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343326, "uuid": "93a919e6-6641-473a-b938-85fc2347329e", "comment": "Malware payload (AgentTesla)", "value": "53e588d411ba7a41fda9f0a9a5ffa006a0cd2823532f65c896a4a65588178c82a4a12c2cce8df10a4a9a63fd6bd3f3ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343326, "uuid": "c8b6526e-d18a-4e36-bf95-674541c6668d", "value": "T13F55AE2BCDDF6E25E3DD211950BB11BCE6E00823E806B5BE7272E8AF35D1705B392156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343326, "uuid": "06274284-6560-41a3-92b1-3538532bffa0", "value": "12288:K5MdGN4q6OMvMlgXeJt8VjRvMSwdw+dfTku/Uj3a+v7Wbtl7QxwAxIuMETYhPmty:bZq6F0DXSotgYhbbyFGLNPT2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343326, "uuid": "110733a0-761e-4785-b36e-699be03b0aaa", "value": 1389347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343326, "uuid": "bdeeb4be-f4cf-41b8-93f0-2082afb3c939", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343326, "uuid": "9580c401-a0f4-4e1c-b3bc-2f184430bfd4", "value": "Order_2026-081_Full_Container.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee026e9e-277c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774355294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355294, "uuid": "17134fde-0d55-41ee-af22-5b2a96468899", "comment": "Malware payload", "value": "f000da23d69e55c7d4ac2664e786fde1", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355294, "uuid": "40958ef9-e512-4bd1-9bf0-eb02e7a94d48", "comment": "Malware payload", "value": "e09d8cd18a910fbaa030541b7f14047accffa2fe8c65f0f72411b0e4bf579501", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355294, "uuid": "0ebaccc2-5712-42ee-9ea4-dd707b439b65", "comment": "Malware payload", "value": "a2acfd5e56a7f2dd897d58cf40b8b6fcfcf15803", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774355294, "uuid": "d4b5363b-3e10-41f8-84c2-eadc8c209e1a", "comment": "Malware payload", "value": "cb02e096309abd871326d86efac2ab62ebb040717b7d1fb4e9ac466eedc28af5f19455445729685279f7fd1443e16297", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355294, "uuid": "b6c47dd4-9917-4815-a304-4fb992452836", "value": "T1651833F23A5C9F09BC3AB27C08491322D1D6373A44BC61B4DAAFC7572D5242EDB85927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355294, "uuid": "d52fa567-f480-4597-9117-2f028cb3a60c", "value": "1572864:UVwMrLgHVHhkGa5Tlkt4ecQJy1q+wf3fcFm6/6Ov18Tm9LdF:UCMgfkytIAkwfvq/6Otum9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774355294, "uuid": "cb2499a6-3924-4bcc-a087-8ad140ff9d31", "value": 87434408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774355294, "uuid": "28508aac-66b6-4c5a-8fdc-ed1c5daba217", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774355294, "uuid": "d7de1bd0-48c9-412c-9d6d-d4ee22a6c8a9", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2dc5c6-2784-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358435, "uuid": "2c3e45d1-7c3b-48d0-b76a-cf5789fe418b", "comment": "Malware payload", "value": "20c9131f25ab261fc21a16ffcff869b6", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358435, "uuid": "4779fe40-9a92-4712-8408-c5621bb44a2a", "comment": "Malware payload", "value": "e0f93b73682c054911afcbf7f5d59b2a15d725eac9227d467c46f25993fb89c3", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358435, "uuid": "7f5cef31-5f5f-4273-9e32-7908d7f23e5c", "comment": "Malware payload", "value": "8f8c463ae56d10e3bab51a517a722ebd0b9459b9", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358435, "uuid": "becdfe37-5ef7-4b30-b71a-b074b11a587d", "comment": "Malware payload", "value": "569a02e8ba2f7872e6dde55874c4643efe79e38b972e9c16d846fae2738511cc05d8fdd78712e7e3d38b8b3773d0919d", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358435, "uuid": "8e724c1e-1254-4d08-9603-342e9975c4f4", "value": "T17E6533E9885EB4547F8710813C39E27ACA29BF427E3DFD45E2D5207268640BCEE9B4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358435, "uuid": "08cba7df-14a0-4bcd-8edb-7b6c38fdc9ea", "value": "24576:GVCHTWS1FH9x6DFZVTmga4nF+Ei+nYKodRbYRcPQJLuVt3Y30for8j3qoP:GGh9YFWgkERLodRbt4LuVuEfoeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358435, "uuid": "815069f3-e74b-4f15-974d-ea00c7ed94bb", "value": 1415427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358435, "uuid": "f963047d-2215-4d5d-b12c-b8cb9aec2339", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358435, "uuid": "768022a5-6106-420b-8a37-0562454204ea", "value": "kru.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1f0ed7-2737-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774325652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325652, "uuid": "524330a3-2773-4ca4-81b8-cdaa86526447", "comment": "Malware payload (Mirai)", "value": "e2b571aa36d82e4825a0df4e1e2b013f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325652, "uuid": "09287b65-8349-4a67-9130-fa429ca971fc", "comment": "Malware payload (Mirai)", "value": "e3060223977da8f21e95f6df338863429d0d547e68063658c875b629e27d4b6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325652, "uuid": "595b8dec-5b38-4757-b7cd-243092de5f45", "comment": "Malware payload (Mirai)", "value": "c3b8abe19dc29359a7942dda399b1b56d1f55ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774325652, "uuid": "d80596f7-edc8-4329-bdc8-e900159bbd00", "comment": "Malware payload (Mirai)", "value": "4578593c50c2e3cca35277592cf95d8e7bf7fd8046326fac0721cb39e76d0cda2bf6624f7ebe70fb97f861d747e4a5e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325652, "uuid": "4ed70a8c-9fb9-4661-b0f1-3304d6eddbba", "value": "T1AF536CC5A687C8F5E81605756133AB374B37F53B1029EB97CBDCAA229C42B01E21739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325652, "uuid": "6bef8d2d-76fb-43c6-8053-c00923ae10c3", "value": "1536:yFTEDQhVTerheQ+ebAJMUAlUhCA7ALMurVQSPqs:yFTyQh1eHpbAJZAqhb74MYnqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774325652, "uuid": "b5fa2d6e-630f-48dc-a362-c5f95547cfdb", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774325652, "uuid": "ac7cfff6-e07b-462b-86e1-11ce12f4638e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774325652, "uuid": "12dea02d-4f2e-45c3-a948-c93840042c72", "value": "tux.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c09eb9-27a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774371970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371970, "uuid": "c5818211-33e5-4b34-8336-5dc2f32beb24", "comment": "Malware payload", "value": "5c2930140d4664c4fad7b5dee3dc1dd5", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371970, "uuid": "fe66b73f-a7d0-4c5e-a294-86fe1dc9011f", "comment": "Malware payload", "value": "e333a0cfc335e631c989f7171f1bdd814ad907ef099b871c3aca8b3c956c27f1", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371970, "uuid": "6298a581-ec04-4aa2-b350-1c9f3b5d169a", "comment": "Malware payload", "value": "4729728fc5b71bb22e2bfe1b5864784a2fb66814", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774371970, "uuid": "5f543364-7c90-4a16-9c4c-99ade0a37c79", "comment": "Malware payload", "value": "7c48d895da53311af545b1730f6255ab1c2ceeaf8d95ab8152c3c8d67c3306a6ac2d9c8004972058fa1f0008dbed2f65", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371970, "uuid": "65830f35-3e10-4462-873d-3d5f59366aff", "value": "T1729412B746C9BD3EC44D42F7C943B070F8A95D039A74B2661A5347EC8C9A61D062A8FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371970, "uuid": "11180584-e762-40ac-b4c7-9c72dcae062a", "value": "12288:uTktl/NXlQBkUK1DvgdArOMkva7YAwmTX71ROvq+ZImAWGmrKp:lx6k71D46AeD7GhZIcGm+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774371970, "uuid": "8dd1e7f9-5610-46f8-b775-648934e7a750", "value": 432140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774371970, "uuid": "6c2adae7-b154-41ea-8222-0567fd930bfc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774371970, "uuid": "6e6d7ee7-b6e3-43f0-87c6-cdcbc8d16ade", "value": "Payment terms and conditions.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afdd155-2793-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774365007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365007, "uuid": "01ab2cd5-d111-4db0-8e65-834b6c74713d", "comment": "Malware payload", "value": "61593234b25ce14121abe561420a795c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365007, "uuid": "f947337c-a7ff-4c97-b8b1-04e3bc486677", "comment": "Malware payload", "value": "e3abb4eac9ff646e991a992d9f1753a0407f1cac89ab7b3a17ae96fbe84e47f4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365007, "uuid": "dc73ec48-db16-4dfb-9665-4bd24ae92d65", "comment": "Malware payload", "value": "a97f338a8efc65cf94af0a5727273d71e7c8d657", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774365007, "uuid": "a06db36e-f75b-460a-a3d9-de025633f2cd", "comment": "Malware payload", "value": "c08ea8fb0c730211ea86594049d014ce624e07f481a45401b524953f955bdc9c00533f1e312d5359ab7c9be51dc56eff", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365007, "uuid": "0398c51e-09fe-4331-a72d-9dd45d11bf52", "value": "T1785733C4D0E9BA0AE436C739C4F726C998587D1ECB621865253670AC27B3FF4B9B501E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365007, "uuid": "4592522e-d9fd-44e7-baf2-4a4860fcd00b", "value": "786432:A/K9CQdON4T4TtS9pXOScEN/ndRlTJont:AC9CQsNE4BQ7cuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774365007, "uuid": "fba30c6d-1dc7-46e1-b2ba-2df346746de1", "value": 29384704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774365007, "uuid": "32e395f9-a8db-497f-ad9f-fbe3b1bf229c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774365007, "uuid": "5b438e80-d86d-4ce2-bcf1-995bd8be50df", "value": "AetherixCore.