{ "Event": { "published": true, "date": "2023-07-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-06", "timestamp": 1688688181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e38d9486-69cd-441d-9271-950093c802f2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed3b78-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688636795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636795, "uuid": "d8770e19-94a4-4952-aa1d-cca2a5b4b8ea", "comment": "Malware payload (AgentTesla)", "value": "9a8f6816ea247731938cc571a0b907b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636795, "uuid": "b47c74ca-99b0-4b73-a614-25a8bcc2a8dc", "comment": "Malware payload (AgentTesla)", "value": "00486d09538f1c6194531583911de97828f3a82d4cab8bc5aba373c07e758ef7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636795, "uuid": "58173800-2014-4514-865d-70958a9349ea", "comment": "Malware payload (AgentTesla)", "value": "65cb4c1aec887df05a71fa6404e21548b804d221", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636795, "uuid": "8317d623-121b-4045-9988-9713b707f919", "comment": "Malware payload (AgentTesla)", "value": "8f9a7b28cc5b97f27954c46dbb00c6a0ef804bfc75282f0f51765e0fc9d4a21a4226fcb07ed8950d9afc99b942acd964", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636795, "uuid": "660f5c4e-5679-4791-90b2-c0e8c4191c82", "value": "T1747423EA8CF306B8493709A05E671EB0EC3CD76ACBB6B0465A9D271374E607706D58B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636795, "uuid": "1041701c-f49e-4814-9170-f0eb45a91dce", "value": "6144:lpU8PLk88TmZMVdAlLzEnntq1g7QxQtXia6MYlpuvWz4kew0fSbfQl6n6Wu56B:7PLk8m7VaZz5WXOflpFXUabfQ8n6J5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636795, "uuid": "32e898a5-e5d3-46f4-b6af-6f6201712ff5", "value": 368479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636795, "uuid": "8804b418-ea53-408c-b551-f7d400f1aa62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636795, "uuid": "533321bc-c4e2-4947-b2f8-90bc7f10c961", "value": "SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf903b1f-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623374, "uuid": "6a715f1f-1492-4fa6-8de5-515da916b052", "comment": "Malware payload (RedLineStealer)", "value": "7a26df7c642cd20d34586f2255776804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623374, "uuid": "07cd8774-64f7-4e5f-af64-20e290f901fb", "comment": "Malware payload (RedLineStealer)", "value": "011653f0e9d45cb212c720f206aee13b3f41e5bb5c6955926d2bbd121dbbe164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623374, "uuid": "41f621f2-38fe-4c6f-87bd-792b76ad96b6", "comment": "Malware payload (RedLineStealer)", "value": "6ecd50737476beaaf5cfab9326b40656e2bd107f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623374, "uuid": "f0cf43b1-5776-4bbd-82ee-2ec01e7af08e", "comment": "Malware payload (RedLineStealer)", "value": "654ad85b3b1fd7389e202015816cccd42c7672686c9ffffff64fd2fa65f69343157c0c830bca8a6ca7c15417011602aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623374, "uuid": "d1f4e7cf-96e6-497c-9fae-1c60658a396b", "value": "T11A55AD05A09D1C5CC572E7B2BADC23523EBC8474291DA13992E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623374, "uuid": "37a7f3ff-ad08-4ed1-a54d-9c777a950df2", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623374, "uuid": "4e715e30-fd83-4113-8b52-940094d92040", "value": "24576:On8t1MvGbfl9RD7UronbZXqiFsRa7lORqoda9:O8H+uflYrqNXTV7lORqR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623374, "uuid": "7ef57933-914b-4c4c-9ab5-a15d3a021e14", "value": 1343820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623374, "uuid": "6aa2cd95-980e-46d7-82a2-449616098b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623374, "uuid": "33f19bbd-97f0-40f9-9225-97796308b58e", "value": "7a26df7c642cd20d34586f2255776804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522914bc-1c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665711, "uuid": "e2ec8014-afbb-4ff9-a42d-e8e9bf86bef1", "comment": "Malware payload", "value": "9e997471f605939ae958c2f5ad2947ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGOTT", "colour": "#A1ABD2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665711, "uuid": "e8fca9b1-446f-40a5-a653-093f33b29fdd", "comment": "Malware payload", "value": "012bfb490493cd15e6f1c1e1638929651a2f65886b60288ec937152b374710d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGOTT", "colour": "#A1ABD2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665711, "uuid": "3b387443-ba2c-4c70-a751-88ac39b95378", "comment": "Malware payload", "value": "4ae05648ad2aac2cb0f99dd2c33afd8504ee48b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGOTT", "colour": "#A1ABD2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665711, "uuid": "05e91732-15f1-4d40-b2ad-a21fe0dbcc3a", "comment": "Malware payload", "value": "84ffd23fccd8100497f56ae1a47c28eaef26d5d8113150bcf917468d577e92f4da10e6bbedd89ae017e2f15f302e0de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGOTT", "colour": "#A1ABD2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665711, "uuid": "8f143d37-9362-4eff-a31d-f86b04c7d02d", "value": "T1CEA5F0AD1AE4D6DBC1650FBD58B4B7B8527A8EA13E12EB03500435E73F36BC99E81143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665711, "uuid": "34c3a2cf-8004-4b5c-8b0f-667eb24167e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665711, "uuid": "a18910aa-745f-404f-b958-2fda2d17c03b", "value": "12288:+fUI73IfyqaMRCjge1qYhzNbpoCmJZEpol/KCz:C3jIfPaMR2V1qubp8JZEpo1KCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665711, "uuid": "d22e175a-612b-4c7e-b145-7e3e3f40f0e9", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665711, "uuid": "61eace4c-9fb7-4d37-a771-f14cc8f84e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665711, "uuid": "59b7e46b-e80f-4f20-b7e6-74c6d59bda76", "value": "GuardiansGame8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dacfc4-1c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688656797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656797, "uuid": "01fd9c55-19f2-4286-9f51-4ec3c636d346", "comment": "Malware payload", "value": "9457b6cc2ed714298af1fbfabc20bdea", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656797, "uuid": "a8df08d8-d710-483e-a681-eb236e59fec2", "comment": "Malware payload", "value": "016a1a4fe3e9d57ab0b2a11e37ad94cc922290d2499b8d96957c3ddbdc516d74", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656797, "uuid": "a5659f50-c174-4cc9-b06a-be6574e94a04", "comment": "Malware payload", "value": "112b5637c8cbb7d2e216d89f969515809e1dc66d", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656797, "uuid": "e677db23-2ef8-4d4f-9eb0-83bee93467ee", "comment": "Malware payload", "value": "5aec614cfd750ee5d9c99647bbe7942e28c7570100e405083ebce0c9614ab63f53d5211329b6c9baf5cabe315d0e1c9d", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656797, "uuid": "b3cfcc69-54bb-4050-b221-915b586a546f", "value": "T1C7767C2BB9A05924C29780304AEF57A26B32F9354135FEDF2375E6392F22C12DB5D346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656797, "uuid": "7eee25f8-29b0-4822-916d-4176031e0d10", "value": "98304:5ik2Nukm79RUNFygmD3FHLgi76ZnSPGW78SPc:c03F0Zk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688656797, "uuid": "93c1fe13-f698-44e0-9dfc-82595ffdee36", "value": 7790136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688656797, "uuid": "9556ea3e-a3c3-44ff-a836-4741758e86f6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656797, "uuid": "3a8added-db96-465b-91af-4edfb58dfb75", "value": "GuardiansInstaller", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437ce83b-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623595, "uuid": "c8f41d6f-dd16-4dfb-9c72-f064c26baf95", "comment": "Malware payload (RedLineStealer)", "value": "96aa619e703dd9c9af5df8373598a0d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623595, "uuid": "d5b25bac-a885-40eb-b79d-91a9b981ae08", "comment": "Malware payload (RedLineStealer)", "value": "0175472e856de50c491001b63db73e37d4ade26b01b222b2db2c10844cef3433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623595, "uuid": "e766d65e-ac01-4b46-891c-4b8bf083d052", "comment": "Malware payload (RedLineStealer)", "value": "d48c62a2d37fbe6395f5b75a83df68e2d4aea134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623595, "uuid": "82b1e3c7-9f47-436d-9a9d-2590c9312f90", "comment": "Malware payload (RedLineStealer)", "value": "279a1e8a6bd2735cf30ec0405e5016367dbfaf12e9080bc477190f656643017697ab5f0887d146a8e65493d66c4a43e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623595, "uuid": "1b636124-cd78-4a54-bdb8-1cb75eba3193", "value": "T1EC060102258D6EAFD13A363527CC1553F96CA874DB0A0D5521C2ACEFC98DE83F6A64DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623595, "uuid": "32705abd-7fea-4ebf-9115-cc96c39bd9e4", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623595, "uuid": "1f3a1990-1ee0-4e6f-86ab-bcb110e2528f", "value": "49152:yxypntypmroj7XHFEoxHSL+YTKxQHFgnrkJVb4ksaJi97pHJ2AsdlhfL0P1JfPGo:jr5+YbVb9Ja6VhUPcHzILF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623595, "uuid": "37b73e71-2567-4897-bbf0-c27bcefa14ea", "value": 3788616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623595, "uuid": "19de9e3c-4cb0-435d-a0a9-4c0f16c71228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623595, "uuid": "d1aef965-078c-46c4-9bb3-654ff72b01af", "value": "96aa619e703dd9c9af5df8373598a0d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484f228e-1c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664406, "uuid": "cacf8df4-396b-464d-aac5-31dd76d47a7a", "comment": "Malware payload", "value": "950e1390092ce15738f8fd0a34af1378", "object_relation": "md5", "Tag": [ { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664406, "uuid": "d2afee0c-e420-464b-8bc5-47ef2b7866d4", "comment": "Malware payload", "value": "0182b6df116ea6b7537bd843fed4828efdb5057b601844e1e95bead492436186", "object_relation": "sha256", "Tag": [ { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664406, "uuid": "51f546a1-5201-4f95-9fe5-7968da584210", "comment": "Malware payload", "value": "e061d16ae1b3ecc58ada37025866c5b2ee0adb8a", "object_relation": "sha1", "Tag": [ { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664406, "uuid": "237ac5ff-988c-4db5-af82-657c7c7a4f74", "comment": "Malware payload", "value": "fdb9af232dd424b7188d873f13d6d155909282c44376d0354906796c05533ea2b007a72d4b4ab398b52872fb61f843c6", "object_relation": "sha3-384", "Tag": [ { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664406, "uuid": "8c7a9e6c-9ff6-491b-a250-eab86742a1fb", "value": "T1F885AB35F0593662F84DCAB405F02DB403F66D75123B07C822BA395F96A7E6CAB64E34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664406, "uuid": "7d5191f3-639f-4dd7-b94b-9eddbfb105bb", "value": "12288:T+t7SAbCVxciryyObSoN4V5jlx4HFHngOus:TEpCVeiyN9N65jEHJNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664406, "uuid": "b1468cbe-14ce-49a1-8ce0-ebc2dfc61118", "value": 1781319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664406, "uuid": "58fce0db-f178-4123-9aa2-97b31040b678", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664406, "uuid": "56e754f8-5b08-4b85-b866-3d2fda499c91", "value": "OlympOfReptilesGame.data", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10863cf7-1bf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688643267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643267, "uuid": "3d6e831d-0645-48cb-811b-459f50957857", "comment": "Malware payload (Formbook)", "value": "ffa043bd31ead8b378dd9912a1dfc53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643267, "uuid": "05df9d5b-b91d-482b-ab61-c676834297ee", "comment": "Malware payload (Formbook)", "value": "01ce82aafecd77a6ae68ca7b431b152764db8b4a72277bd8eb2ea1fad6460740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643267, "uuid": "d4a5c815-ed9c-468a-a4e2-93119f50dae6", "comment": "Malware payload (Formbook)", "value": "656fc2205ec6798d3d1a6308a324821bd32a4bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643267, "uuid": "04a71114-3f4d-43d5-9e4a-e599d90b1167", "comment": "Malware payload (Formbook)", "value": "f88183e559aa3c90e4147b11eb5811c68bc1004eb35353966a0add320781277a96da773104fbd249990d1b2de6af91e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643267, "uuid": "dd73021e-eaf0-4313-8cee-2c8d25488e15", "value": "T13605F1FB03A645BEC4936F7C8E599671F0D74648B2B2DD26CE73A8189E3370578921B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643267, "uuid": "d52b84f0-2481-41e5-b978-844def816be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643267, "uuid": "829b2d97-9270-427c-aacf-ee4e47faa940", "value": "12288:Hy1PWR28Le0cY+Yg9fb9+ybT/xWHLGsX1KFcfsDD0IxrFs3pK:Hyh+xL9Rk98UAGAxW0IxJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643267, "uuid": "13739227-e908-44b4-bbc4-44f2e1e6894c", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643267, "uuid": "aab75306-15b7-4f1b-8ea9-e9dea0203aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643267, "uuid": "cee11a0b-3a49-464f-884c-bade5734c650", "value": "01ce82aafecd77a6ae68ca7b431b152764db8b4a72277bd8eb2ea1fad6460740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0af4ff-1bd1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688629807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629807, "uuid": "ba8bc0fb-f642-475b-bab1-08853350e28f", "comment": "Malware payload (Mirai)", "value": "e2c32c791be8c4f4176a14d4adf431d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629807, "uuid": "f9ef6253-a2f8-4551-a955-2f7bc7cb1bfa", "comment": "Malware payload (Mirai)", "value": "01d0f279709755247ae15c3cca05b54faa93caf6a6501d32ebda2371d3b5797f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629807, "uuid": "10826698-b69a-40c6-8fec-12717f90c20c", "comment": "Malware payload (Mirai)", "value": "74d77f009ec46e260145962322aef0dadacbfa1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629807, "uuid": "ddf146b6-b279-4df0-a3ad-dda515f1e407", "comment": "Malware payload (Mirai)", "value": "f2a43ccbab3529c292d496146ead8fd505e527da2f9c9831121595e4878f07d0db465b07666a2d59f796df89ddfeaa48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629807, "uuid": "6c65a881-1466-44cc-9eaf-7d0718095eba", "value": "T1DF631851F8819A13C6D1127BFA6E02CD3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629807, "uuid": "ef679685-ec5d-442e-a148-f5b2c560f6f1", "value": "1536:rNHlxvmiiBmLv/RN/596yA4BxF+2YWfwz2vvWR:rNprxIb4BxF+5sbv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629807, "uuid": "2b4c37d4-587b-4350-b1c8-7252f1e72446", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629807, "uuid": "de76a9a3-4ba6-42ca-8380-511ec0d7a19b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629807, "uuid": "af2e1cd4-3d00-4dfa-b581-6e715e4945a9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e911c1-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638115, "uuid": "ba439ef4-fb19-40e1-a8c8-4c137a2889c0", "comment": "Malware payload (RedLineStealer)", "value": "454bb648eebe697450ca4c8e6bfd2731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638115, "uuid": "1cd56300-4c30-46ca-ae5f-35650915ceb4", "comment": "Malware payload (RedLineStealer)", "value": "02b94bbd2e920a80417f844835f06c8adecc4ab7bbbb8349873a4f6e706cf1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638115, "uuid": "41b2a5f7-dc25-4ae9-a50c-cc1be550e0c2", "comment": "Malware payload (RedLineStealer)", "value": "89637aa0ff0c9805ce00a597b25788a48e2ae705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638115, "uuid": "919299d0-f320-403f-83de-54875bf3edd3", "comment": "Malware payload (RedLineStealer)", "value": "5281c839f7a55738edc3d3f8651fc5f2c4ad8098b6657b75fecbfa0adcd21f4dadcceb1c4a95fa02f4c883c7b4ce0d2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638115, "uuid": "e1c23395-3999-4ba4-b09f-b59786d56b5c", "value": "T163060111654C8E6FD4363A7537CC4457F92CA470DB091E8522E62CEFC8AEE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638115, "uuid": "f7e2ba89-3919-4fec-92b1-e845df4f10d3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638115, "uuid": "c556bb92-7e5d-4a78-9867-ae076b6d3b4d", "value": "49152:eDI0fuc0NgK9VmjotaWh2rEFoCAVtfVajN+FGbYyCLfIvPN+RJPbVkG8aZpizyOm:HMNVZVajUFkUgYPjxZDWfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638115, "uuid": "3405ed78-259b-47e9-ba48-f7c19d0a18a7", "value": 3777352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638115, "uuid": "4c294e7f-c7b8-4a20-8ee3-9aebf4ce624b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638115, "uuid": "49b86f53-861a-47f8-be65-e733a645c5c2", "value": "454bb648eebe697450ca4c8e6bfd2731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf62db59-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648312, "uuid": "3b56a8d0-180c-4735-801b-7fe534d8a31b", "comment": "Malware payload", "value": "7b95572341c45c2c0887d81340a8f0e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648312, "uuid": "5a2c72a4-4054-4d44-81bd-bd8be426b84d", "comment": "Malware payload", "value": "02c14e11454f20466dea04c8d160f6cba94da2e03da64c23439909a1277c3b4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648312, "uuid": "67b76984-c66c-433a-bb31-eae3b616a2ec", "comment": "Malware payload", "value": "5daf003a1515248ae511465fe8794a24eab48107", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648312, "uuid": "863ed43c-ea32-47ce-94c2-5e1629104d0e", "comment": "Malware payload", "value": "22c53a3c91439e83308c20aded2796d291e0ad2d6512637f8c1f301abd8a4f71550add347ffb5ef3dc252f6e2f9afbe0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648312, "uuid": "96096815-881c-4112-bf2c-520ffef8fecc", "value": "T16AA3F8C2AD527E33C2C2EBB6FBEBD2483BF25510D79B3301B9D95EB0461A9CC1919254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648312, "uuid": "7eacf3f9-67d5-42bd-8e0d-2c6941b86e7d", "value": "3072:0CaOGGqzON/tBoO9NlbBs1KjUCfyPG4VUp:/GGqzON1BoO8KjUCfyu4VUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648312, "uuid": "55e9a2db-938e-4fe1-b21e-3c5d65ab932e", "value": 99746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648312, "uuid": "15e6d80d-681b-441d-8baf-65a7a44581dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648312, "uuid": "f1a79625-d537-4d89-94fa-2d1cf3e81528", "value": "armv5l-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc4c797-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688623101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623101, "uuid": "7f389177-af03-4149-8de8-f7660c6e613b", "comment": "Malware payload (Mirai)", "value": "7beda23df6b73831169d054ab3f2ccc3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623101, "uuid": "cdd8dacf-8a6b-4efb-bf89-0589c9fd2fdd", "comment": "Malware payload (Mirai)", "value": "0302fadc0cd5b70117cdf7d0c5d9dfbe0b238ecce70788784cb1eeb0ea70a817", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623101, "uuid": "9d753cd9-c031-4dca-80eb-968c7d74bb8e", "comment": "Malware payload (Mirai)", "value": "e18ee0d05101515fec16b9593dc0c85695f670d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623101, "uuid": "5f94a357-bde6-42f2-8e58-739452ba6771", "comment": "Malware payload (Mirai)", "value": "7e7c0370d26b02c96abe33f4bdca629a0d937ecda817523f812cb014f4a7f01f3090105643eb5cf4270d6a7242d37ea0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623101, "uuid": "7f7a2f9a-bdff-491c-bb80-245a249808a4", "value": "T168634A1B7580C1FCC499C17847BBB63AC473747E1239B2AA67D8FE162D45E706E2E488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623101, "uuid": "fe8601ef-4196-48f8-b293-891c283b6c13", "value": "1536:2gfrLQmY+SfaNNQB7A7RDMEebxdXhcQQ0znYb0rVPJj/VrND:Bfr8mY3fanmM7RvetdGWznYIVRj/VrND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623101, "uuid": "74e656d6-2e8f-4261-8ced-75679e9acd3c", "value": 69376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623101, "uuid": "28970956-67a5-46e0-ac2c-dd6128d12ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623101, "uuid": "2ce59682-5668-4e09-9470-2653b5c7f43c", "value": "x86_64-20230706-0558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec51d087-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688654373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654373, "uuid": "3364962f-32d2-4e44-b7c6-556ebf8f1a28", "comment": "Malware payload", "value": "033f3bc152e6fae59748f0f471ecf95f", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654373, "uuid": "8bbb4756-36c4-46a1-be99-d02f78a35ae6", "comment": "Malware payload", "value": "03044ce1dea80b43b94497cc7bad22eb3e9c4c7bd4b4d13f74432152fed19411", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654373, "uuid": "9577d685-2b40-4720-917e-8bdf6606537a", "comment": "Malware payload", "value": "410e4e24f6f6c4f29c8a75723f84bf60ff96c2d5", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654373, "uuid": "bb1e57ca-b28b-439d-b67e-5c7750afc624", "comment": "Malware payload", "value": "c459bef3f2f87d31681a0161c78a9608846e18af7f1945ba12a08d713285f56bd762dded5f7e1f2890aefad8bd2fcd00", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654373, "uuid": "c82c6f11-a720-40c9-8335-06a4558934a7", "value": "T1A2867C27BDE10924D287C07049EE87A26731F9358235EEDF2775E3352E66C128B8E746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654373, "uuid": "3d7d33e7-cd75-4259-ae29-1885079d8161", "value": "98304:zzlCxn7ELoZh2hBDVVtADQux6VPdu6sSPGFMSPS:tOR4nuQj8FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654373, "uuid": "7520ffda-97b1-4be1-87ab-c2c514f03e7d", "value": 