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0002b633-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366921, "uuid": "ba39f951-d980-4c03-9147-4010bf074f19", "comment": "Malware payload (Mirai)", "value": "1997ae9513f5c25053b51ceba625bf7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366921, "uuid": "aa7d4021-79a7-46a1-a9e5-d1fba05e6a15", "comment": "Malware payload (Mirai)", "value": "e3f41c89c9e8ab283c73c581f9ec430b1bf1804ba5889d6c69201c5d0d489fad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366921, "uuid": "acce65b7-88f5-40cc-9fdb-559297b0857b", "comment": "Malware payload (Mirai)", "value": "69d1a7450956514bb8afe95fce023f0a2750321f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366921, "uuid": "9731e7fc-3311-4a6d-8891-5a24d91ebed5", "comment": "Malware payload (Mirai)", "value": "8a41bf405a3caf0a163d7b3a6250dc714eab15bde450febee63c15807581f72698ee39c6f0dba9409933a2ccf73a9b6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366921, "uuid": "dbd53b07-8623-4e15-a230-9c4154f9899d", "value": "T16682D034609774F0CB714835D1BE8EC76B460BB8E1FC26E326496B5DDE1340992FA2D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366921, "uuid": "dcf7c939-3775-4d52-b25d-ed958e48e66a", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUmJ6eyP75hymdGUop5h5lbY:2dV0P6+kom0tVAoNvm+tFVyPNs3Uozn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366921, "uuid": "51c5b116-e23b-4759-ad8b-0783a212c753", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366921, "uuid": "d58ced6e-0bd4-4a27-a4a1-ca5bf11a8bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366921, "uuid": "66801eeb-d524-4c46-a444-71798f4af3ac", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a414001-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774366965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366965, "uuid": "9cd9c720-98b6-4e12-b147-67c03e5a876d", "comment": "Malware payload (Mirai)", "value": "14265b55709763978ffbf9e451a293b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366965, "uuid": "2b3bb11a-5fbf-41a7-ae0e-2f279a0cd2ca", "comment": "Malware payload (Mirai)", "value": "e467feeb05f84f15c7c33caebab74cb864de6254cd69db1ef965547c592e182b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366965, "uuid": "0944006d-46da-43e6-adfc-41d3c15925f9", "comment": "Malware payload (Mirai)", "value": "43d9f39949d627594872922a3e7d49878bafb54d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366965, "uuid": "9c861500-7a70-4866-9053-d249b7f7daf2", "comment": "Malware payload (Mirai)", "value": "7526110959ae3ff016d7108ca360529a8d020852126ee127141d5402b3337e6d5a463347d9153530df5ce9d77868a903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366965, "uuid": "87b090d2-f167-41e9-8662-76fd4a51bf14", "value": "T179230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366965, "uuid": "8ef14513-0b8f-4bdb-bf2a-d493e17c6f04", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THo:5DmKF7Gxyk8cqoHAmWurAufsk5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366965, "uuid": "452eae07-d490-4fc8-b67b-31bbefa6d6cd", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366965, "uuid": "810a11f4-ca34-4107-ac6e-a4126ebdd580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366965, "uuid": "5adb0499-9b6d-44d8-b779-30e7f0878cdf", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c62301-2769-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774347046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347046, "uuid": "c9bc697d-52db-47a1-9e74-c090b31ea6bf", "comment": "Malware payload (Mirai)", "value": "42250359ddd022524f8a4336141ec7b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347046, "uuid": "4b0ade5c-26f7-4099-83f0-f3f3c63cf8f3", "comment": "Malware payload (Mirai)", "value": "e472983455464d89af3ddb529dc383eb88a275f05174fe207cf5db484622e6f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347046, "uuid": "e2414e8e-1ad6-4731-88a8-0c366a4e4147", "comment": "Malware payload (Mirai)", "value": "f95cf1a706f3df24adbb53d537467b543e50bc18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774347046, "uuid": "9e800697-d4c6-4e95-a9aa-7d4515db6f0d", "comment": "Malware payload (Mirai)", "value": "b6a56c29db0b14fab77f4ad1cd89b00c334993c542d086dfe94859a618aef822f8f3b712f49aecb0d8e56973b34e860b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347046, "uuid": "0547b41a-eab4-4070-a42d-0c4ec14cb4f8", "value": "T1680429417E419E37CBD0A77ABBFD42CD731223F8D3EA7112EE018726369A5290E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347046, "uuid": "7f833202-938e-43e1-b3ce-6792716804b2", "value": "3072:zolsBRiRy4r+bo02klRZakWnihOQ6yYFH1d2zFeqGDSzWNndp/bl/eXi/Wz3T36n:zoGBRiRyq+bJlRZ+nihOQ6yYFH1d2zFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774347046, "uuid": "fed827a4-5d7e-4e1c-9558-402f99abd945", "value": 175256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774347046, "uuid": "1131d916-7a4f-404d-bde7-e95a37749ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774347046, "uuid": "f1da63dc-4a60-47b2-8747-512ece6ac7bd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247fe567-2768-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774346366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346366, "uuid": "ad5c1fa4-9ffb-4de6-b5b2-14892bf014b4", "comment": "Malware payload (Mirai)", "value": "123442c41029fd94b39ce6aeba51170e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346366, "uuid": "c9a47a1a-ce74-41b0-afab-289536854236", "comment": "Malware payload (Mirai)", "value": "e4ad930449f130b22330db4edcdba4d3cc64f73b0fec860372992c0ea05e21d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346366, "uuid": "89662a8b-31d7-4b1d-a24b-d3aa4607dcbb", "comment": "Malware payload (Mirai)", "value": "a73ebc804d36eb726776233ce1286f381126cc7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774346366, "uuid": "7005f317-1303-43aa-a72e-bf5e913b0b26", "comment": "Malware payload (Mirai)", "value": "96018cdcb1446125aac3bca7415c482cb49f0508d33c04f8f56e94ce873e00ce2d6190dd43314b8aa83033f785daf536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346366, "uuid": "4d811a90-edeb-4b11-8fd2-a2a983fa34a8", "value": "T16BA31906B9919F11C4D621FAFE9E459D33036FECD7EA3102C8246F94378699B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346366, "uuid": "cfbf179d-5274-42e5-a31b-1a7bd14152ae", "value": "3072:K86PK0CxdwlS1/caPfaSPhTnpxeXDir1iyEZXH:p6jQMSlcaPfaSPhTnzeCQPXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774346366, "uuid": "1b36ec72-3d20-4dad-8080-ff75ca9a654f", "value": 101320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774346366, "uuid": "2dc7b8b9-6286-47db-8f5f-c95af2de8a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774346366, "uuid": "b6021ae1-06f0-4c3f-94b1-746b76f3eb78", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdbd6bc-27c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386214, "uuid": "1a22d53a-0cef-44d6-ad8a-27be7e584e0e", "comment": "Malware payload", "value": "6588424d971d4589db64a35ff8fbd4b3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3254", "colour": "#55F820", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386214, "uuid": "9897b23d-22fa-4a87-b712-6eb50f7a5236", "comment": "Malware payload", "value": "e4ed95fa06d862bc2d2590203fa81ea8ec5c38f6615e633fc3d081557854aa80", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3254", "colour": "#55F820", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386214, "uuid": "5b5dbd4c-ad7a-4c5e-a179-4595e7b58e57", "comment": "Malware payload", "value": "f9520947f1750d3b0c0ff102a548bb892e4a1e32", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3254", "colour": "#55F820", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386214, "uuid": "d89555e8-c601-49a4-9dd8-26aef9ee7910", "comment": "Malware payload", "value": "dff680b9829d4eca07f863bf6226e4de47e8cc67c7dcd4395fcc7876ea11bf1475e25febc24335932a18f65e6e973302", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3254", "colour": "#55F820", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386214, "uuid": "64a001ca-50e1-4ef1-b512-f62d23ffb5d2", "value": "T1A70733FA5C9C83DD7AE5DD68A08DBE54204D4599E5673C87B9EAB80DBC7B34C420C8A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386214, "uuid": "aa04889d-2906-4182-9bea-3323e097242c", "value": "393216:EmnArgaSXFIkRatoLhwxFqs7IrEhxQVoZbTgnkrmhGc9HTDnO:pArgXXFTrmqs716VUTgkihGiTrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386214, "uuid": "7e36020d-ddae-4e61-bae2-d3bb5bcc28ab", "value": 17235587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386214, "uuid": "0ef666f3-5c73-493e-8ec1-96d16506e7ca", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386214, "uuid": "85305d10-514d-4e40-a615-3d6ac4564e53", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92677c07-275e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774342256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342256, "uuid": "f8a8fda6-552e-492a-9a3f-1ebdfe03224d", "comment": "Malware payload (XWorm)", "value": "ff617fc5d1968e2d95a7aec28cefac4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342256, "uuid": "e8b6c975-7c4d-46bb-8bbb-4c0aa6068164", "comment": "Malware payload (XWorm)", "value": "e6bb646f56c9c4807ee6aa5d50101b0bc1240f748e6c9c12a3f673f2f828d10f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342256, "uuid": "c4382160-507a-4df1-a3d5-2c8ebac64820", "comment": "Malware payload (XWorm)", "value": "29fd27e9b165631a8cf903166e75ec1e7d6df986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342256, "uuid": "08c37fef-d0c1-4e73-a954-3c754b7a565a", "comment": "Malware payload (XWorm)", "value": "b22d9351aba6f1b193045e77a3b5d234babab95d920ce1c615d281ece4607c26643ea5e98ab195c311c483a3cd91057f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342256, "uuid": "e124d0fe-9822-45a0-afbc-99a31891943a", "value": "T177E4CE621E567F48C63E0BB8C027098873F089539283D76B7EFD51F54AA3BC6CA17946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342256, "uuid": "3bbca625-464e-429d-a51b-ffb8e465b0d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342256, "uuid": "0f3d8a03-af6b-4dc7-9d2f-4b6cd70631fe", "value": "12288:iDaqcak6kuuk26BN+X4QG7MAB6J/zzBsdXGSQtTjJq/pV14J5cvTBg11EQ5rXH98:4agUK7MABYK2uxb4STBa5rXH9c7oI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342256, "uuid": "6e4dc8e7-ffd0-45e8-b972-0211de584da9", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342256, "uuid": "1e1ab30f-b9ba-4353-96ab-07fb5be101e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342256, "uuid": "6523b071-3ac3-4cb2-a8d8-e7ca4302bc68", "value": "ff617fc5d1968e2d95a7aec28cefac4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cd4507-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774337879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337879, "uuid": "e7420a5c-dc46-4704-abfc-a2b237ebb3cc", "comment": "Malware payload (RemcosRAT)", "value": "046bf7a3d451768f0b7c0899db426e96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337879, "uuid": "976cbb7c-7012-4666-95dd-edba087b140b", "comment": "Malware payload (RemcosRAT)", "value": "e6faf4b04b4af47427346ee41caa3aeb95b7e864458d570ba5111d73cbc70f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337879, "uuid": "bd75794f-395a-445f-b83e-3a9d851037e6", "comment": "Malware payload (RemcosRAT)", "value": "e257c186521fff6434d0c0e671d747b4f8e295bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337879, "uuid": "08e75d1c-afff-4ca3-86c4-957a5e78b7b9", "comment": "Malware payload (RemcosRAT)", "value": "cbb70532c998aada669186cab2d2c25e8813ef2668437257f3822c3c932fa8d5c0a3fac293c79a583d2ad25700f8770e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337879, "uuid": "f32af6eb-9441-45e6-bd6b-fafd43c4d3bc", "value": "T1B4F401142748DE03E4DF17F42768E23617B45E9DE922D31B8FE96CEB3CA67142A09643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337879, "uuid": "60e7bd1f-cdc2-40d5-a1a8-c89e232e400e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337879, "uuid": "32cf0f06-be42-4820-b54c-dbc6c5dee492", "value": "12288:E+7J9np+cUkdyr7aXKsl3GFB++icDFrgW/RfRv+GHCxMhvzkR:xjbma6OWFT9DNgW/OJMJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337879, "uuid": "77b4cb73-99e6-470a-b44d-44a2f87df491", "value": 