7964480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654373, "uuid": "f9fd908c-647f-41ac-8af2-8b7ecb265cee", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654373, "uuid": "8e33d1b5-6502-47fd-907d-578882f154b0", "value": "Evolion", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdc45d1-1bbf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688622162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622162, "uuid": "cc2a5d38-9c54-43a9-83f0-37a6825e68a8", "comment": "Malware payload (AgentTesla)", "value": "ec4d41a9007380840bbdbcba6e62505a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622162, "uuid": "ccfbec8e-a3a8-4690-9acf-cb7478f105b9", "comment": "Malware payload (AgentTesla)", "value": "03642d9445dddc012ac9deb3bf64407597f8910bccd068cdc10ed86f34cf4b4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622162, "uuid": "e3c3b484-fb52-4d4f-a372-5624c7aee6ef", "comment": "Malware payload (AgentTesla)", "value": "d757b0dd217b738911714c63507bf9956061e579", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622162, "uuid": "87782e12-9f0f-496f-8f54-64bc8bcc16af", "comment": "Malware payload (AgentTesla)", "value": "5ab8c7188ddf7fcccd0ffd2fcd9c817d13812a71e1f6786e50f33e6e815de7b9263b090cf32f6e82e8aff048e27f161e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622162, "uuid": "241ea46f-e5ef-4002-bf62-b7534201dfad", "value": "T189F47C3C18BC7223C134F6F69F9DC421F650956A3E61CE3769C3989A461EA0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622162, "uuid": "aef664be-7f92-477d-95f1-51471769ff30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622162, "uuid": "31f3b6f6-684c-44bc-98c6-54a348736aec", "value": "12288:sz21jhnjhwVrw1zxxmqlPPS4jmSQI0m49h0sXqp7GTqZSaKeh:szKNnNgwP4qlPPSjSx0mi06qpiuZSaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622162, "uuid": "51532533-0e6b-4ab1-b876-441c9a68d0c8", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622162, "uuid": "c262e134-9245-4d25-b79e-4e1c089aa0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622162, "uuid": "f3cace44-4073-4aec-92ca-7871c38cf4a1", "value": "statement(s).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac185e2b-1bd6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688631931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631931, "uuid": "a753225b-ea9e-42dc-a1c8-c064097b25a9", "comment": "Malware payload (AgentTesla)", "value": "48331464a137df82fa493f4609d7e074", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631931, "uuid": "be2837e0-d632-4553-844b-2bca9383a713", "comment": "Malware payload (AgentTesla)", "value": "0367e00431ccebbb5f8f7b2eba1fffcc2a9aa1899eb053933adb92e576b60399", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631931, "uuid": "5eda42ac-7814-4faa-948b-544242c42a99", "comment": "Malware payload (AgentTesla)", "value": "cb5295fefc73ad84a51604b0fcd328ac6b7f07a0", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631931, "uuid": "9e17d408-44dd-4ac7-aa20-f8e6b9c75549", "comment": "Malware payload (AgentTesla)", "value": "9d17d1ba62faca85d0d640ee021880bd4de6ece42ac524305226ea6b04c6c03f4ae222a0613a48943f92ac185d2bad14", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631931, "uuid": "9ebf114a-d0a6-434e-9e83-36c324cec1c8", "value": "T171D45B3C1CBC7222C170E6B68FADC421F564996B3E658E3B61C3999D071E90269C7E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631931, "uuid": "ea381a0a-663a-4648-887b-19d8a23e5de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631931, "uuid": "f3013619-2c67-49cb-8936-02670970aeeb", "value": "12288:yjfiN/fajqq1sj0CAl5sWekOxpynqYQMzJf:Ha+ksjEfe77m1QMzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631931, "uuid": "ccece37c-3a17-477b-bcfa-0139d9f13505", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631931, "uuid": "48ca35c4-205d-4138-9464-ecdf0d640ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631931, "uuid": "e360c6ef-0277-4f0a-95c8-2a3ff68dd906", "value": "slimzx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f6f9e6-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688623095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623095, "uuid": "5c6640ff-733a-4834-8fce-0b2761a8bdfb", "comment": "Malware payload (Mirai)", "value": "51de29c1759669de34759f5c951a1862", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623095, "uuid": "9e01be73-c37c-4f80-a42d-9d4324e816a1", "comment": "Malware payload (Mirai)", "value": "03f4d720c23753736ed66f414f9a194bb8ece50ac538dbebf5a71b78f86b68b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623095, "uuid": "6f5c72dd-e374-4f56-886e-feab01ce2f9c", "comment": "Malware payload (Mirai)", "value": "9a132b8f14e649e98dc8a15f5040d580592ab6d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623095, "uuid": "a85af9fb-b66f-4baa-a2df-de3aa496222d", "comment": "Malware payload (Mirai)", "value": "fd26b84fc7b65631a8cbe81087d4b6fe285b88389499f65be2d9f8dfd716a8e2268ab8451fcfbc1ad34fe7dcce2bad71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623095, "uuid": "c9c5d904-cccb-45d0-8ddc-b543c1f50d06", "value": "T19293970D6E219FBDFBA8933447B74B21A748339936E1D685E15CE6012E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623095, "uuid": "bdc627a6-6142-4b78-9fcb-4c7667b12f35", "value": "1536:CAhv70ie/6p9l9YRh3EYsjXPvIPvxVPvx4RULbPMfSixLsmRArOVBhnebgYBH:FBQiK6p9fYLEYsvGofSixL7yrOVBhrsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623095, "uuid": "966da406-863e-47f8-a6ae-eb957074a6bb", "value": 92824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623095, "uuid": "8cf0df85-0803-4925-817d-c8539ba56b99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623095, "uuid": "3b877096-868e-4cae-b928-771c199701a8", "value": "mips-20230706-0558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5027f5e-1ba5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1688610928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610928, "uuid": "ad97048e-6b8a-4249-acfc-d8e4608b8ff6", "comment": "Malware payload (CobaltStrike)", "value": "ab34e325c39b978e2af749e1e9c7b7e2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610928, "uuid": "5bbbe262-357e-403e-8e16-96ec5501463c", "comment": "Malware payload (CobaltStrike)", "value": "0410a2daba8159f87bce47ee0ee806bae2f7e4d020e1ec9a5755fb3e302fdbf3", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610928, "uuid": "dfb78ad0-5122-4549-92a3-3a14265d6bf6", "comment": "Malware payload (CobaltStrike)", "value": "a53d412833044d541003851536dfdb2af6ef34b4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610928, "uuid": "ba4469f0-6785-4d08-aaab-14d27eb91a57", "comment": "Malware payload (CobaltStrike)", "value": "ef02717e82e7ffe3ae4c5cb9351e7e813a4172bc304dae69e043c7b344b8a5904ac6186a7a774aabdc7b1ba7c7f3cfdc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610928, "uuid": "821b0f83-f9c3-4351-8a0a-3e3b1d12be39", "value": "T1E154E078DAC5FCA1C6C638B01ECF631CA739B14205FBB60A5790B16E45ED4A4C7B8399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610928, "uuid": "8296da51-e07f-4202-9ccc-bacbfb617552", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610928, "uuid": "41d499fd-bbc8-481a-a170-2468f1c8d96b", "value": "6144:BRiTGYl5/OIb4S86y4sR/BK7nypqZcsbeNxRlIL:BKGYl5/OoRy4s/wnyYS2eNfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610928, "uuid": "3d4d95f9-67fc-4433-aebe-a2a7d25ab930", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610928, "uuid": "aa770118-41ab-4d23-b0b3-0fc09dd21d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610928, "uuid": "9308eb1c-17dc-4316-a9e7-350a5e679751", "value": "ab34e325c39b978e2af749e1e9c7b7e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518e9a2b-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688648530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648530, "uuid": "cd068aa4-dbf3-494c-b611-b8a18878bb33", "comment": "Malware payload (Mirai)", "value": "a7cfa6e72b0b199392fe592572c277e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648530, "uuid": "1e8398ff-6b4d-4204-ae87-84205db912f1", "comment": "Malware payload (Mirai)", "value": "04d45349815eeeeb9db8917501d68b743db30c1f6437de449957329d581ad858", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648530, "uuid": "a3fc73d0-d601-4590-b0db-5f2f718c13e1", "comment": "Malware payload (Mirai)", "value": "dd924624dfce8724ce70ae26567c3f756ae800c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648530, "uuid": "544552cc-d0f2-42f4-89f7-a2b579645248", "comment": "Malware payload (Mirai)", "value": "d3a8f14329abdd6b900576a8298df3df1ec0d8a38f20263e8976a02b40aee4f566adb22844d224c3528f55937c735d22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648530, "uuid": "ed7477c0-4de6-4b83-8b62-a689355c84a9", "value": "T10783630E3E215F7DFFEC823987B74A21665933EA22E1C5C4D19CE9061E7034A641FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648530, "uuid": "c7a6a75a-7958-4995-90a0-6eab2bb0bbf8", "value": "1536:im2yFrszc6Q0vTJ2VdKXrE1nHkiRZKyLXPj6jc:IyFraQ07cVSE1nHkiRZKyL/j2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648530, "uuid": "b0218fdd-20b7-4873-8c03-9d6f783de1ea", "value": 84120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648530, "uuid": "ecd4f2fd-f514-46ec-a082-e4bae672ea63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648530, "uuid": "7b21cc70-1495-4cf0-8ab3-342326d98b86", "value": "a7cfa6e72b0b199392fe592572c277e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512c497a-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622330, "uuid": "2be788a6-7522-48a1-a651-e982dc7064fe", "comment": "Malware payload (RedLineStealer)", "value": "0c01ceb7ebf517238b55e516afd1be37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622330, "uuid": "449f6f94-6132-4205-a656-a040c167fbd0", "comment": "Malware payload (RedLineStealer)", "value": "051ab52a753ee51e150a1e9a12ba8d54e6d098d3de6498f8813eccd097704fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622330, "uuid": "ad532cdb-9c63-4de4-8027-096d59238b7c", "comment": "Malware payload (RedLineStealer)", "value": "9c70671fd70b9b446c9b064d8ca928321ea81c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622330, "uuid": "cb1063b3-37ba-45e9-949a-130634edd797", "comment": "Malware payload (RedLineStealer)", "value": "2e26903804d7d26741cc06e52cf7b8f1fdf0f46d9bd1e3496e022cecd74b27ff74986d8e38a691514aa027b5b812ac17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622330, "uuid": "1977452a-fb45-4acd-a6c2-732ea745f9d9", "value": "T15B55AD05A09D1D5CC672E3B2BADC23523DBC85742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622330, "uuid": "d478c357-07b7-4117-8f66-bb53ba4b50dd", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622330, "uuid": "448aab34-99cf-4d95-849e-4abee96c2ee1", "value": "24576:PTx1buwUS/lk5g+OsFK1TpQZRCodm9g02QKGYQkD8lk:PT7KVS/lySsFSTpQZRCodmG02QdYQkD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622330, "uuid": "4aa2fe08-0c6e-46b6-a692-43da474e4e8d", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622330, "uuid": "9245d126-7294-4b87-bc6f-dab86eaf0037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622330, "uuid": "92b6f3c6-abdb-4a54-91f5-b9f8ece9ec68", "value": "0c01ceb7ebf517238b55e516afd1be37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b45cb61-1be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688639070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639070, "uuid": "f352f8a0-c765-4edf-9d00-4b1f80663c06", "comment": "Malware payload (RedLineStealer)", "value": "d9356cf5deb7538d1dd7884e760a7243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639070, "uuid": "b456c829-aa89-41e4-8f68-83924d721988", "comment": "Malware payload (RedLineStealer)", "value": "05332f887b27aef819564bf2bbdd2dd49ce9403264ad6cefa6579e18eb4b830c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639070, "uuid": "456ad805-ba6a-4783-9187-96a643e68292", "comment": "Malware payload (RedLineStealer)", "value": "8f36b5a882bc73e58fdccd79a0ce231930e19e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639070, "uuid": "b5d6bdb4-f898-4338-b345-ed420b07cbb5", "comment": "Malware payload (RedLineStealer)", "value": "b7359db4e6eebce3d60cc73041dbfef7c7e3e62a9e49f15e851070e03ca266c8f60f0f56f0387d70febef3fe35dd261c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639070, "uuid": "cd9d19d4-6267-4208-bf67-b89a592cb395", "value": "T1B7060102249D5E6FE13A39753BDC0947F8AC95B4DB0A0C5521D26CEFC98CE43F6A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639070, "uuid": "896848da-5112-441f-bac0-53b5f24b068d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639070, "uuid": "904e0788-a35c-47ca-b88b-cdc1e9c882f6", "value": "49152:NtYn+3bvmo9/9Lvwff8d6U2izBZa5P007lORpHaNbIiog5W3BIcMTjpf3NVOqbCV:fYbU2iDahtIqWytdfYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639070, "uuid": "f7bd8b61-4e2d-4f92-99e5-2770a71a1613", "value": 3784520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639070, "uuid": "2e863c5c-dec5-4693-8b6c-aa027ea3fd11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639070, "uuid": "2849bd98-6f18-46f9-a358-5e5172b8cc21", "value": "d9356cf5deb7538d1dd7884e760a7243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc40addc-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623905, "uuid": "b1059ab8-7f59-4eb9-b27a-acce8ca311eb", "comment": "Malware payload (RedLineStealer)", "value": "d433091da463c64bf7d3a15ce44889a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623905, "uuid": "ee17f7b8-f307-4557-9ac9-f6c3696e3540", "comment": "Malware payload (RedLineStealer)", "value": "061b8311cd9088862a8cf5acec5b906b7d04a8dcae3556bfad2788c07fcf6e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623905, "uuid": "b2ab9ead-e8f0-41b9-9b1a-e6fc3dcc043e", "comment": "Malware payload (RedLineStealer)", "value": "0eefd58be81583de0aa924fa34026f8d8af80d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623905, "uuid": "12caee14-ac5a-45af-829c-3a33e53b12e0", "comment": "Malware payload (RedLineStealer)", "value": "e60bdd752e8d4b8e76e1c9761937c6d59de094f6b8d5ad4b940d768c345c5bebf3bbe7f1b0aa1ff9dffb25080914da04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623905, "uuid": "3692e442-67a2-4188-bb4d-b70a312f3485", "value": "T15D160109616E9DAFC47534B127DC0993F9ACA471670F4E0122C2EEEFD8ADC81F6914AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623905, "uuid": "4846e8e1-1f05-4775-8930-a5e08a4a2a24", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623905, "uuid": "e323e154-184a-4566-b9d2-713d111a2386", "value": "49152:dfoqFij7iSFBuP+gemoVTXgn58+nHtUNiS1VNzoDkPZCwbwJEn6eAn7KBf8fQPyw:UwzsVg5aNNNjjP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623905, "uuid": "cdd279a9-2761-4eba-b4a9-c7c4a6078e8d", "value": 4067656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623905, "uuid": "6ab5e407-f52f-4be1-b6f5-affab8f7d433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623905, "uuid": "8b4581c3-66b3-4f99-a5a5-c123463aba27", "value": "d433091da463c64bf7d3a15ce44889a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df556c66-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620421, "uuid": "b65ab657-21a0-499d-8498-e69a878f8031", "comment": "Malware payload (Mirai)", "value": "0ab364662ba1152e608bb3cf75d0404c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620421, "uuid": "e7169aeb-c1b2-4f2d-8a6a-e1379d94e15f", "comment": "Malware payload (Mirai)", "value": "06f0454f36adcf40362506fa8af3a79b00e1386e0db71ae053752f5e41c4357d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620421, "uuid": "bb88acf7-92be-49bf-bc9d-0eb7a4e50e92", "comment": "Malware payload (Mirai)", "value": "87751b83907cdf5a0e6320f7de8410ad1e670805", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620421, "uuid": "926d4246-ddda-455f-929d-467b6a14aae3", "comment": "Malware payload (Mirai)", "value": "8ca63ebd3fd5f3ec5d760f7db5a25452891212712cf07e2410fa0c631b14e25663a1685181f98bf9179391352a33699f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620421, "uuid": "96d6f552-6ee6-4d1f-9c85-925bf5e2a723", "value": "T1ED4493256E66EA63C4ABFFBAEBE53A82134CF1430F856303B0B0905D59F594D245BCD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620421, "uuid": "f38c242d-0f83-4c67-86db-471990ab2198", "value": "3072:pe3g94jo6dwUrL2y5FG566CSh7rPNrPt9656k/VryUmlHnYA2mcCR/bezUdCrCqw:d486Rm7vkW/sUdCrCqxtZwo3smy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620421, "uuid": "d8e25719-0727-49a9-8ba9-2ee71a219864", "value": 257829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620421, "uuid": "6745898e-181b-4055-a09b-a9e68b359100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620421, "uuid": "4cad1bf8-9fde-4596-919a-3c440371e2a1", "value": "0ab364662ba1152e608bb3cf75d0404c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c025bdc-1c00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649755, "uuid": "4fac5ca7-7808-4dc3-af23-fa3aa820b724", "comment": "Malware payload (AgentTesla)", "value": "8bd1824cb2c839ed25f116341f787214", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649755, "uuid": "35ae3958-1cf2-4274-9484-7c6e47bd2d86", "comment": "Malware payload (AgentTesla)", "value": "076556ad465bb59f3c94c5bfc5432af05b8bb41f8cf65fe72f55b0f208c17aa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649755, "uuid": "91ab4feb-319b-4d50-8bf8-c4bf8c7f3480", "comment": "Malware payload (AgentTesla)", "value": "c911067a202ba960a1f9d7a192cc85b63befc96b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649755, "uuid": "5e26331e-47fc-45eb-b67d-ab4d1ac3d29d", "comment": "Malware payload (AgentTesla)", "value": "a7525a65101725400edd458a64115d27f72d410428061d8aa87ed8ebac96146070f046acc40ce60a34b7298101a366d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649755, "uuid": "4ca0750a-13ef-46f7-980c-9a7a87bb2b30", "value": "T1D805E04171392A63EAB9CBF5025152B097F63F5E616EF2E84CC6B0DB52F4F840A41E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649755, "uuid": "709e9f86-0d28-4ff9-b838-9f5306390171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649755, "uuid": "550ac26f-b349-4d6e-85ab-6f5e6dac37d6", "value": "24576:1d4qXdVEiz7NpLg/uz2SXqXwUVxSQQPs:r4qXgiLW65XqX3xhQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649755, "uuid": "bdaf2817-e619-4571-8482-eba04e528df8", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649755, "uuid": "27bcb93c-f835-4f0e-9361-2981fc33597b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649755, "uuid": "76fa76ab-0c07-4d43-8eea-60a0547f82db", "value": "076556ad465bb59f3c94c5bfc5432af05b8bb41f8cf65fe72f55b0f208c17aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e688baf4-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688646203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646203, "uuid": "a18f79da-a11c-4aad-a791-923dfee82106", "comment": "Malware payload", "value": "92ff94037cb35c1f5ba86f2fa0591216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646203, "uuid": "88acf32f-70cf-4634-a3ba-1b58a08daebc", "comment": "Malware payload", "value": "078b9a9369af59f12616ca1087918f95a5daa7362016a873525f2bb1d2bc5cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646203, "uuid": "d2bee56d-6a0a-49c9-844f-26f50c4c01a5", "comment": "Malware payload", "value": "b8cbe9727a0c04f093f2fb28a56ebd1ad6fd5f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646203, "uuid": "a375350e-c314-4c55-859a-131c997c56a6", "comment": "Malware payload", "value": "6f253d325997a5439d4b4fd4385c945594776ab8b54ac249d508cfe562810fd8bb7eac15e4849595fe78f9bc724d71c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646203, "uuid": "28a41ad6-9d2a-4e97-a85e-54e253ca293b", "value": "T1D653D782F7AD80B7D549CAF048565B39423FF8991B2152878FC5FF094833B9A9CB2578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646203, "uuid": "a840c937-e4e0-4bda-b46d-b907b8b88ac5", "value": "a9db95aa94fc573e916351fa7743cda5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646203, "uuid": "17686860-f8f4-4468-8737-08aed18a4e6f", "value": "768:qq3eEneZl1k3smLIpXS8Go9Ql/aFCPiXfXweaVU4CagN2g:q0eEnsqDLIpXJX2RS2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688646203, "uuid": "45a54082-4aff-456c-b2d0-4b3455f46322", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688646203, "uuid": "4a7ca0f5-d310-4cca-b29c-a9da5539e53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646203, "uuid": "2d61f5cf-dd16-4b7c-ba43-5f091047c1d1", "value": "078b9a9369af59f12616ca1087918f95a5daa7362016a873525f2bb1d2bc5cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c7e45d-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627681, "uuid": "388dcf6b-c164-4fdd-a6a6-57e5a21df068", "comment": "Malware payload (AgentTesla)", "value": "76206169b0a2f67f84af88517fd236f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627681, "uuid": "a8c849c4-1d81-4eb9-bc50-54a4100826ab", "comment": "Malware payload (AgentTesla)", "value": "0792e51bf75ef3e84e9d67abfefde373c2a068c28fb03c7fc1cf4c980b1a1df6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627681, "uuid": "df39ac19-98ff-45ed-b7ae-b3f5e7edb7b2", "comment": "Malware payload (AgentTesla)", "value": "6dae414069bf99a1c217224e154aef4a26c38148", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627681, "uuid": "d7d67146-ea2a-40e2-9749-843bc1e67a7d", "comment": "Malware payload (AgentTesla)", "value": "2ef8ea2a89e1a617d431303b45b9f654c26a3b35a8487e3b4d006209d46f5312a95fe73518350965a269f2d06a9a001d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627681, "uuid": "fb0289fe-346c-4f14-b7ba-0f639bc92dce", "value": "T1D584123433A2945BE4920A755F319BAF0FEED01614B0834613605B7EBF36B61A62D7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627681, "uuid": "bc35b244-9955-4afa-b1ae-62643830d9f0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627681, "uuid": "73d1ad8f-efde-4d28-83e0-b04fa496d579", "value": "6144:/Ya6PY3EIv19Lu2atoyYcWOAqztXQJnXYe73gNQfVTQ7FctEA0jr611rYBB+2ORW:/Ylp89Lu2qYcWZqZX6Xt7Df5QetEAmSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627681, "uuid": "393b7d2b-535a-4e96-be56-4c83c2c783a4", "value": 