736776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337879, "uuid": "1293b00d-7d87-4d0a-92fd-d982fe8932da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337879, "uuid": "9c001758-d002-4a42-9561-b2c7eb2578cb", "value": "QUOTATION MTL #009447222.pdf(68KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1b933f-2784-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358678, "uuid": "dcd839ec-768d-4d7f-9fdf-b6e777bdf3ef", "comment": "Malware payload", "value": "2c85efe152a25281f250b3c80380811b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358678, "uuid": "b2c0f5b6-4914-4528-ae3d-cb07d785e69c", "comment": "Malware payload", "value": "e73fa583da7adc97a772826ce26e16ed0b95e4193a36382a2e69e148fbd4dea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358678, "uuid": "88b74d06-42ed-4c5d-a073-11031c6a9e63", "comment": "Malware payload", "value": "6523598f79da9d194184d526186cdd18d80dfe5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358678, "uuid": "c74fb6b6-6f45-48c7-a031-46115099baa6", "comment": "Malware payload", "value": "438ef0f4f8681bbcb751b9b24d10cc71ca355e924bb69e8e54f5a28d2578299a2b0394da4c57127e3ffbad6fbeb58bce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358678, "uuid": "9f121a7e-1512-419b-aee2-531a14c531b1", "value": "T19D6512127BC484B3D47225311BB657901A7C75701F72CA9F63E469ADAB306E1CA32FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358678, "uuid": "eea5ee0b-4d15-4fa9-838f-c11934aa7e74", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358678, "uuid": "6761d4ab-8f5b-4b96-a499-9f0a371eecb7", "value": "24576:KN/BUBb+tYjBFHEPxZswb7CJ3qcm2BY3Zl9YN5zyXITzX1zJ54D+qRfoBan5F30:6pUlRhSEwnCJ3qtE2Zc5+X6zX1zJ5w+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358678, "uuid": "fdbce897-8b43-4e5f-ad77-d9b10bccc5e9", "value": 1450793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358678, "uuid": "ae69a56e-3ab2-40d1-9d7e-f3ba5b7e02a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358678, "uuid": "19e1517a-7630-4008-9844-82236baa5586", "value": "oak1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e11151c-2799-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774367374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367374, "uuid": "43f153a2-5d51-4e2b-8df1-b5b950c87214", "comment": "Malware payload (Berbew)", "value": "4792439deb933cee589accebad53e6fe", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367374, "uuid": "71db08f3-3e21-4034-afce-3a92f210fd5b", "comment": "Malware payload (Berbew)", "value": "e75d2101d05a26a0514be7bf9bc26ffcf11c6b9d79911f8c85a34ffe6fc4137b", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367374, "uuid": "f2154537-f4e6-4f61-b06a-3079bb690063", "comment": "Malware payload (Berbew)", "value": "d300e5f81c2f23f4f6266599fd79a87a71553d68", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367374, "uuid": "576908af-8566-4492-b558-7ded3add1ab7", "comment": "Malware payload (Berbew)", "value": "389b0ee1233c64b2e4476174bb1edb923698133c5d3b666083e4d841d26eb549d30bc65c8f2006876b4188d0627e69fc", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367374, "uuid": "83aff82f-ad56-4cdd-bef7-b8f1e8f4f919", "value": "T194857C1754759FAFF08E573F12722695F8B043EC3AB68B19AE70C69B0A3258DC49CB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367374, "uuid": "d9ec3aff-2fab-4a39-8445-48b7a28c114a", "value": "3235d0a66c0a8ca4d8b84f3bea439dce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367374, "uuid": "5aed1017-6cd6-4a66-848c-4c049d5e6aaf", "value": "49152:9ix7/ix7yix7/ix7Xcix7/ix7yix7/ix7Y:9U/UyU/UXcU/UyU/UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367374, "uuid": "b22137ed-0385-4211-a6d0-47766d102964", "value": 1745960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367374, "uuid": "818ee37c-e642-454b-adf5-a238cc64e1a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367374, "uuid": "fbcfb9b9-ffef-4921-a809-85ac7f001dff", "value": "e75d2101d05a26a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b4812f-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774343340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343340, "uuid": "52728716-7b2e-45de-b30d-13c3b36ac345", "comment": "Malware payload (Formbook)", "value": "dcf432733a021e73f55745bd6f5082ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343340, "uuid": "9b1edce1-a9fd-4ea4-9236-405ad605aad2", "comment": "Malware payload (Formbook)", "value": "e805bc653dd7355b21b93d441c493cfb40037f39101d6bd841c4de5ac5ea5f79", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343340, "uuid": "83941dba-4151-482f-be62-4dee66d2b57d", "comment": "Malware payload (Formbook)", "value": "c4f1a2649f6f46a6b123eeba81e899e34ca0cfd0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343340, "uuid": "8df77d8d-62a0-41be-bd02-1a4e18fde4e5", "comment": "Malware payload (Formbook)", "value": "fa2005424c0f35abce6267d9c93f53919e21507e0d01c902c7ad0fc315b28d4b40f3892f541b3b8effa3a81953665c38", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343340, "uuid": "fb469b1b-dc84-4bb1-b6b5-bc3194d1b86f", "value": "T120959F16C48017758AEAFD0E91FF324FA2E1934BC0469FA9F6517D42C9DE9017B2B9C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343340, "uuid": "5bda51b6-baa9-47c3-a1a9-ad3967706826", "value": "49152:Uk0HgKpQOuTzbSdZOQaaL6ULJz6fd87hw3vIBh:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343340, "uuid": "169fc796-c6cb-4f55-9708-cee3f4eeebe4", "value": 2049094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343340, "uuid": "d1967378-1e99-4dae-a0b5-22effc4e962b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343340, "uuid": "2f5b9815-d43b-459e-b185-46adf965fb26", "value": "dcf432733a021e73f55745bd6f5082ba.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553d3416-2793-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774364916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364916, "uuid": "0225015f-d762-41ce-9eeb-53bf7193b56c", "comment": "Malware payload (Heodo)", "value": "ca9ec4fbfc7c04b14fffa465b687f535", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364916, "uuid": "484a87c3-e14e-4e6c-a58e-644bb4e35eea", "comment": "Malware payload (Heodo)", "value": "e8444339164268d9950b137d7a23f09eb213b9e9fedb7d4a025b5f1075e3929c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364916, "uuid": "c49bd89a-eea0-4e1a-8893-0d654980c1f1", "comment": "Malware payload (Heodo)", "value": "9208aca44f70e907d565da5e8c74183cb0e337de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774364916, "uuid": "6f33b036-07f5-4e8e-83e9-220a9dcbb5b7", "comment": "Malware payload (Heodo)", "value": "04634eef1f5cede15d8c4750a7491f49336d2916b8bbab46d2926974f07a86f0e2e0c23b5003c8d57e2b942d66edd611", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364916, "uuid": "ee9d1d4a-c07d-4f9a-8df5-fe7b82fd785e", "value": "T1F514C3067A41D573D8454639C8C6DAF93632EC60DB07CBD376E03EAFBEB6AD42820165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364916, "uuid": "2b16efbf-ee1a-4e1b-82aa-653a6612c36a", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364916, "uuid": "70b73980-683f-4f46-95a6-07d20fa49d8f", "value": "1536:CnWuET+PI0lypKqv0hCwTeLwp0n3BA9Eg8K3T9:09qkvTeLw63BaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774364916, "uuid": "7f28a874-b126-4c8b-bae0-59afa0a399e1", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774364916, "uuid": "77afcc4e-cc8f-4711-b86d-4f35f506de8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774364916, "uuid": "04af2fd5-4369-4f6c-8820-42e31a70589a", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c71a4b-276c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774348212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348212, "uuid": "19a059db-f9ee-4155-a14f-06a06db44814", "comment": "Malware payload", "value": "a8910faa5275b08d4ee152850e76d350", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348212, "uuid": "7421ab99-5aad-4fe4-a1ea-4e67bc373959", "comment": "Malware payload", "value": "e9fb5839785a9a7edeac01b133c1e6870565caa21de23d3cf9353ffb7b9244c6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348212, "uuid": "b89a77a7-ee05-42cb-8415-b9807584f191", "comment": "Malware payload", "value": "39b3f56a4fd332892f6f822ef1b660ac3096c737", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774348212, "uuid": "e2582987-567d-451b-92fd-1c9313b86dfd", "comment": "Malware payload", "value": "9be00b1e0b8adefed526528932bd37fcd3a4cca6929078ef4a65138d0f7adfe51aed3cedc0185e6e56a075c0e926ac26", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348212, "uuid": "bb7a60c3-12ed-473c-b286-6a4844cb28af", "value": "T153F67D93A7881BE8EA549CDD028C796B50F7C57B3C26219DDAE20723B43DF59BC54A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348212, "uuid": "eabe4f27-87cc-4b8d-92cd-78daf5c2a0be", "value": "24576:s4+gqKAZenIysBq+ro6ECz+f+nVSES6NOP+R+l+6wA+Pqui+ce:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774348212, "uuid": "16fa7c4b-4a5b-4d74-bbfb-8899d384eed0", "value": 15337482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774348212, "uuid": "0dc12b7a-2f23-4a6c-843d-6799d2377812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774348212, "uuid": "3495203b-d840-46c2-9188-9c8327bfaa21", "value": "JetBrains-91267b64-989f-49b4-89b4-984e0154d4d2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59ed098-2783-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774358314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358314, "uuid": "e34c0ee1-b3ef-4b80-8c3c-be5a92e2e0e2", "comment": "Malware payload", "value": "b0609bb9ccc49ed5191125e938c328e6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358314, "uuid": "b1f0a126-e33a-42bf-9ce2-081be1c6cb24", "comment": "Malware payload", "value": "ea6c8182092241d19b9cf25e20aa9455bb02ef8418e74e3916412a5a228520fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358314, "uuid": "79932b0e-d868-4ba3-8285-2b29c2a7085d", "comment": "Malware payload", "value": "2a28af2091956342d580f9ee3d1ce2b64253082b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774358314, "uuid": "a92e7cad-78e8-447a-8b50-8a57430ffa53", "comment": "Malware payload", "value": "928611c2f175c4e181b5772ef87e9482c8053ea2bf02da1764017c389af7d7dfc690058cb306c0f86df0ed1ab5d2123c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358314, "uuid": "3c95eb41-d190-4fb1-86c9-f63f38160425", "value": "T143C633C8357285DC3ECABB601B491AF4BBA441513AD8C587D7113741AA33DFA9BDE80B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358314, "uuid": "520e9171-7ddf-4074-a36f-9e13cf90110a", "value": "196608:72FKzkfxV4sr/DGkbOjQ5Et3/KtWTbLhv3mnIZuTjR5VXgr4iWc39Yx8JzO7e2s2:KFb5xqcAbLYnYuTjRr9iWu6x8IfUUpnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774358314, "uuid": "76450867-cca5-4d58-b96b-7eac803775e0", "value": 12385715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774358314, "uuid": "da37abc8-04e9-4495-94a0-beeb35b6582e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774358314, "uuid": "1badc1d1-bad2-4280-84a3-25aacf648bf8", "value": "Proekt_prikaza_568_o_pooshchrenii.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e4ef25-2761-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774343493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343493, "uuid": "53f2efa1-6c66-48fa-8a90-3df33151686d", "comment": "Malware payload (Amadey)", "value": "701ad776e0d850796d94150733b9c880", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343493, "uuid": "7897da82-460d-4b88-9a7d-3999ade2c256", "comment": "Malware payload (Amadey)", "value": "ea73014533b4dcea85e42aec959e4b2eb884c71135516c54dc5e28f0c09643c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343493, "uuid": "9f64056a-bccc-4c65-9355-5340addbeace", "comment": "Malware payload (Amadey)", "value": "b5b5b08db653b2fb2966cdeb695efff6e9e044ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343493, "uuid": "e91dab15-dbfa-4b38-9297-21ea498199b6", "comment": "Malware payload (Amadey)", "value": "1ea1aaec27ddfca76eae0b00658b6d21ed8ccc5c70ff66f02fa8f83880d26c759d224b9b5a4183576834e796dc5a6fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343493, "uuid": "a9546c67-e2c2-4f92-bfe3-551c9d53f3d4", "value": "T145B44A5AA25943FDE07BA17CD5575E42F638B44703B18AEF039005B32E572E2AF3A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343493, "uuid": "67377871-24b0-4da3-b383-3c0ae33043b4", "value": "8db30f7f23140d78d7f34e827c0f7dbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343493, "uuid": "5c4b287f-f095-4403-892b-8c6f077373aa", "value": "6144:R5RYwx+VJi3YHIu+uUIsVqdEidqKlTZW/Y+6eGU9k6BZ0Qlfj1ohN5MpBPqoYRuZ:R5RFIhHAIsaTdq516yMyo/5MpByoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343493, "uuid": "cc962d50-ca6b-4d3f-99c0-b3f5088030b0", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343493, "uuid": "23f5403d-3c1c-4a73-ab62-448b5ed6a74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343493, "uuid": "7b3b5006-e425-4a35-9f59-83d53a83a8f5", "value": "701AD776E0D850796D94150733B9C880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40472185-2797-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774366599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366599, "uuid": "b177a755-009a-4ea6-a0ec-1d73ae58f251", "comment": "Malware payload", "value": "0cb747d04e2bfbc7dcabbc79b678d8e9", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366599, "uuid": "9f53c6b7-476e-4ce0-820a-1e6f911b9bfe", "comment": "Malware payload", "value": "ead2310ce64978f8f54955a2f4ec362c4cb06048430a30920d5a5bf3473a67e3", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366599, "uuid": "5cf8e775-d32a-4405-80c5-4f9bb78eaf80", "comment": "Malware payload", "value": "9df514144c6d5a9469805ae8bd921babc573f16d", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366599, "uuid": "2289b039-0259-4116-aaeb-d0d2b5f5a37a", "comment": "Malware payload", "value": "3cdca7fdc2d3fd1df67109e83831e032e3078bda119a5d16bdc32c329cf746136193fa7da0257b49491041937d2ca1cb", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366599, "uuid": "c341e951-4b04-4d45-8302-4b8889ef1120", "value": "T1B3C58D20B542D031EEEA08F592B99AF65D788D18772B71D395E87888C5B30F1363D39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366599, "uuid": "f5a521f3-a327-4d43-aa97-11e1a7accaa0", "value": "d3c8d1acc2e46895f2f7cf1a2a921cb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366599, "uuid": "a083d900-d274-4a07-ac0d-4a335179aa8a", "value": "49152:oF0PbFiXT3Ezr57Da5IHHfFLtZPlswfF1bll1Cg2OPln4MdWHFdtSIqOTDpl+epH:5PXHfFL3tswtzZ2Q4MgHrt7quZvYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366599, "uuid": "198651a9-2a35-4a0d-afbf-af0f44cc3482", "value": 2640384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366599, "uuid": "0f1b38ad-2f97-4903-ab02-8855e5a4c5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366599, "uuid": "2118d7cd-1d60-49cd-9dc7-4e7e324e46cc", "value": "python27.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2e700d-2796-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774366483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366483, "uuid": "2b1ec04a-b6cb-4ca9-82bc-158fa2a79f1b", "comment": "Malware payload", "value": "2295d533097783066abdb594fcdbaf1b", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366483, "uuid": "c0d5596c-3fb8-4b8b-b0da-1dd248cd05e1", "comment": "Malware payload", "value": "eaf20437f52e0df89b35530a85c62cd7ac5ad8b01af539632b9f89b28563d321", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366483, "uuid": "ae71463f-e708-4d6a-a001-cb89866458e1", "comment": "Malware payload", "value": "03c0072742a2df3e2cf2f7118e5a3715b3e818e1", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366483, "uuid": "ec3638cd-ce59-4fae-9849-70b00c8e8130", "comment": "Malware payload", "value": "fa36310bd99296240759ed995a42812d285dab7973ae646ef130f542985a7e8b36e0863f0f8a559f95f662515d41b817", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366483, "uuid": "91bee8f5-4a40-4318-a5a6-2aeede31a7c5", "value": "T15A257D12EC404572F8EE15BA97FD6A7E4C3C96061328D1D36AE2A1E14E705E3773E386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366483, "uuid": "840d54e8-f9f5-4418-af51-9826746b5f68", "value": "b0dc4c1caa8bdfa5c1b94196e7ea9022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366483, "uuid": "07ff4952-17fe-4801-88cb-ff8c3bcb6a8c", "value": "24576:xQhOEvtEWiRLcoTUIEPmUsOE0iUadcBoO0kAB05RSpUWZGDqul:MlE74EUXrZ6O0k1SpUlDqul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366483, "uuid": "e37ae4bc-f07a-48b9-a466-6594cb224b62", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366483, "uuid": "4508ad60-257b-4864-8111-a2818d2e5913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366483, "uuid": "a8f70793-9a68-434b-8eab-02948424c6e7", "value": "fskui6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec7c576-27bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774383750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383750, "uuid": "b6beebbf-a156-441d-9446-73c81536ffe8", "comment": "Malware payload", "value": "151b8bc70f13e9056e80d48ff869c1f1", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383750, "uuid": "b726035e-b405-41fe-936a-504a73d719f4", "comment": "Malware payload", "value": "eb07431d9f5cd47b5e54bc4759ed5650621bc1086e919686f891fe9ee415de28", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383750, "uuid": "4457343a-366b-4b7b-bc4a-a2fe798673bf", "comment": "Malware payload", "value": "e5591bee9b947678b356dce18e3efca1a2cc91bb", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774383750, "uuid": "edc2fae6-60cc-4997-8ff5-b651079a3cd7", "comment": "Malware payload", "value": "465d938c7778a1bc9f2e658782688ed910709ad316011b01e1de279a1c76d19789b9412c3ccdffe58e4e9d63299f627e", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383750, "uuid": "4fb72555-8094-4977-8aa5-018d4e28377a", "value": "T16C558E6E97A32291DA7AA70422AA391D433E4C5F14F237497F0D2FDD1F14A7A17B809C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383750, "uuid": "62338a14-5967-43ae-befa-0fc642e7deae", "value": "24576:FrD7yxKk0/u/MjMRR+Athg+T14bWumS7yxKk0/u/MjMRR+Athg+T14bWumV:FrNC03pC032", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774383750, "uuid": "696b42e9-d913-4f68-a198-3cc0bbf15908", "value": 1301389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774383750, "uuid": "d802efcb-25df-4e86-8ca8-88b56f0a6b7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774383750, "uuid": "dd626dd7-b700-43b8-bb40-8469f493516d", "value": "memo_darwin.decrypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bef7a02-2729-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774319482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774319482, "uuid": "350726a6-bae0-4e34-afd4-3062bcf9d61d", "comment": "Malware payload (LummaStealer)", "value": "3a6e86ffb1e1276f1aab99e894f6ed96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774319482, "uuid": "07b25088-41ea-42d0-9d69-6166c43a34f2", "comment": "Malware payload (LummaStealer)", "value": "ed10e243f8caaad1855458c1028a6b724fc643f5c986f45ead490f870ceb7942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774319482, "uuid": "cb73a647-27cb-4355-b9ab-8f36de14ed9a", "comment": "Malware payload (LummaStealer)", "value": "5feac1bb2cac12685d87f86424f9e3fe5f820a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774319482, "uuid": "8ca4bc20-1801-4132-b379-0c4dcb43a74d", "comment": "Malware payload (LummaStealer)", "value": "0bb66b447172e53db29aa1be8177daaee88e9413456f942c66c8e0f7884cbb98f01d18ee4c2dd8e35dc2d21c64997da7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774319482, "uuid": "42d4d0bd-75d6-433c-ba69-8c98168f00b6", "value": "T17EE47CC0699910FBD48A5F340031AB7B5DB42F204635DCEB854768D6AAACEFB423D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774319482, "uuid": "e3ca8aab-1bdd-48a4-bdd2-66cd67b4b6b1", "value": "6ab798bf0b977a6dc9bb8850efa6fb8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774319482, "uuid": "4563f23d-9f78-434a-a0f0-45849a3c8a2d", "value": "12288:TLmv6J3O1b3pwFRNkdgUkFnl3jURuRe5n4GZ91Rd6qIXzsQxvXnfoMC0Yy:/mv66b32F7wQr7e5BnT6qkzs5Mzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774319482, "uuid": "b62c1611-24eb-4bfa-8d79-e4d61708c87d", "value": 671952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774319482, "uuid": "1e4745a4-867e-4b0f-86c8-6d5524e30b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774319482, "uuid": "a76a3b13-b58e-4992-9fe8-96dd8a3f732d", "value": "ed10e243f8caaad1855458c1028a6b724fc643f5c986f45ead490f870ceb7942.