382726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627681, "uuid": "fe2dcbd0-cbc2-4ddd-82a6-23ebd452516d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627681, "uuid": "a268becb-233b-4370-b911-ee1859934203", "value": "DOCUMENT REVIEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f48147-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623392, "uuid": "ce4eeb37-a345-473f-895d-388388605572", "comment": "Malware payload (RedLineStealer)", "value": "a025e956046856b90e7b47173d27c63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623392, "uuid": "13015c76-9ef9-4068-9d0c-134a6b61961a", "comment": "Malware payload (RedLineStealer)", "value": "07cda52cb9c4c7092d54527c6d34a63272ab0f5997b6b1468c98da273496d5ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623392, "uuid": "60fd2e0c-53fc-4823-a7f1-ad97acbe4035", "comment": "Malware payload (RedLineStealer)", "value": "76bae43f686181c291ccf457dd25cadf5abd9ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623392, "uuid": "ecec27fd-bde7-427b-8c48-cbd2bbc3747a", "comment": "Malware payload (RedLineStealer)", "value": "ad288280013c6470bc77e28614f9d5928e3f46edd58bb461871bb9b696d013b3efa07f89f4f1bf8f63dac09471eac7ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623392, "uuid": "14822753-d016-44fd-92c6-bdff77186272", "value": "T16755AD05A09D1C5CC572E7B2BADC23523EBC8474291DA13992E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623392, "uuid": "ed1ce660-5e39-46f7-9000-832d2e8e8e43", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623392, "uuid": "c06887ab-c0c8-4cb9-a3ca-ed8c3285f75e", "value": "24576:Jd8t1MvGbfl9RD7UronbZXqiFsRa7lORqodaw:JKH+uflYrqNXTV7lORqRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623392, "uuid": "e996e85b-9150-4fef-af13-3d9c218fce48", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623392, "uuid": "fe39fb6e-c21a-4096-82ed-ff2c208483d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623392, "uuid": "80fd55cd-88b9-4b1d-8c09-71da7996c2b4", "value": "a025e956046856b90e7b47173d27c63f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38cc543-1bff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649553, "uuid": "c7ed72dc-35a1-44e2-baed-e96b501310bf", "comment": "Malware payload (AgentTesla)", "value": "f3c7cd594dd9da495bc3c5e811249cf3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649553, "uuid": "252e4d45-0eff-4656-9dc8-5c7459300bf1", "comment": "Malware payload (AgentTesla)", "value": "07cfa4984b99d3fb354c156fb7db24103897c28a7486aaa34ccfcd255a8ee153", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649553, "uuid": "dd62c553-0024-43c9-87d3-130c0816f23c", "comment": "Malware payload (AgentTesla)", "value": "b5f8bbbae9a34f2e42d454da981894e53a5254e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649553, "uuid": "6adeb181-b965-455c-bf9e-d3a24d0a0b69", "comment": "Malware payload (AgentTesla)", "value": "3952eadb8cdd7c56a4f1bd359819dce7e741415f4cbdb72ae587b171d2910a2bef72a0b0dc1676c7acadc635188b5e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649553, "uuid": "ff7c1719-e5df-4f8c-b5e3-88b67fa30920", "value": "T15DF40204A6ED8707C9BF13F9596488344BB2B55FB536E74F1E42B0DA6962B128F01F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649553, "uuid": "417aff37-0256-4d5f-b99b-4bdf67400dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649553, "uuid": "78d5747e-9807-4dcd-a3e7-845fd1be2cce", "value": "12288:jI8lO9Rk3TduLKOleTIXh0b0v8PzXcDum1eNDHmDawZqvjB3juAEXqXdVc:9sLlNR0bzlmQND0aw+tjuA4qXdVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649553, "uuid": "5353d001-60f6-4e20-a4ab-eac63ecfb133", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649553, "uuid": "4d085eb7-86b7-42a2-a192-549df929bb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649553, "uuid": "23a4b1b3-59f0-4f69-81c5-d44b557986a0", "value": "07cfa4984b99d3fb354c156fb7db24103897c28a7486aaa34ccfcd255a8ee153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5e3353-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661619, "uuid": "2163c2fb-ecff-4c7a-8656-e91f944a7008", "comment": "Malware payload", "value": "d7c9e6e5ab89ffeac7adf595e28e90a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661619, "uuid": "acf84310-d1ee-4e2b-9288-f72c9c38f930", "comment": "Malware payload", "value": "07e889ad34a429f3295011d92258f5d43a6e015eeb072695fc81535f82b460c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661619, "uuid": "7838b727-09fd-437c-8267-5fae6853a8f0", "comment": "Malware payload", "value": "8db88941d677f0f9e373797dcbef163fe7e7347d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661619, "uuid": "5f5ed380-674e-49d1-9e95-8369942a9397", "comment": "Malware payload", "value": "6e58f7d50bcc1be565f7d46dec048c2c6840d3ec1918fb58fede0dbd881ac8e32d2854ce151412ac0ca0dd93faabf56e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661619, "uuid": "5a8f3f2a-4ac1-4d56-b309-3d5d80b17995", "value": "T1F3D32AD933486A9ECC7E8D74D4650C6587B0A05B6207E347AD83E4EB6E1DFC39B091E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661619, "uuid": "22a43702-a3b1-4841-861b-2efde6a66d06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661619, "uuid": "26844b51-cc8f-4fdc-b07f-2812890f6ee7", "value": "1536:v6bfM01pe95Y0TMqYSTsD4gzMRF7h4G5FbVnhdbhcVsYgibfbFDKsRC:v6R3e95Y0BpT54SVVTbhcqYgafJlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661619, "uuid": "185273d2-76cd-45c5-9abc-0951bd12e0fe", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661619, "uuid": "5ca33af1-a790-45a4-80c7-44dee5526381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661619, "uuid": "91cd3b21-297a-4c0d-af29-786ca5594e1c", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94e8f7f-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688644436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644436, "uuid": "c58e444c-d369-4b85-9346-63bdb5912c11", "comment": "Malware payload (RedLineStealer)", "value": "8f61e60e35a64c6da039425733180392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644436, "uuid": "f4b8800a-069f-46dd-8949-01f8e8eec499", "comment": "Malware payload (RedLineStealer)", "value": "081c25dc1080c68fdb416866470796e718afcf24daf7343529cb1e76632c0224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644436, "uuid": "8d06a695-31af-491f-909b-3e05f8b4c539", "comment": "Malware payload (RedLineStealer)", "value": "69676c69878392c4a9d9e156f902661462c141f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644436, "uuid": "99275618-cba3-401e-90c6-5bbe4df801e7", "comment": "Malware payload (RedLineStealer)", "value": "5891756ae5084192ca77e95c0affe0fcef58c800d432bb8677b040e4acf68bc6d946ea0477d213882e1ab0fdab8ef698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644436, "uuid": "ec1adbb0-5b82-4b13-b1e4-88124fbdc2db", "value": "T1A516011961AD9D6FD47534B227DC0943FAACA4B0270F0E1122C2EDEFD8ADD81F69199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644436, "uuid": "503d179d-7b6e-4178-8aaa-557f6e1612b9", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644436, "uuid": "1d3843c6-c7f9-43f5-ad67-b3de5039b446", "value": "49152:EYNo534ey0nSj82ewSP+6pFzvZHTv8HufUMoCUqysaz5EDS4kkSeFGqJ0aqTFo6+:d+d51TiC05UFBJ0npo6J4vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644436, "uuid": "86df9f62-ab1e-4c34-9423-98c1511eacd6", "value": 4064072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644436, "uuid": "0f8aa276-fa4d-4209-a0b4-f1278fd38eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644436, "uuid": "cfd8a3d1-bc97-48a1-b945-09b47c68cc2c", "value": "8f61e60e35a64c6da039425733180392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc9e659-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688624416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624416, "uuid": "0f91d0f8-5867-4876-9d82-0bc6048dbd9e", "comment": "Malware payload (Formbook)", "value": "f7ed2dffc0c7e0ab7f3a3fef4f0fa7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624416, "uuid": "e53167cb-a548-4e7e-ad54-4dfd2930ead0", "comment": "Malware payload (Formbook)", "value": "084024d4f98c6826dc940424c0eafdc69c92af63f3e0cf2abdf287425a29c36e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624416, "uuid": "c6ea48b1-a583-4ad4-8a75-1c03a2b7d464", "comment": "Malware payload (Formbook)", "value": "06e822c41b420ef83a50dd87dc573988b0603da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624416, "uuid": "9e5b48fa-389c-41fc-aea8-c230211bd406", "comment": "Malware payload (Formbook)", "value": "3e7b3ada5b86ee127b4757719f5ca75ccd31556b1aeacf7c1ac56d3f079f75cd1e0465eb61506a7abea3aae362e62312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624416, "uuid": "37de3981-927c-4e24-a74b-684b5b93a66c", "value": "T147D45A3C1CBC3222C134F6B68FACC461F554946B3E618E3765D3999A471EA0269CBD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624416, "uuid": "5102bd84-d4ce-4a67-88f2-261071e8008a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624416, "uuid": "968a53fb-9274-4001-868d-dad344472130", "value": "12288:N9ZISYa2aHAeLaLZF7ga/AFfUTmRIdiLA1POivio:fZ9YangekxHJTmTLA1Pjqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624416, "uuid": "ff23e1c3-c110-4b40-9299-6a00fb4fd3ce", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624416, "uuid": "dfae8429-c253-4558-befe-15ab2be88bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624416, "uuid": "3e08c110-a1af-4b94-af14-fe9aca48dccb", "value": "Yeni Sipari\u015f Talebi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e3f3a-1bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688641599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641599, "uuid": "43c6ae7a-d654-4dfb-ac23-2408024dcd20", "comment": "Malware payload (Formbook)", "value": "cc5ef31195300b2ba7931939057df6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641599, "uuid": "5a9c8891-162b-4cfa-999f-0e5bd6460cab", "comment": "Malware payload (Formbook)", "value": "0978bd6c3a575dd054cd139eaecc851695800c859e61ed340b47c9d5bf0d0d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641599, "uuid": "5e27cd9a-2eb8-44f8-bcd2-e1863bfbce27", "comment": "Malware payload (Formbook)", "value": "2380d7774b44918c6644ae0e9ad4df1a318ea11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641599, "uuid": "eaeea9df-bd17-409b-a7f1-ce38366f3fb5", "comment": "Malware payload (Formbook)", "value": "b7ce2da3d50aca61b38bd50ebc96161e654895b531fd408d2b07b8163ddd4811e1c03a067a8144ce87a4d1da6e6ca425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641599, "uuid": "428ba46d-d7a7-4be9-97e0-983bee4f9a0b", "value": "T1BA05023C53A2992BC54F2F7C0A9542BAA7F989933613D3038397693E9D1EBD54A314C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641599, "uuid": "eb04fa01-85ba-4360-8edd-40c298f0b11e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641599, "uuid": "dbd73755-7c7f-4c5d-8bbd-105d34a3c359", "value": "12288:rVLbhaDnLMzIL2q+RTdOL8U82C6S0yBxdqswdnU85ucBKL/4MdmYaAw/J5tXcIm:x5OyqGUL8D2n9y2nU8NUdqrtsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641599, "uuid": "788bbbc5-0bf6-4825-b907-c50f89eafd68", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641599, "uuid": "d0d1710f-6ab1-48d7-a397-68992f166003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641599, "uuid": "f6d6d9e5-624f-47f3-b8e1-1e7855f4c20d", "value": "0978bd6c3a575dd054cd139eaecc851695800c859e61ed340b47c9d5bf0d0d38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5281d373-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688627057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627057, "uuid": "34643c43-c137-4008-b3fa-fbdc8c3ca5a8", "comment": "Malware payload (Formbook)", "value": "12a5ba51dddf12186814082e05ee8fce", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627057, "uuid": "06f225e1-601a-437f-ad64-14e02ebd431d", "comment": "Malware payload (Formbook)", "value": "09d5670d1245b635c357986fab9f0c2d1c5c56650bd2432fe3e985afc2835770", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627057, "uuid": "229039bd-4c00-46a4-8880-b8fd60f7e37a", "comment": "Malware payload (Formbook)", "value": "5cb7932ba0d163cf1c0827c71f8176b540787ba5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627057, "uuid": "41d47a87-ea65-4c82-9ba4-0d6c30be34cc", "comment": "Malware payload (Formbook)", "value": "51bc597381eb9ace1cb6c047acf5e1aeca956764f9c058ba16502481f9dfb8df116f726692704a652b85d8404b9911ca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627057, "uuid": "c0488843-8cb3-4a28-ad2c-34880bcec7c4", "value": "T13174239EACA52911C566862EDBC2E854347E75015DCB20A1CC2713E2FDAD7FE8953C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627057, "uuid": "f32c3542-6967-4a69-bdcc-297f4bf8e8d0", "value": "6144:RpU8PLFsgOpeVhQcMthCTX5CQa6E/sSQaxkY3Z4aL6VK1EUP3/gENYL8jRI6L:3PLFsHA/16ho70Nvf3ZbL6Ebv/gEOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627057, "uuid": "3ef39722-3abd-4913-9de3-7a3ce0a727ef", "value": 340035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627057, "uuid": "d02c38ec-4bc9-4011-8b07-6f43827b5166", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627057, "uuid": "6211c146-01d9-4e10-a801-d45d16839ae2", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f489dc-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624370, "uuid": "761bdbc8-937f-4ebd-8001-d8407a204883", "comment": "Malware payload (Amadey)", "value": "ec6037429bbfc8b715b73d14e285b85d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624370, "uuid": "e39b05ad-9d61-47a8-8dee-9a6389c04f4b", "comment": "Malware payload (Amadey)", "value": "0a4b12856e7bef364dcec764e8f190bf8e423a467e6c1acafe0f07c6979fe895", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624370, "uuid": "e7d0962f-ae44-43a1-8a04-45983edb2108", "comment": "Malware payload (Amadey)", "value": "4e9fe5079831a9133623488a558dcedf6c761314", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624370, "uuid": "29d5c677-5149-4221-b889-e36c63f23d92", "comment": "Malware payload (Amadey)", "value": "0f1a8378a50bb17c8a094deb554a93ce45fc5215a20a2c25880937309fdfb2db83a5368f8cf9d3954e65e415a93978d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624370, "uuid": "fc7d22c4-2c2f-44ff-8501-46f4982ba15d", "value": "T153060102215C8E6FE836757923DC4847FD6CA474EB090C8121D62DEFD99DE83F6A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624370, "uuid": "7dee7b38-339b-4db8-8266-c6855c768cb7", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624370, "uuid": "fbd082b9-00ef-4859-b270-db1a6bbda627", "value": "49152:wz2l2cKCeAeONGP7sJBs2S67QU4x5Cz6KTsAewwPGkH7oRdhWuN6gWAcNRv95EEO:hHKCMAWzwDfkGkE0TMEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624370, "uuid": "f70ae796-da3a-434d-b09e-b600a3bad94b", "value": 3770184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624370, "uuid": "0a352f76-d736-424f-8219-ca0d0dd2377a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624370, "uuid": "ca3c8009-4ceb-4bc4-bf2a-5c95c8e4b485", "value": "0a4b12856e7bef364dcec764e8f190bf8e423a467e6c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022af628-1c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688655269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655269, "uuid": "669dc65b-14fc-4b9c-b4e2-88e3d27cb562", "comment": "Malware payload", "value": "f28c2b5c60c28841d3633038b1339ba4", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655269, "uuid": "04edb8c9-57d4-47b0-b39b-379dbb3dcebb", "comment": "Malware payload", "value": "0a4f053791180ed2b3f95774dd11e0b87a72ad8681e28ea70df790d5fb955525", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655269, "uuid": "ac7037bb-1faa-4b1d-a40d-e18e30de8bfc", "comment": "Malware payload", "value": "db9fe7ba9ff8771d28a2fa504d84059faab6be5b", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655269, "uuid": "9ccedb3b-2f0b-452d-9dda-a25337e7702f", "comment": "Malware payload", "value": "f99767d24be5e0f7606463e27786d87357e4d6187a3c1c19ff4988a03664a3b7c36ddf60c59d85fb4cda61105d622166", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655269, "uuid": "c1c7d4c0-76f5-4aed-9443-d91b061dd355", "value": "T1C1868C27B9A10935D287C0704AEE87A26731F5358235FEDF2774E3352E66C128B8E746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655269, "uuid": "863ff828-9570-4073-9ded-0f02fcd896a8", "value": "98304:9lf9hH95tMoLhlhQDNNwAyG7x67Ndu65SPNOn1vMSP8Z:rP9OzOGKTn1vYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655269, "uuid": "b1b03201-61c8-41d8-b197-db65980fea02", "value": 7981128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655269, "uuid": "427252ae-8f25-4cd0-95c5-8430ce064b24", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655269, "uuid": "fc3a2435-da23-4968-abae-bf102303b4ea", "value": "BrawlEarth", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8782091-1bff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649588, "uuid": "8f0459a6-66fd-4e82-822a-d791d8811d51", "comment": "Malware payload (AgentTesla)", "value": "102e172d6ba9a24ba983975e64741604", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649588, "uuid": "c64e3b78-8d9b-4b0f-b1f5-0c2700bffea0", "comment": "Malware payload (AgentTesla)", "value": "0a9461ba501b7c58ab945a31ed3ad1bc171ed3b02909b308d47cfd8d298ad868", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649588, "uuid": "ad8facc5-9e30-41f9-a507-7fc6641f80e2", "comment": "Malware payload (AgentTesla)", "value": "4f16ef843507b311e221399e64ec2696df65cf08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649588, "uuid": "2da31fac-bec5-4713-9771-c0ea629ea682", "comment": "Malware payload (AgentTesla)", "value": "9763dd6edc3e302ef2072a5d7d0b10d1fb21c46ce32412842adcb2b4158d2b888365f3e64aa9439571c80aa367ee880b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649588, "uuid": "6e150d40-3d72-473a-8455-b53034659a8a", "value": "T17B0502449AED8347D5FF1BF45521943807B2F86BA936E31E1E81B0E6AA22F114F11F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649588, "uuid": "563377a5-88cc-4b7d-ac00-b394cd085cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649588, "uuid": "850c55fb-368d-47de-8c7d-30be36a8b5a1", "value": "12288:U4WU4w4XNU/s5vLINhw8xrwuoDGhE79QcrlgS75EXqXdVp:/2NdvLyw8xr/+t7v354qXdVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649588, "uuid": "7a9db499-631b-420e-9663-7639a81759f6", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649588, "uuid": "1e263722-f4e2-4552-a3f0-2c5acb023901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649588, "uuid": "7c3e0a38-ce63-4a7c-b624-ce0d497f3ecd", "value": "0a9461ba501b7c58ab945a31ed3ad1bc171ed3b02909b308d47cfd8d298ad868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceec9a9a-1c03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkComet)", "timestamp": 1688651317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651317, "uuid": "6e75c4f8-d484-4667-abc4-8ef8a48ffad6", "comment": "Malware payload (DarkComet)", "value": "6fe53a251f6e9b6deda81229abf29e49", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651317, "uuid": "3dce8b32-a365-41d2-a825-c69133a59b59", "comment": "Malware payload (DarkComet)", "value": "0aa53c306f231af2bc7097242847e6603b2856d97aa49b36cff179d645d1dd58", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651317, "uuid": "ac82b020-ce7f-454e-ba95-0bddbc1a657d", "comment": "Malware payload (DarkComet)", "value": "663063a6d3b72f8652f3bf01d5ba060a9ca4e1d2", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651317, "uuid": "ab61d887-060c-416d-867a-f9f804655fed", "comment": "Malware payload (DarkComet)", "value": "58050a68981982e6a4ad27574a1881ea597bb5e118e246d6b1cee392d8ab19f62b426d268336c166d88e97cb1660cdd7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651317, "uuid": "e8104df1-e944-4b8b-b4bf-d006bf5b0d1a", "value": "T121E5263A99BD527BD171D6B18FE48423F050EBA7301A5D39A8E3379542729C238C6D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651317, "uuid": "c40c9aa1-3f44-4bf2-917f-83dad73d4022", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651317, "uuid": "a6ea2a1c-7c9e-43c7-a2b8-8fc5df0e56f2", "value": "98304:3dxPig9KbLS7NYH0VwxA0WjgeG68Nq9Hr2839Y2YXC8bx7wwI3nwiY4gZcafQm6Y:3PigkiH3Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651317, "uuid": "ab13972e-85ff-428d-a48b-93bc510536ae", "value": 3229184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651317, "uuid": "398910ed-9645-4675-9d2f-b1a00c9cf6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651317, "uuid": "3b7c15db-0958-4bb7-8e47-bbc278e5d985", "value": "0aa53c306f231af2bc7097242847e6603b2856d97aa49b36cff179d645d1dd58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c00e95-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624598, "uuid": "903d709d-3ccb-499e-8d44-54901e09e87a", "comment": "Malware payload (AgentTesla)", "value": "fde1998a4f91b01722de069c5496560b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624598, "uuid": "d33f6ee1-5a82-45c8-94a0-61ce5c3080c9", "comment": "Malware payload (AgentTesla)", "value": "0ace5259a5f3de5bfd71221aac959b8054bc31018aac425aa440aa4fe451ebb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624598, "uuid": "2f50ca3b-144d-422d-be4b-99bc9a29e6b0", "comment": "Malware payload (AgentTesla)", "value": "1cb01d36f19e0317843ffa8936e4aced4c63d61d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624598, "uuid": "837573f6-0dfe-448c-807c-5c5d4b8d3d3b", "comment": "Malware payload (AgentTesla)", "value": "a0a1638392f09528f4ede5600821f0f9d2a3280c004af3acd7a256b416be28ad98bd5691b1f41dcfbc266aacd621e40a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624598, "uuid": "bd1e5b7d-e02e-4adb-bcba-7e3b8d238bf1", "value": "T115F32A68D2879CD1D32D41B8E4B10144CAB2A147521BE76E6DE19CFA3FC73C3362E866", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624598, "uuid": "5b14ecb5-1755-4961-8dd8-5b399b527ff3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624598, "uuid": "a230d79c-1303-4002-9d4b-75da31244c30", "value": "3072:K70cnZBhtu/9mIkoEgqEKJikXAvvqKcO7xEoCp501gkA/jz7d6:K70cnZBhtuwkEWyiPa4nXDA/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624598, "uuid": "89b685de-37cc-415b-940d-990dedc060fb", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624598, "uuid": "67a96f4a-b364-4318-9773-26a71f7be853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624598, "uuid": "e84dfeac-bee6-4fef-a2d0-f8682e64c851", "value": "1688624584b308c8261010248fee7248e4e590e9452a370302d93333f1477a9ef425a2e38b290.