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76832824-27c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774384729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384729, "uuid": "a148f09c-e13b-4ba7-a9dc-74433377fa77", "comment": "Malware payload", "value": "0d4dd4231ab0d6273cce82d3990693e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384729, "uuid": "574739d7-8241-4011-9885-d7e80393b386", "comment": "Malware payload", "value": "ee3a26eb91fff4f284032f127bb73dcd6200dba9c54556b3c629914cd981472a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384729, "uuid": "ce5d4a68-2444-45ee-9a36-17721ddea09a", "comment": "Malware payload", "value": "d4d69095405ac3e558776bc7a3f41c471bd7ef4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774384729, "uuid": "90dcd180-4679-4251-83db-6341b55f32c2", "comment": "Malware payload", "value": "f9e2789b7b9b5eedadeb8d70e3744e917567ab6cdd37cf66714a59f19c72f1691987a64184bff4b6faaee22f185f1680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384729, "uuid": "f785a9cb-16ed-414a-9eb9-ec06e5f84bd5", "value": "T18BA512576B132C47C67343B941A1E8FE4B036F6CB416932249FAFCE3BA72A470C96495", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384729, "uuid": "5727429c-5bc8-45c0-a749-a9f1ba05eb75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384729, "uuid": "6cd97fe6-07c5-4ab2-90de-4ff4a608fc58", "value": "49152:TQ1E4+3/7LElukfBU6J95lwhBOPRecd9B6Tq24GjdGS:n4O37kfq6lwhko2vEjdGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774384729, "uuid": "6b614417-54e4-42fc-b911-35b11a857db5", "value": 2239488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774384729, "uuid": "620e0ad7-523c-4e36-8e5f-99d97bfbd35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774384729, "uuid": "d5f31fe1-e717-4ad3-928c-4e8bc5354abf", "value": "CS2_Hack_240326UNDETECTED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d83553-2762-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774344112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774344112, "uuid": "caa8aa58-6328-453f-b313-b517ae5cb2f3", "comment": "Malware payload (LummaStealer)", "value": "055d1f5fad0d0fc423239a7239a694bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774344112, "uuid": "12f365e5-ebb7-454f-b688-7c38cabeeae4", "comment": "Malware payload (LummaStealer)", "value": "eea39c339f93ecf3073d09d1fb9407741089e3186288eb8533978dcc503d01b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774344112, "uuid": "50780812-3e0d-4e4b-a6aa-eae2c9aa185d", "comment": "Malware payload (LummaStealer)", "value": "64b3cbde89be4e220d688ac87d50aff42737a6bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774344112, "uuid": "7f8156ff-fd23-4df6-ae98-f66f59ca9555", "comment": "Malware payload (LummaStealer)", "value": "6222696a2b87468bc7edddd22724dd719e7c3e87303f7f87a451a558d63ebbb687441ae7c5982dc88efff9e4e55317eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774344112, "uuid": "3a6a0ad0-69a6-41a7-86bf-3fcce3a12887", "value": "T1C4948C55D7A204E6D58B07B831E2773B8E24B730433A9DA399C4DA8F6D2F9D2053D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774344112, "uuid": "42a36864-2e64-4c51-acc6-7c3667636b2a", "value": "6e5b25021cf3f4baa967e11ddba7fae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774344112, "uuid": "e97d6108-88a0-4063-9a44-019e6bc81466", "value": "12288:xgbDC59VrGMNbm2SEkDA+/v/P/v/P/v/P/v/0UF028f:xgbDC59VrB7OA5U228f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774344112, "uuid": "2a067cac-76b2-4c29-b908-771146bbfd34", "value": 436064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774344112, "uuid": "e9bf54a6-cb1a-4bda-a923-460fbddfb0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774344112, "uuid": "66df73e9-3d9f-4c0e-9e3b-73a362949e79", "value": "eea39c339f93ecf3073d09d1fb9407741089e3186288eb8533978dcc503d01b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a8935f-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386283, "uuid": "7c52d7a4-9659-4427-82d0-92bf9fee1ea8", "comment": "Malware payload", "value": "330879468a2f974dc491705f545f1e4b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386283, "uuid": "6090565c-8bd8-44c5-9a29-58dee2582355", "comment": "Malware payload", "value": "ef44e8b47f29cac9e427ddec01aa66cfab0c84d2278f91639840e9f09420d38e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386283, "uuid": "3720d1b4-5162-4eca-858f-3774455bb754", "comment": "Malware payload", "value": "be41663349095bded581fc6df9fe3383d1c66318", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386283, "uuid": "9dea9d69-78e6-4cd8-a5ff-40cae4d4830d", "comment": "Malware payload", "value": "5ff23f510e5b0f67ddf3ff07e2bccccd8211865b2d5353dbb1d1693da308fdb591d46f453553bf039da172606a06dcf7", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "kl-wholeunfrosted-cfd", "colour": "#04AEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386283, "uuid": "31ed42c4-0f40-4db8-9255-78282535df48", "value": "T1AA573350C7A506EBF3F67039FA71904A949063FDC963FE4F598CD1D192C3BA1AB22A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386283, "uuid": "03493675-3d6d-4918-bb54-ab2c1197dd3b", "value": "786432:Z8nJGpNbpWd1TpDep3HFzpvhrXcOG1YY70QzqqrOF:Z8kNtW7pKtfhrsOG1jre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386283, "uuid": "e2c076c0-4b28-437d-bb4b-4d2b8e55588f", "value": 28960144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386283, "uuid": "ba2260b8-0ae0-41e5-b278-43242fc36547", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386283, "uuid": "47566360-6c19-451c-afec-9a7710312abc", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8420c026-278b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361559, "uuid": "39a504a7-07f1-46fe-b44c-9758921f05ba", "comment": "Malware payload", "value": "fd1c401fb0985799bb0792ecf2a6a7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361559, "uuid": "c8fada1a-bf40-4f44-80be-cd0707884f88", "comment": "Malware payload", "value": "f11234994e932cfb3e661c20191c0a7eec7cb474467701c54b65c32a0c80af2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361559, "uuid": "930c96f2-cf2b-43b6-bf84-18914c815fbe", "comment": "Malware payload", "value": "f5723bc583cf87a69e764fdde8727b554398eb8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361559, "uuid": "80be342d-abe8-4b8d-9ad7-de51ef2fafe7", "comment": "Malware payload", "value": "8ae99ee4d0929c33bb4d61626184e1ee25c3284defdad07e4be70948ec2d56bc24621e09e52ac5a08921a4cba81be0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361559, "uuid": "ec34cadf-1bdf-4f6a-bbef-84c8bbe89784", "value": "T19A15E0224E12AB68C57F0B78C022155473F1E8539363DBAEAFFD41B45963BC1CE2B952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361559, "uuid": "75f873e2-930c-4f5b-a823-3d36173f55c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361559, "uuid": "578a4e0e-4a9a-409d-a674-6f53c1fe8c1e", "value": "24576:EO5gEGM4n2E0KR7KLLDPQ2addwAKoGXay3:EO5gEGM4UKR7KfDPEddKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361559, "uuid": "486ac311-adf0-4ff0-9665-4bb649f127c4", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361559, "uuid": "f784eb40-24a0-4a9e-9662-79d1d855422e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361559, "uuid": "8ddca33b-e72d-43ca-aed4-76c97f9404e5", "value": "Solicitud de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211e907b-27c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774386733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386733, "uuid": "1312e7dd-f368-41b7-aeaf-3d8a2f1ee728", "comment": "Malware payload", "value": "3140bf9c2d52f6fb287ae88952d3c4c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386733, "uuid": "f2bab94d-49d5-4378-9991-f85d975ccdcb", "comment": "Malware payload", "value": "f15e680740563b0330a9b0b08bd091602c2c3c601f52bbc82b0fcc4cb693b50c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386733, "uuid": "a3cf2c63-6758-410d-81bc-3d1d620662d6", "comment": "Malware payload", "value": "0d5ffdc13781563cb9fbe8c548c269a25c1d87de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386733, "uuid": "7abe366f-1bd0-43fa-a474-87e1d27f2a48", "comment": "Malware payload", "value": "1c017c7d1893f285ca753b799e334f61221632c29c06376e8822efaceb4058157486c1c1d9bced42929f9a34d9ea4312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386733, "uuid": "482f9e72-2a37-4b93-8e3c-f66995b76a66", "value": "T18AF73322E1008D9BE1F17BF58845E5B546472E6CA8B4430F94FBBC37F2F26431D1AA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386733, "uuid": "d07cddf3-3aa7-4ecd-bdb4-0e3b1874e9ed", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386733, "uuid": "847841a1-09ef-441b-9cef-7edee050e48d", "value": "1572864:rXY0aSoiwKTE/QtqbPd6RgzzAZzkBMwpbMTWDAYzNlz:7YC/c4tqUCzzANGMg7NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386733, "uuid": "ee3365a9-ac5e-44d4-807e-7af3acb1a960", "value": 75307320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386733, "uuid": "7d507e19-0cfe-4f6b-91c1-3fedeb0b8386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386733, "uuid": "a3af88cc-9e2e-4ff7-9923-328d78afe324", "value": "release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71fbe2c-277a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774354424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354424, "uuid": "a3dc607d-1384-40d9-a7ae-2a88c5b91e8b", "comment": "Malware payload", "value": "e4f3e4347a978728a9f605e31aa2c289", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354424, "uuid": "d425cac2-4a21-428e-9b6f-07cdf9148fe1", "comment": "Malware payload", "value": "f1e02c24bc937bffb64da541f31e67264e4e12506f0abd99c38a7292b19bc0be", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354424, "uuid": "d7fe176b-44ad-4aa7-b04e-6f366c3a91e4", "comment": "Malware payload", "value": "582567b3b49ddfb8af1ee449b997de7a83ec589b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774354424, "uuid": "d23417a4-5358-4c1d-94f5-209849a0f37f", "comment": "Malware payload", "value": "7351058d1e806e28627aed18ccd5dc690e37c801ffa9c64fef9f5b3eefcd3cb113b623cb34e97b1bd7cc9477d67cdfa3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354424, "uuid": "14fb6387-915c-4376-b412-254b219b4e70", "value": "T1A6673327A80A8793F917D23E977E4F590A707D538F6AC083A929B7A750B77E0B375100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354424, "uuid": "ce09bb91-f1d7-4ab6-9dbb-b47884fd879f", "value": "786432:XvO6K6b6y8hQB7R6HidGGAcxndJ8nzibiJZb5Ii+:Xv26b+M7R0iMfxPZby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774354424, "uuid": "b1e1128b-f579-40fb-a0b8-3cc223b003e4", "value": 29802496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774354424, "uuid": "6bb73cdf-93cd-4f32-81bc-a0c7016d1227", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774354424, "uuid": "e001e372-4876-43e3-8d1b-649d37913b84", "value": "RivalMods.