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2412e9-1c1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688662100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662100, "uuid": "485db2b2-82da-46d6-acb9-b9f7c4494434", "comment": "Malware payload", "value": "370854ad00e3e6db0523be72d3893dca", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662100, "uuid": "30f0689b-5fbd-43bb-8a9e-cb2cacf40f83", "comment": "Malware payload", "value": "0ad38e279f77fa31979f86788245fcf8536e3341d24b56166f64d60daa98343a", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662100, "uuid": "0392a5c1-0668-482d-932b-aea01645daad", "comment": "Malware payload", "value": "e92eeeaba632ee0c7e6d5f0507e85aa08b10190d", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662100, "uuid": "7a94c903-9299-46f5-a3de-131827d77c3b", "comment": "Malware payload", "value": "8c2881f090dfb1b5c72bf33c4166222c01ad997e430775cefe50ee2fda370a32bad917f26fc8cd49239f41469b0a1961", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662100, "uuid": "8a0d2e9f-7ef9-47d6-8966-8e05de209680", "value": "T187759D1265E24FB0D859143985DB4B22772CBF2A1626CB8F5724E72F7FB22F0CD24652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662100, "uuid": "a6fedf31-bd92-454e-98e1-7318adaa3d96", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662100, "uuid": "deaec70b-1ffb-40e5-aecf-556dab8f20c3", "value": "12288:1jOtvHMm5xvmX+t4YP8hKVxbY4FGhzJ2JcjND:5OtT5xvEewgxZFGhzcJAND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688662100, "uuid": "7286300f-5718-4bb1-93ca-22c26e8dfaf4", "value": 1625577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688662100, "uuid": "47791dec-e305-44d8-b1e3-1680d52ea03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662100, "uuid": "e593f165-b1ea-40e0-ab6e-d1fb2d504bd4", "value": "Evolion.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5152545d-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688637792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637792, "uuid": "d6b5c230-9fae-4f29-8a10-d40b84430d8e", "comment": "Malware payload (RedLineStealer)", "value": "46f91ba569a196d3399908239402247d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637792, "uuid": "bd183b11-bc36-4de9-a134-b503f7bab8df", "comment": "Malware payload (RedLineStealer)", "value": "0adc96bc05eefa140d18c002942268cad2baad2ea360c596e755f2c4811467ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637792, "uuid": "ae8c8fb5-f9f5-440d-a498-7f5eb8ce7dc0", "comment": "Malware payload (RedLineStealer)", "value": "df5d3c7906a8de92e7e881b1ced562db3fde6fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637792, "uuid": "5b7ef95f-f87b-4446-814a-59422e927672", "comment": "Malware payload (RedLineStealer)", "value": "d499a95a18da73b2c39b85ee95e5800e39820277aecbe51c0028cbb3a86db1aa60b548e5e2d5a1c72522d32698fe0da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637792, "uuid": "3b6855df-bd62-4dac-a7f0-bbe025277240", "value": "T1CB161119901D8D5FDA3134342BED0A93FAACA870676B0E0122C6ECDFD4ADD81F6919DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637792, "uuid": "d69abc93-d4bc-46be-adae-8cd5510b1a5b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637792, "uuid": "16ff05bf-90a4-4c5f-92c2-a2eb642efc25", "value": "49152:iIeJRL61H8b1AvPpqYJAWTBgRoItusc5EPqGgmt4WYb/ZtWJIPQ9RsJDq43lglkL:9GscxAvw6dgKIB9Yb/z9RT5YYbgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637792, "uuid": "7d322fcf-b424-4e04-a884-a0b080dd17de", "value": 4107080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637792, "uuid": "e5b1ad60-24a7-4f55-876c-817c3b038dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637792, "uuid": "8e8db1ca-f4ec-40dd-9947-3c79380b6a57", "value": "46f91ba569a196d3399908239402247d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9bdcf7-1c1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688663124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663124, "uuid": "aec5376c-02e2-4595-8e63-c3c4b654007a", "comment": "Malware payload (RedLineStealer)", "value": "1111c4fcc0071594b415e959f1b66729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663124, "uuid": "98c78cc7-b3ff-45a7-ad31-1b13db13486b", "comment": "Malware payload (RedLineStealer)", "value": "0adf4ceabac0411e7c0760e5156b9b1e59e7da10ddc7c4490ae67f3f323f752d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663124, "uuid": "54e2588c-18e1-46f7-8c77-3a4607261d7b", "comment": "Malware payload (RedLineStealer)", "value": "9f63acc82d0d979c81a5f2d281237024a7a0c7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663124, "uuid": "3fdddb92-cf7a-411a-9b40-3b24710416c4", "comment": "Malware payload (RedLineStealer)", "value": "ef797c97579a6021f56c9ecbaf993ca64fff583ce6fb239be0152441c0f9eeb39bc61afd4a22b65f2869f8653cacb072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663124, "uuid": "f8195eed-7c7f-43a1-b27b-5265cadcc093", "value": "T145A5E0027395C036FFAA9273DB69F2B14ABD7D658123852F13983D7AB9701B1123D263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663124, "uuid": "9cb42897-5ed7-4117-97aa-aa45e89c67a8", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663124, "uuid": "e8e6a979-ae89-4edd-b7d2-955fee24d3dc", "value": "49152:Th+ZkldoPK8YavqqJwn8Q0Q5FDZHHFRu/Qt:c2cPK8Vyn8Qbdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663124, "uuid": "654f2bec-d23f-4526-9264-e479ef1807ea", "value": 2077696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663124, "uuid": "6fdd8773-baf7-4279-b946-e255e3f8f176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663124, "uuid": "1f4fd24a-99d3-4128-85ae-3e7166566210", "value": "1111c4fcc0071594b415e959f1b66729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3b8c94-1bf2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643718, "uuid": "49a2c1db-e481-4b9a-b8a7-37111c2c3098", "comment": "Malware payload (AgentTesla)", "value": "e388f46236306bef8a8c3a820ae3e2fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643718, "uuid": "0c297098-6fe9-41dd-a557-b55092efa863", "comment": "Malware payload (AgentTesla)", "value": "0b048d863c3b5219beb927aab90b4b489b9929dc6959ae7e52c964bf3b80bbff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643718, "uuid": "f50aa524-141a-455c-8cf6-a5bf81ab4727", "comment": "Malware payload (AgentTesla)", "value": "82216d4b5ca2523fb1912a6a38671daf71c90373", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643718, "uuid": "b613ac32-e0ae-4ca1-a112-913353e62ad5", "comment": "Malware payload (AgentTesla)", "value": "c8287de228a1fc2d2c1c113dfd6bd35685ea5fb38b76f1e275f339ac37f077df4b84e8b59906706c6c73ea0daa9566e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643718, "uuid": "a910bf84-0cdb-44d2-ae1e-6f9170bb6827", "value": "T1D1F412AE27AB482EC4967FBD4C501BF5D1FC9A857077C25B8F67BC9E9D41A080C802E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643718, "uuid": "8ca9c582-dc1c-4d65-8c35-c9d804c13058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643718, "uuid": "f8bba291-fbf7-4e72-b8fc-eb4acb20e0eb", "value": "12288:bhPWR28Le0cY+Yg9fb9lbBnlDnvjlpVnpRxC8MAD+f+tmOvg:bl+xL9Rk9XFnlzlntQEmOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643718, "uuid": "551aa61a-5c7f-42e2-9696-fa100b737a69", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643718, "uuid": "fd0e9768-eaa1-49f8-99a5-2c8087282914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643718, "uuid": "7d2ef973-44c3-4336-9696-911f0a43d175", "value": "0b048d863c3b5219beb927aab90b4b489b9929dc6959ae7e52c964bf3b80bbff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1f744f-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688637834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637834, "uuid": "7da922d8-f4c5-4a0b-a0ab-089f16f32321", "comment": "Malware payload (GuLoader)", "value": "d29d71887b87ee432c740caa2873cb8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637834, "uuid": "0e6f1d70-259a-4828-9dc2-c05b736fddad", "comment": "Malware payload (GuLoader)", "value": "0b20e7e6e7366fd3439f7cf15c85d29fda5ed9d1f0dc7fc78bcf04da93459170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637834, "uuid": "fefdaaea-ae25-4d8a-9561-4988880dd63c", "comment": "Malware payload (GuLoader)", "value": "1157389502fab0ec44b4b76cd84b0a86257c8226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637834, "uuid": "65fd1020-71cd-4831-af0a-443d56575aa3", "comment": "Malware payload (GuLoader)", "value": "9cb7a5b4b30a628af48b7f9530506a5798edbf0fb9b1a04db8e4ba065a7aee5d2ba650e505d7a05d00476bfbec24bb15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637834, "uuid": "801f0fa6-e1af-4983-a400-0942921813c6", "value": "T18A8412047624DA23DA6B0FB64D2AE7BB1DB4BC913921C6076F74F64D7C32740586E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637834, "uuid": "1958a3c1-ed79-4f89-bcfe-15ca9633c61e", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637834, "uuid": "140c1e11-0b06-414e-8750-929b7f171059", "value": "6144:aIw3EwpCpz9Ff5ZB9YJnDDtb5h4sLtGwyxOGkpxPIaOOu9Vo6bOqaLCuR//XHb4D:L19FBaZ5bzrGNxIVFb5FCuR/3bqjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637834, "uuid": "35f91e36-61f3-4a08-93c8-4e6920d6a222", "value": 391656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637834, "uuid": "956abc38-e396-47c0-84b0-6680526b03cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637834, "uuid": "26801970-d6be-4b1f-a4d3-de14c69143d1", "value": "0b20e7e6e7366fd3439f7cf15c85d29fda5ed9d1f0dc7fc78bcf04da93459170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7e20d6-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624475, "uuid": "c0b6f79e-8d6d-43e9-ab93-f50d549a3828", "comment": "Malware payload (AgentTesla)", "value": "9da3139b2b0a51409fd22512a2861b5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624475, "uuid": "d8c78b7a-3883-416c-a837-057685615c00", "comment": "Malware payload (AgentTesla)", "value": "0b30ef2d36a2b3017821cbd3e6ae4d141be417c0fc72d8289deb79dfedbea4b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624475, "uuid": "2a3da170-64e2-4144-b229-71c42eefaa22", "comment": "Malware payload (AgentTesla)", "value": "385478a5f264e8d7a041a3c63626170fc9856d0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624475, "uuid": "8bc78c62-30f4-41d5-8675-2abc4d4bbbfc", "comment": "Malware payload (AgentTesla)", "value": "6b03b054242820ba7b535a8b511a9b5657be5936535c2509b1db3432a134d318637ae1eeb1de8c1a64442d2d9bcc277b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624475, "uuid": "ff42b7c0-ca6f-4e20-bda8-934a231f2ed0", "value": "T1C484DE13709ACCDAA1E13A23069FF4F44BFBB7D5422E45A855CC030B96D5D2C8E59AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624475, "uuid": "21be1e89-f8eb-407b-8c9d-e8bd18b2b9d3", "value": "1536:8xynO1xY101ekP2PsPgP8lP8UPyP1APuPCav:wdcqwkP2PsPgP8lP8UPyP1APuPCav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624475, "uuid": "adda6a42-2086-4ffe-a26c-a0af85c7a24c", "value": 376362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624475, "uuid": "e179b68f-4978-4f2e-a70f-2d233520867a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624475, "uuid": "4ba22c5b-7956-4234-b15b-cf8ab98a7b2c", "value": "nuevo pedidoO06708.PDF_____________________.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c622542-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637005, "uuid": "1ca35574-134e-4ed3-a7dc-275abe7adab0", "comment": "Malware payload (Mirai)", "value": "8caa663eab1068cd94d9db76429db18f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637005, "uuid": "169533ee-1254-45d2-bb4c-49d6ced61ee5", "comment": "Malware payload (Mirai)", "value": "0b96a71624c8139bd6d6473d4a09a216742df21488d8804487b2c7017dd5855e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637005, "uuid": "8627c3a2-40b2-428a-8823-53333621a252", "comment": "Malware payload (Mirai)", "value": "c66cf3f4f124a7037a0377cbf42e482d807f854d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637005, "uuid": "5d6c319a-6026-4224-8a21-2d7eb436f700", "comment": "Malware payload (Mirai)", "value": "c2eb37976b279228ee34aac6a8e87132c8c40969dcece5803ca06408e9c62bf08031424e93bd89e181e5816212d66050", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637005, "uuid": "a90618ba-bb15-4b13-b985-6e9ba1957218", "value": "T1BAC2E0BC7EBB6F83CE2700356988FE3742B0A5A5D35BB6D7B24481016C130E5BA66C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637005, "uuid": "72928d9d-9b2d-458d-bcc8-e7ffdc6bbe9d", "value": "384:Mg1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjwXgI:RMw4DZdFbBy6x3K/KdWnH59t2en0NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637005, "uuid": "393d9396-1349-42f2-be22-06bfb0b13059", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637005, "uuid": "2ac62e40-ca4b-4ecf-91e5-38285cf8e817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637005, "uuid": "d3a6b867-e494-45f8-bbb1-6c263cd64ae9", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1024590e-1be9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1688639830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639830, "uuid": "566966ce-3b3a-4ea1-8c42-910bb06a76fa", "comment": "Malware payload (CoinMiner)", "value": "bd60dc5b185cd30c2f8318b46ec0214e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639830, "uuid": "88ef524f-5dda-4a14-972b-1145c40deb0f", "comment": "Malware payload (CoinMiner)", "value": "0be5db22e71c2983af529792c6b496ac4057b331902759e08aac8de8e5fbb8df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639830, "uuid": "3fdcb898-5119-4174-abd0-9793a22d57da", "comment": "Malware payload (CoinMiner)", "value": "bc1455bc54572efd5f0e1bf9976ad46b38bd76db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639830, "uuid": "a761a970-d958-44e3-92a6-3ab95d09594c", "comment": "Malware payload (CoinMiner)", "value": "a62e3a0c6fa625bdc49641d80ef0c9f18cf735af1eeff734372a2980f695de5507b5cb99e8df5145f71319c9175ba5c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639830, "uuid": "b2f1dd6f-5021-4d22-8dc5-45833735cc28", "value": "T112268DC2F88AE844F189F0730A5EBD1C53AB99453B5304EF51953B6A222E1D3477A3F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639830, "uuid": "97138443-0e79-4e8e-ba27-c595b08362b1", "value": "9683fec09ce76c0831ea6c2227610015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639830, "uuid": "eacca7ac-add2-4711-bc27-bdb09426f4fb", "value": "49152:SfNZUZZV+PPwMcAFsTuJXw4RIBpoGEC/Lh9SLZTbAMCRLE:YPYt24uHRaRDh9SLZTbAMCRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639830, "uuid": "ee000eb8-b37c-4d63-989b-ff21fbe15c25", "value": 4678656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639830, "uuid": "fcea31f0-d91c-4903-b18f-4aaa6b105c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639830, "uuid": "1911d08a-7a7b-43ff-ba94-5ad9058c5e07", "value": "bd60dc5b185cd30c2f8318b46ec0214e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e5daa8-1c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688655329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655329, "uuid": "71065cb8-eb20-4e15-8c95-57de415de83a", "comment": "Malware payload", "value": "91f60e4863245cb63a961923b6522a95", "object_relation": "md5", "Tag": [ { "name": "firefox_decrypt", "colour": "#0FF1AE", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655329, "uuid": "fb7d5736-f3e2-4401-b1de-1daa09ba1163", "comment": "Malware payload", "value": "0cd929f660a012e390c9098f3dc6d7f41ae32f472f3f266d86789e2b5d1ceee0", "object_relation": "sha256", "Tag": [ { "name": "firefox_decrypt", "colour": "#0FF1AE", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655329, "uuid": "4c320bc6-5355-42cf-8736-e4dbd99ac6de", "comment": "Malware payload", "value": "87ec206f5cbe29351579edb39bf966cc1984e9af", "object_relation": "sha1", "Tag": [ { "name": "firefox_decrypt", "colour": "#0FF1AE", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655329, "uuid": "31e09739-f619-4210-b0cd-2bee6a094046", "comment": "Malware payload", "value": "ef18bc7ce3bb51d31a75d0b5ca0b2b449ad10fa701d1979774bb81b5b2ac80793a0acc8e37a595a9f3a0816ba4a33422", "object_relation": "sha3-384", "Tag": [ { "name": "firefox_decrypt", "colour": "#0FF1AE", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655329, "uuid": "b0ab7546-f159-4829-b487-e2348c87e50c", "value": "T1B2F2D813D84A1D22D3836976B4D3D483266DE8472910692839FC835C6F1B9AF81F5EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655329, "uuid": "5c265c93-f6c6-4d34-af91-af88d38b6f1a", "value": "768:5bbgZGdJRa/HYce8EiHSmrFinSpypa0/AkKt3KcA4AdxIp9L:5bbgZGw9ebiHSmrFinSpypXokKt3KNOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655329, "uuid": "d457053e-5807-4a8d-a325-a834c450575d", "value": 36814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655329, "uuid": "73a1d18e-bac5-4be3-ba30-0bbf891385d9", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655329, "uuid": "04ae3fa5-bf4c-49c3-b81c-5bde4972e248", "value": "game.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c85306-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688648555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648555, "uuid": "2a8cad77-8324-4f89-8092-bf05049cb081", "comment": "Malware payload (RemcosRAT)", "value": "ebb60f0ff5d4fb966e59dd5a2104d727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648555, "uuid": "257320c2-2b33-4e84-8033-a8716a292911", "comment": "Malware payload (RemcosRAT)", "value": "0da9e22388ed115d5e70170880ce75efcc2c05be05f720b02e7dbfe351ebe92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648555, "uuid": "2c4aacac-da81-405b-8596-11aefeb77e48", "comment": "Malware payload (RemcosRAT)", "value": "64d7716429399c15da51e05b58c6a4988349aa8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648555, "uuid": "0d6f41f0-1bc8-4932-be05-a1defa67da1b", "comment": "Malware payload (RemcosRAT)", "value": "195245767ecefd7a325967dce1ae35f4cd35206a62dce0c84a764203e4b18e1e2a7d52298a221cd24ad00ce1ef797cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648555, "uuid": "f6d722e0-a74d-4c3e-b639-ca1bf1827993", "value": "T179A4AE01BAC2C472DD7518700939A735DABCBD60183559FBA7DA1D6BFE30180B72A7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648555, "uuid": "2516b326-6b4d-4a33-9646-9ec8c7c8c777", "value": "12288:P/kfNBqpXKbQhqSm9JRxG5K0TKA0s/ZsJRq:EfN8pXKbQh6xG5hTlPZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648555, "uuid": "2f731a61-3ac9-4205-8906-25abc3eb38fe", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648555, "uuid": "2e7f8554-5a06-46b0-9cd5-21fd8a266640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648555, "uuid": "4bf9a669-fb43-482b-b062-e2323699fc6a", "value": "0da9e22388ed115d5e70170880ce75efcc2c05be05f720b02e7dbfe351ebe92a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8141eb8f-1bfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688647751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647751, "uuid": "648a82b9-5b1d-4e5b-a5b3-027ef85dbe3e", "comment": "Malware payload (Loki)", "value": "96581fc52c686a149529e8313a17bd3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647751, "uuid": "d2a9ce28-22f3-4efb-93c3-c15817b54021", "comment": "Malware payload (Loki)", "value": "0dc69e491c783527c6465e25b8b33447391ae9d7ace6e4c1c20db8047aa1918a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647751, "uuid": "4bc37c47-89ec-4bf1-b181-4c5ae6e99393", "comment": "Malware payload (Loki)", "value": "008d4b6ae5fbe9d0bd8a781bf330b80bc75415db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647751, "uuid": "bfa4c7a9-d318-4205-84d8-c3f97b845af9", "comment": "Malware payload (Loki)", "value": "5c728707375c9299a048fb89da159b4142cd8aa2d435f26c9f001acc01937b3f399fb3d741ae29bc524affc297cc4e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647751, "uuid": "a95220c0-70da-498c-b1b6-b3d2b74f4228", "value": "T163D40112393BC35AD428DBF2187554C16378538058F8E76C2CCBA0F9AD3BB149667B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647751, "uuid": "5beeedb7-314b-4d1b-a2a1-6501bab718ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647751, "uuid": "3c23096a-43b6-48f9-9ae0-750c6742ffdd", "value": "12288:AVzC6DCogCRKcdcoLDca/WGhzoIaynuY:inbAWHf1hkI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647751, "uuid": "18f17d53-81fe-4fe5-9053-4895cccc27d8", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647751, "uuid": "74f6cd4f-9563-4b63-a04d-ea3a0230ed24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647751, "uuid": "d170611e-7538-443f-83ba-6a36628d3ba4", "value": "davincizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d993a2-1be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688639081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639081, "uuid": "9449a6df-d025-4ab0-b548-a4b946c57fe5", "comment": "Malware payload (RedLineStealer)", "value": "3a6cfe8e7653ce410d2fc055238dcc23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639081, "uuid": "3c78436e-9a3a-4d51-8c7a-9716955f5386", "comment": "Malware payload (RedLineStealer)", "value": "0e7c8949d1c4baab0bb02d727f8f1ef88db1d81ef769aa