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620bace1-279d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774369233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369233, "uuid": "6e0964f1-b3f5-4888-9ff2-1ef50347afe2", "comment": "Malware payload (AgentTesla)", "value": "6c544ddae9b11d4ca0593b8d21d872e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369233, "uuid": "daee2e51-7c31-41ea-b474-a42f8028220c", "comment": "Malware payload (AgentTesla)", "value": "f33b8ab9fca177f47dd8cf23417361f2ac63a0832ad322e32a141a3bc9a08287", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369233, "uuid": "5f6e2051-fa5f-4c4c-b9e0-ac03ee84c01a", "comment": "Malware payload (AgentTesla)", "value": "11f39d4056db0d8af4cca65ee7e9a9212209381e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369233, "uuid": "3cc37175-9934-40fb-a164-7208a9499638", "comment": "Malware payload (AgentTesla)", "value": "0d28aa4c653ad5c263ce4425b37aa9ee718caff7e955b4fa69c313232e690f825e9e7d02f755904e63373391a697bb22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369233, "uuid": "0520f291-3d0e-41f3-abc7-54a6c8b93f77", "value": "T1BB4522247A59C823E9A767F02960F37813B92E4DD541E3978FECACD73866F641209353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369233, "uuid": "ba6d7194-820d-4f1b-91bb-180e52f8c071", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369233, "uuid": "6ef5e99f-af4c-4191-9db6-fd178a100089", "value": "24576:UnMJOJJYc9ySS+DCiy5DyGjNerc2JEqAN5k+VRlyFOxHPejjc:iMJYUSlDCvpyGRmc2J83NLxvSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774369233, "uuid": "2c6a15e2-7e51-4d19-bfe7-43087d56bf47", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774369233, "uuid": "70919ae3-c528-4f0f-b75b-d3ec4d284224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369233, "uuid": "f1f03467-53be-471a-9585-f7b067893035", "value": "f33b8ab9fca177f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f3c962-275e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342179, "uuid": "4110bb1b-db71-4e62-be55-b206fd0e375d", "comment": "Malware payload", "value": "c5500c833dad364fa8c7522130332007", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342179, "uuid": "573c4570-c0bb-4bd4-93d6-a2384991cdf7", "comment": "Malware payload", "value": "f36cb9d3a5274b244de87e1a3f8f949c03bc2657cb2629819e65d82a124e425e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342179, "uuid": "19393ab5-c760-4f12-bc40-ca5eb1760bbd", "comment": "Malware payload", "value": "8cbf22cf1cf48ef4736dfbdf967c916b3237c7d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342179, "uuid": "6fb3cd47-77a5-4952-b862-bf19cf44e366", "comment": "Malware payload", "value": "a31ab02f30f7b3ff182fc4ea25c1de635f9990deb3856659f6afe472401e151fe1e71b4b873bd025efb1c5183ecafff4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342179, "uuid": "768a4ade-317d-409f-8d86-6d2bfc2bddba", "value": "T1F0924CB512896C79FBD1CE399F3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342179, "uuid": "4a917b0c-0def-445d-b330-0a70df89d1af", "value": "384:w3DFcuQpWx+BL0SWL0g4zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:w3DF8i+BL0SI0vzsP4cbddr7zsP4cbdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342179, "uuid": "6b568d8a-804e-40d2-8201-a33aee6a1c21", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342179, "uuid": "30a4c94d-b552-4609-af77-3feffdec4ab9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342179, "uuid": "ae3bc323-81de-40ad-abb9-a823daaa9cf5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43076729-27c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774385931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385931, "uuid": "9cba2d09-30cb-4358-a7ea-e3eaa4ed8677", "comment": "Malware payload", "value": "40ad09aa2feb282e9ce058b55be1749e", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385931, "uuid": "3901c737-3939-4d15-b7e3-edbbf3d6d948", "comment": "Malware payload", "value": "f3ee455a8ec625fe7de833b66f0ca462f2ea31c31a6eac91d23123241be93b6e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385931, "uuid": "6ec6a7e0-9782-4e6b-889c-12b6e29aa1f7", "comment": "Malware payload", "value": "a3bda45ba85227bd36ad9fab4b9a4b09bc729b36", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774385931, "uuid": "aa16db96-8c60-4c20-860a-e468a8d15d7a", "comment": "Malware payload", "value": "ba1a9749e097163edde5371999618ec1a3963ccb3ca75d7253a0dce4cf4eacbe252c17d8f451f11a956ed2c5cd63d104", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385931, "uuid": "631520f9-351e-48e1-a038-1379a6369fb5", "value": "T19B07339A92B2CCC2E5D0607065C49780BE53EBBE4E5B8D30378E2D4B1F3D367A523A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385931, "uuid": "067fb131-6543-44fa-8dd2-f8bd8e54d67b", "value": "393216:hL5i+TLecohllhAXFN0MXf58d9RQSXOtuWicn5gxkN1zl:hl5TKce4XFuGf8uqDcOiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774385931, "uuid": "38dcb2a0-f775-4170-9b88-b5c51a80ae55", "value": 16928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774385931, "uuid": "b5d0a771-bae4-4004-9de2-0b310da1eafa", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774385931, "uuid": "c689b38b-51e1-4e9c-852b-733f31ce84d9", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8d5a0c-279a-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774367878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367878, "uuid": "bb6341dd-cb8a-4af9-8ce6-154b57e67340", "comment": "Malware payload (SnakeKeylogger)", "value": "85b3636f7e6af1c505dd2e11a929a418", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367878, "uuid": "c48575e0-855c-4fd3-aa9b-06dd7e3c276d", "comment": "Malware payload (SnakeKeylogger)", "value": "f4da176988f23e15f2b5c5a331e2441c57b3257da196df4e0c980940af64a067", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367878, "uuid": "ccda99d1-7888-47b4-9c03-c36db9d902e0", "comment": "Malware payload (SnakeKeylogger)", "value": "5234f43700628ac8aa57123ff816a417d3897777", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367878, "uuid": "f2c605a5-2430-4da3-bd44-1c5ed539ca6f", "comment": "Malware payload (SnakeKeylogger)", "value": "d53d078b7ed76f309578c2e461be263b55086fe086ac66df0df2aa70c343050c1ce0215d955a69aea829d290b3ca45bd", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367878, "uuid": "dadd581c-c45c-4015-979d-b19532214685", "value": "T1142502513658DE13C8EA27FC6A62E27513B56E9D9431C3D68FC92EDF35E6B011A08383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367878, "uuid": "98b5af66-4f88-47bb-9726-07312513eeb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367878, "uuid": "ce20f26d-b9de-46c2-9d97-193e5524b577", "value": "24576:d8rPjL7cQ6tgLuzR44aXYyemghXpuda78+MJDdgO:8/4dth0IhXAduMJDdgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367878, "uuid": "e6015b5e-63fc-4be1-9987-fcb9432fc5d2", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367878, "uuid": "c2612081-9bd2-4493-83a0-8190612d4f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367878, "uuid": "22ddea12-d4d1-44b0-ab93-6c1bd183bdc6", "value": "f4da176988f23e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac62b51-278c-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1774362161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362161, "uuid": "60ae3e9b-2e83-440f-8cc7-de6a41f96bdb", "comment": "Malware payload (Heodo)", "value": "9529fb4c32999f0d904965d9d4ef8d37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362161, "uuid": "bca53549-f1c3-4125-a5da-50c073f87795", "comment": "Malware payload (Heodo)", "value": "f5d4dc3947d2a2db3572d9ff54b03d8db9097ccc18d27c53c5deacdafce69a4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362161, "uuid": "cabdd5ef-502b-4656-9e0a-9a1d01e7d94e", "comment": "Malware payload (Heodo)", "value": "3a2d16f3320461550f61005d8d346b122b16ce68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774362161, "uuid": "b089d060-f2cb-45f7-929d-fdb06e763a86", "comment": "Malware payload (Heodo)", "value": "7ede803ac9a7e341aee8e149198d83cc539f28d67028b2577c135950442ceb268d539fdb00d99b332a8d561caed837dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Emotet Payload: 32-bit DLL", "colour": "#C2B28A", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362161, "uuid": "ebec3668-9b8f-4bcf-8b98-2d5b18455290", "value": "T1C443190FB582E8B6EDA854B473DA123C0867C5314B037ED38BB034F94D729DAA57285B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362161, "uuid": "28685ec3-92ec-4b96-857b-04b7bac48121", "value": "8f9a124a88878ac62589c50d13924ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362161, "uuid": "85e09fb2-c06f-46d2-ae92-159f1d6f4735", "value": "1536:AnW0X1fFFbQcYNWvSA8fnGxWw0c6upOR:wX1fFFbQcYMvAGxWw0c6ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774362161, "uuid": "70bf70c5-9eeb-42c7-8091-698f6bdc6a2e", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774362161, "uuid": "864b16f0-062f-4536-b143-f4076516b2da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774362161, "uuid": "1542283a-c642-4592-b10d-0c028c28caad", "value": "Emotet Payload: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2893b5e2-2754-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774337783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337783, "uuid": "6e0f92cc-3597-46ae-809e-b0c83ab22380", "comment": "Malware payload (Vidar)", "value": "92682398d5891dd8069b5d1c3bf68993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337783, "uuid": "52fb0284-1701-4770-9ec0-d6250a9e656d", "comment": "Malware payload (Vidar)", "value": "f6335654e12afde0a72dbeb22560f1c1eb6da5235692dcbc713e0db94eb6ae46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337783, "uuid": "d3920a69-65d9-43df-bd96-bfb25fd061da", "comment": "Malware payload (Vidar)", "value": "670ee0ca291f6fecaf4596c00e6cfd500b59d2dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774337783, "uuid": "a194419b-f360-4faa-be7b-f5380ba4e5fa", "comment": "Malware payload (Vidar)", "value": "0b3117901199744f7080393eb42e10d2c3c5bfc850eef19fdd31b1309ba0a2809689f030dcd45c3467ade466ba8cb4fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337783, "uuid": "07f408c9-0190-4630-84a0-5c19f76aff0a", "value": "T13AA59D1B6CD509FAC46AA33688B721957B74F8090B3233D32FA0A6782F767E45D35748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337783, "uuid": "40bcfbfd-647a-4cef-8143-ae41a2e68145", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337783, "uuid": "9c3cd03f-54c9-41f1-b0a2-7f747874dded", "value": "49152:5WhSo5upiTMJ5U6h+MIpKWhDMTIy8gyuVTIxbmC6:5GSUTy8MIgWWTIy8EV8bm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774337783, "uuid": "aec2a3e0-9efb-4fd4-8457-7f3eaeeb42bb", "value": 2229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774337783, "uuid": "92d4af66-e3ef-4a20-b424-8c955d27dab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774337783, "uuid": "d58103dc-836a-4b33-9b44-be6ee1edea72", "value": "f6335654e12afde0a72dbeb22560f1c1eb6da5235692dcbc713e0db94eb6ae46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b265a96b-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774343168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343168, "uuid": "f42988dd-8a6e-401e-99e0-12c91ad504d1", "comment": "Malware payload", "value": "5fb2419a133d261eb209dc12b4fa483a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343168, "uuid": "d85f88a8-cfee-4827-a98a-c1182aa7cf75", "comment": "Malware payload", "value": "f7463493a6ee0db3259c5f4ea0f45c9dd0f9165b2c2daa783bfe7c21365e7ffa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343168, "uuid": "bcd6c2cb-1190-4cde-887d-ca5baf0fb1c3", "comment": "Malware payload", "value": "9a0ef02a73280f67bb57f2a006e8b9c070d92768", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343168, "uuid": "642bc87b-46e7-4d4a-bde4-fab1606d86e2", "comment": "Malware payload", "value": "6b5f35d3a9cfe4893d87217338237c2fdc461abdfb853698775fbbcd8a370147c3b07285ab5206c4adbe5a90cd12b469", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343168, "uuid": "b9440ced-6b53-47bb-af34-e8c5bd342593", "value": "T14CB4DCD92EC1F5AD0F82A933F21AF06DE4F498F0536A8C29A0DD1C48F8956D4FD69235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343168, "uuid": "f9902417-872c-4917-b99a-103e06e58588", "value": "3072:W7PbPaQnnqPfavoFPkvZvePfkPdP3vOPUPtvNvXDP+AvCePTDP3vf3JdyaaJo3zs:QBZKo3zQ/YkXSmF7FPGDaaqgTKDIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343168, "uuid": "62c6d4a6-a543-48e4-9425-6be6da2ceac7", "value": 528707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343168, "uuid": "a9e7ff29-6928-4aa6-8575-462e3d1c79f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343168, "uuid": "59711f07-b064-41cd-b4cb-53aa54f39ca0", "value": "5fb2419a133d261eb209dc12b4fa483a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4c0a4-2771-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774350476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774350476, "uuid": "15bb32df-f364-44a9-8f00-adc1137f9829", "comment": "Malware payload (ACRStealer)", "value": "7a88cb0b13b1f8894fe7d0b01745fbe3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774350476, "uuid": "8a273e1a-9ab2-49c6-8374-106389d8aba0", "comment": "Malware payload (ACRStealer)", "value": "f7966c111c9efd3c51dc32a4c173b244de78ea4bdf7bc9ff6babc9ec6363c512", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774350476, "uuid": "ff8e41fe-2503-4c7a-8cb7-bbaf3e6c8abd", "comment": "Malware payload (ACRStealer)", "value": "f836b7474e0ce83f3ca714de927bd93db0223dd9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774350476, "uuid": "ebbc48e0-2f1c-4e44-9a42-34b1e3fee475", "comment": "Malware payload (ACRStealer)", "value": "6200461764250688499d3bfe5f086a91a3d55a5ac7623a17d4f3fa3a7f466957063579bb8960669c075456755ee0f65a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774350476, "uuid": "1697eb6e-2511-4146-b809-e1fd9c377ef9", "value": "T1F40623B1E7C2F8D4DC2FCA61D659F999BC21CE41E4DB19043088B2945AF5720EF8CE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774350476, "uuid": "541c658e-996f-4410-a9d0-94d735df79ab", "value": "49152:ZUZ3/HQ3jr1tYTtW3UC87B6KlteVbxjr5tHD2yrkb:ZS3/iP1tYJl77BTtMxjrbLrkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774350476, "uuid": "3b8e2e4a-3ba2-47f4-9ab1-88e4f5e7f774", "value": 3697079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774350476, "uuid": "a126a7e8-96f3-46e7-a728-f2e251614e5a", "value": "audio/mpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774350476, "uuid": "25704bf2-ecc9-4925-ac7c-56f2d345370c", "value": "manus.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128aa5b5-2760-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774342900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342900, "uuid": "50fe5a11-bc04-4c15-b351-9f8c83bf7986", "comment": "Malware payload", "value": "aa9f786e812f03ca893e6056e83eaff8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342900, "uuid": "5ab3be13-3666-4527-8bf9-b851694cfaa4", "comment": "Malware payload", "value": "f79d4fb4b719a0631aa13efdebaffa2955760d481f69ed4c2fe5cda02ac4ee77", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342900, "uuid": "643f9a63-1cfb-4804-9f61-0f90d32ba256", "comment": "Malware payload", "value": "395cbade47575b15f56c903e34ed3ae0c6ca7c1a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774342900, "uuid": "fc3a25f9-2a1d-47ba-9fc7-75cf9d11aa99", "comment": "Malware payload", "value": "6314bba217e9fabbaaa1ac25e5faa88b1ab460d74d15fbdc611f8c25b7b8fa7112894229331c77d8e6669ff8d50555ba", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342900, "uuid": "d2d23c84-8340-4928-b24a-0e202d71b519", "value": "T16DA2F66AADC0F4CDD077099C97E6DE3DE9785E80F042850A42E0D4F16CB75E66F680B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342900, "uuid": "6be3042e-52af-427c-bb73-5bf6ce698592", "value": "192:Vu8V9Aua388AlkiQ794a4kbhgIEW+V8ANf/jtiDdcudss4FUdTyNvCmS+ypSPC8/:/9AarQ7qa4UKIns7ND1Ad2YmjyEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774342900, "uuid": "b4df8462-dc43-40b5-a689-e8a48d2c2e78", "value": 21632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774342900, "uuid": "efba8332-20f9-48b2-bc69-a843c96b926c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774342900, "uuid": "4516fe1b-9430-4ea3-aad5-ac6d572e2679", "value": "aa9f786e812f03ca893e6056e83eaff8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae25865-278b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774361758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361758, "uuid": "2d7beb7f-c7f1-4429-b8a4-2f2b4d57f81e", "comment": "Malware payload", "value": "6d1fb5ac436df82008226a6f0f00e863", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361758, "uuid": "a83df028-e0b6-48a9-a296-d03c19147b8a", "comment": "Malware payload", "value": "f84ff28480336d9e28b87f218aae62b166d51c79d89cea5d89169e0b423d20b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361758, "uuid": "789af60d-0643-4a8d-a1c2-1cab4ad03e06", "comment": "Malware payload", "value": "cd8c5b3b7639b09bf7dc589b03d297ac446684e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774361758, "uuid": "07dc60cc-5a32-4ea2-beb1-482b02a6bda5", "comment": "Malware payload", "value": "908cabf7462caf2ce48dcf9987f4bdbf953db391f24df3b7725651c0ba7d1aa2306c9bfabacbd278e7f78f8694ba5927", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Unpacked PE Image: 32-bit DLL", "colour": "#D2C139", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361758, "uuid": "5d45921f-6f30-48a9-af72-d3c9ecb94fcb", "value": "T126A47DE5588846B2FAE321F0405C3D3195EEC5CA57A0ADD381D0C9E2F5E69F21EB60DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361758, "uuid": "ae236f4d-fcff-4119-9ec4-f71d74fb0c7a", "value": "77eebdaed0179e8b897990c836a66a89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361758, "uuid": "d91f1068-d4fb-4c57-bb74-eabb7090344f", "value": "12288:+DFEo7Dz4cn7SbTnHdCRbE2CbbnognL/B0e:wRDz/u92bSPokbB0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774361758, "uuid": "1c7eab83-8ced-4a60-bff5-294d425c0d09", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774361758, "uuid": "32b68dbb-47e9-419c-86ec-231fb6f447d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774361758, "uuid": "6d31d416-0b6f-45c6-8af2-6208b1f16a73", "value": "Unpacked PE Image: 32-bit DLL.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f071bb6-279d-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1774369120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369120, "uuid": "9ba4137e-24a9-41a1-90d2-e1252eccf650", "comment": "Malware payload (ArkeiStealer)", "value": "75c72acdd46eb4210c327b3592d7a9ce", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369120, "uuid": "1bd85628-9715-4c02-81a0-934aa535549a", "comment": "Malware payload (ArkeiStealer)", "value": "fa46490c070fa57d7d808641777f3d8dbb324c1e778909092b1d5fb38731d275", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369120, "uuid": "60ae567a-c2aa-4e7b-8be2-ebd62b77879d", "comment": "Malware payload (ArkeiStealer)", "value": "4e921e5c688cbdb0b8d6d82512c6a6e92e7cd262", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774369120, "uuid": "71dbbab0-eb46-4dee-b7e8-a454ea5a434c", "comment": "Malware payload (ArkeiStealer)", "value": "33c98125572369c347224271f25b25067fd00a18ef292a47eb99650697617f48cb281ece0213411ce9e9bf2842e15f7a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369120, "uuid": "6f22d2b8-c426-4f6e-9264-5493e1abd62d", "value": "T142F5AE027BD4EA5AE55FA2F5F270116C92B0EE069FB7D71F0614A6BC1C227508E82377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369120, "uuid": "3d748736-ae6a-44ce-b30b-e0389a1e0066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369120, "uuid": "20947779-3cc2-461b-88c4-c83d45d76cb7", "value": "49152:rBzIGsoy/LeN4BZwq78vOqmEc7Ba3lg7e/LlF1YM0iC:ruEy/LeNQP78vJm0RlF1YM0iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774369120, "uuid": "1ce97ee4-af3f-4cd6-8872-5dfd19ba593b", "value": 3551232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774369120, "uuid": "4130bb99-da14-4d15-953f-14f42183ac55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774369120, "uuid": "dbbc5d2d-fcbe-4715-be2c-d401ab08418a", "value": "fa46490c070fa57d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586e06f3-2778-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774353325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353325, "uuid": "305eebf2-3e4f-4404-a772-ad1269398561", "comment": "Malware payload (AgentTesla)", "value": "78934cfffeb5ad06e3f0d3f637715929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353325, "uuid": "2de87b82-a865-4ebe-b014-080cf2841c1e", "comment": "Malware payload (AgentTesla)", "value": "fa84bee64b9ace41a6ff03a2b7ff788276f25a851a955c323b35f6467ce4b3ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353325, "uuid": "0bd82fcb-8f93-469e-9941-d2dc18e0be75", "comment": "Malware payload (AgentTesla)", "value": "c6011f92ecdffdd349984bd1eb43b02cb25eb577", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774353325, "uuid": "67a2df5d-8784-4f81-b9da-ff7431d6b28d", "comment": "Malware payload (AgentTesla)", "value": "5d84b93caac92224d808c34dab13438a32e0d041eff9301cd86cfce5aa615ff05d40fc39a043b272d4f412d5cf07a4ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sendboxorigin--onionmailorg", "colour": "#E22CB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353325, "uuid": "7bcded98-1021-4e96-9eab-98e4ee9cc01d", "value": "T11BD423D1838D145DA3DAF4C2AB2AA040CDF8C923D81FB991874E9CA1097B1764D9FF5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353325, "uuid": "303e6bae-830e-41b5-a017-02eaa729d66a", "value": "12288:Mtljv6KQeDJSCe182kiZ+Gs8YL5Qm51WQ95OFWqAPX:Mtl+KQ8SCe18NGs865Qc177MWqYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774353325, "uuid": "70d639c4-1258-4ae6-ae8e-fd1d10dc96b0", "value": 610062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774353325, "uuid": "0e116305-76d5-4002-978f-76cd3f10ab18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774353325, "uuid": "1dec7898-fa11-41f2-8712-346ffbddccc5", "value": "Veseel_Particulars.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccefb683-2773-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774351373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351373, "uuid": "1150bbe7-af9c-4af7-b59a-4947edaa49a8", "comment": "Malware payload", "value": "c20d890a2b4e0ee91c0a8fb0bf543e78", "object_relation": "md5", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351373, "uuid": "be90edb2-82d2-40ff-b301-6ef599022195", "comment": "Malware payload", "value": "fb68797872dedd29a86db18ca41350155249718b3b0372e1985c980d4e09edf9", "object_relation": "sha256", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351373, "uuid": "6f9cf700-f2c5-42fb-b8a1-99cbb88bfece", "comment": "Malware payload", "value": "cd13a2925a040a93a0b2287b7d7f976c40711e27", "object_relation": "sha1", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774351373, "uuid": "abc8a69b-787d-49cd-8b38-235d541311f2", "comment": "Malware payload", "value": "61a73bd9fed45f223271a0487b9e396478d9bc264601a82e708dd6905380abb4d74af558c0383042007fc8b505994624", "object_relation": "sha3-384", "Tag": [ { "name": "172-86-68-64", "colour": "#84FA0A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351373, "uuid": "126005b3-9154-4806-b87d-ae565007420c", "value": "T1DA33C516D95A913FE2998D74CA828D50EE727C9A8BD1A4CF57800DE60E75BE09F3D303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351373, "uuid": "6b6d5dfd-428d-48d3-8e75-9e71c7120a29", "value": "60447f89c0eb870e071cb55cd57678cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351373, "uuid": "2e9147d3-c53f-4942-b32b-2aa40add9a4d", "value": "384:a3rrbmn0qpy9DCZj8CXqD2fqkcjWiqQvRq+ukqiqhH7q2hVTIN+l0+fE+rn4ipex:klxYrnegxtDZnooEt7qA40GeNUSPjJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774351373, "uuid": "a62b3878-ea71-42c6-8932-4200dbd624d7", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774351373, "uuid": "5a3fbc9a-4fc9-461b-adac-665733f60545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774351373, "uuid": "648a24ed-e460-4c60-92c4-54f445ce4d99", "value": "fb68797872dedd29a86db18ca41350155249718b3b0372e1985c980d4e09edf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3837e075-2798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774367015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "fe6233c6-1ec3-4369-9f94-5dad9c6f6f28", "comment": "Malware payload (Mirai)", "value": "1339b9f36be6d1fcedae728f4ed4b55e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "d4ab8fd1-e0f4-4a22-8a6b-c1fb55ab3fd5", "comment": "Malware payload (Mirai)", "value": "fb68cb304fe448e02edeeb42dea3dfad58d32da51848b0f66ab9dbcda0feb425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "bf3201c6-f1aa-4364-8c53-fb3b004e66f5", "comment": "Malware payload (Mirai)", "value": "5e887729e28265cb318a4c4e0e37f23d134bf982", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774367015, "uuid": "c90a1c76-d7d7-4787-85dd-15623dfa4f9a", "comment": "Malware payload (Mirai)", "value": "a45073d236a33519aba64d949d4495c3ebea7c17cae3f9c094d1f0973b644e7c3ac5114502681814f519f1cca2481477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "dd92da62-67c5-4c6f-8ce5-6ad404dc007e", "value": "T16D334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "8b388513-6c9a-4ea1-bb12-9fe55f0c5b4d", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+G6PS4yns96BktDgIPi8TwU:ivW3jdQGqt7Y+Z+dN9cGgI6bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774367015, "uuid": "d1879c87-f26b-46f0-a4be-4b8a2c5608f0", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774367015, "uuid": "1cc1865d-9345-43f7-a460-0aa4e1543619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774367015, "uuid": "efd34869-b6c2-4e79-9d55-ff368aaacf04", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f862cb-2752-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774336992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336992, "uuid": "95fd9c83-7020-4e01-8f41-173bcf15296a", "comment": "Malware payload", "value": "d27f45cae14bdc185ee4571083fb4421", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336992, "uuid": "a9368b89-5904-4722-a65e-40704eed98b3", "comment": "Malware payload", "value": "fc046d94184315b711c3c92b50cf56ae0c5a413a6e0287e08c71e33513bb9dec", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336992, "uuid": "13f443ae-028d-4f17-864d-25b605945733", "comment": "Malware payload", "value": "d38b4e3b35a31be279421a92b250736997441f35", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774336992, "uuid": "104c4531-e361-4b07-80f3-4f1e518fe1cc", "comment": "Malware payload", "value": "4d759dcdb2039343962a9e0b8676943f90e1543412d787d2440dd4dd5583d0a7c897032c3f3db207c19f4cefd6dd1649", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336992, "uuid": "886b5cbf-09f5-4dc4-8cc2-8ccf64a7fb56", "value": "T1F5C4127769D1BDBEC9AE02F7812334B0705A0D4689393216C93B07CE9D5A94D1A3A4FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336992, "uuid": "2fcd7e8c-9225-487d-9008-ca40cddae55f", "value": "12288:SHktl/NXlQBkUK1DvgdUo5w0KaZdda1QXXhzqI0fpNB1VHr1xA1xIh2dJTgnSpqr:Tx6k71D4Co5w0Zdda1ehzwBL1VHRx6xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774336992, "uuid": "fd47c650-8ed6-4a2c-bb06-a79d29f3c5bb", "value": 590264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774336992, "uuid": "cedd859f-e9bd-432a-9f09-e11cbe1b76d1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774336992, "uuid": "eca6af8e-a2d1-49e0-b477-454ff45a7df3", "value": "draft contract.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a43653-2760-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774343227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343227, "uuid": "34fcaea0-9448-4288-a426-4bbbcacc443f", "comment": "Malware payload (AgentTesla)", "value": "619cda76b1aeece60e474f6b5a7d3bf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343227, "uuid": "32d77fd3-3afd-4932-982c-10355e8a62a2", "comment": "Malware payload (AgentTesla)", "value": "fdb303b02f5df45bb8dd15d10fe9f15aee73e3179aaac9398413fb3874ab68c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343227, "uuid": "7a60386f-8718-4b35-ae9f-ecabdab3ca2f", "comment": "Malware payload (AgentTesla)", "value": "232c98bdef706b2fe8b323b97aed76c835c7ac94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774343227, "uuid": "6c01e305-c01d-4aa2-b889-499e27eca984", "comment": "Malware payload (AgentTesla)", "value": "f60b19877cc2129cbf60aa8faeb109e160113367f5e7fcd3c5cfe2b19b936250690febd3a775a0575af1ec40b8788903", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343227, "uuid": "6d1524ed-1865-4466-a98b-e9b1095024d1", "value": "T146B264893AC67191029218F3692B710FA1FE6CC07108D216C6ED9DDCBE66B58D5BBCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343227, "uuid": "53d7a290-7ec2-45d0-8ebb-c9b0a4609c39", "value": "768:jSmc+wCmHbbxQQoLqMpQk6vB51Fh7yYY5Q2BAd:2mcHvoqjL51FhrY5Q2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774343227, "uuid": "39ca8835-7256-4e13-8127-548dcb4b5f25", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774343227, "uuid": "f849c14a-3cd9-493e-ade4-1129c68040eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774343227, "uuid": "6f7fc185-538f-4932-886c-860eb3f04cc5", "value": "619cda76b1aeece60e474f6b5a7d3bf9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0d693f-2797-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774366834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366834, "uuid": "5d4a2f71-fdab-4de4-a209-d1478366a6ee", "comment": "Malware payload (Formbook)", "value": "94448e4334e332064c47b0e95a4fae5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366834, "uuid": "d9decab4-a509-4424-97e9-6287587eb33f", "comment": "Malware payload (Formbook)", "value": "fdc1d1198c5b49e8155bfea0ceb3505a2efc88717ef58d8cae7a56a1205d1000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366834, "uuid": "4a948235-df6a-4dbe-84f7-018210918914", "comment": "Malware payload (Formbook)", "value": "de262e1a5f38c08c1e1ef5f27a2f40a9a3646324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774366834, "uuid": "ae593812-71ce-4923-8b15-f1194eafde6a", "comment": "Malware payload (Formbook)", "value": "ad03f132a92034b1054e65688faea4c33543d9cb573037c47b08707187f1ef328fe15a1fa63c5ded90fcf5f2c40afc3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366834, "uuid": "a0c9a1f7-1171-4200-bd04-fd69e1d70ead", "value": "T1ED85AD46B3C01AA9D916D938C7279232E2B2F852477295CF6A95D70E1E33F905F3EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366834, "uuid": "b752682e-1dca-4714-9a7b-ee4a8219d1f5", "value": "afd888d817141807bff5da808e6b6b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366834, "uuid": "4c10a381-4f59-4379-b0ee-5d9cf41f4773", "value": "49152:gOHEU7bC0adlGMOYTlf/v5Q7ht7OBga9LS3e30XsHG1Uy:h7iOYfn5Q7ht7OBga9LS3e30XsHG1Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774366834, "uuid": "31343143-94c5-4fbd-bdb9-539a1b20f5c4", "value": 1861120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774366834, "uuid": "b4b7cb3e-8c86-48ff-8fea-655cf2940ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774366834, "uuid": "7cf348ac-2724-4f49-9de7-0c6f978ca45f", "value": "WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d5b3a3-27c5-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774386548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386548, "uuid": "8bd45e24-470f-409a-8b5e-2b63f80dbfcf", "comment": "Malware payload (RustyStealer)", "value": "83e0600de5b54ccce368ff153c655024", "object_relation": "md5", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386548, "uuid": "131003e1-3649-4c12-8246-26630d03d31d", "comment": "Malware payload (RustyStealer)", "value": "fe02d2a6944cdaf8b798d3cc53c97c4d937883f2333728f2812dacf3677aca6c", "object_relation": "sha256", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386548, "uuid": "eb80083b-aec5-44cc-8bd7-f887fe92a8aa", "comment": "Malware payload (RustyStealer)", "value": "d32b2573c85e130e9ab53ee6c0a94e5342bb5169", "object_relation": "sha1", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774386548, "uuid": "6dd68979-e40c-46a2-82ac-f04086973f48", "comment": "Malware payload (RustyStealer)", "value": "1c399720de8a2b6d108830b91257ca8890b568130068effeae09d1e2bd90eb068ab61a4d1f1355b0c86021d37bb28005", "object_relation": "sha3-384", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "EasyLauncher", "colour": "#561209", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386548, "uuid": "cf03a001-a9c1-4672-b7ef-2153e2b658bf", "value": "T1C9769E75363C28F7E65B02FBC5A66A9913706733434695CA30B472C116B363AFF2B918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386548, "uuid": "08f867fe-529c-4a60-bfd0-f280b65b7996", "value": "24576:89PaxTYOd7uoP+dySuU2w6SELvNMKKJYQxhjGJo3TI8gvS8XLE453EcE6t3jNsBT:89PaxTxdLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774386548, "uuid": "ec214480-b048-49a1-81d1-da641b0cda65", "value": 7626752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774386548, "uuid": "cee927fe-67cb-487d-981f-443de35bc83e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774386548, "uuid": "2a6c5f3c-e6fb-4b32-8780-151b18864b67", "value": "Launch.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }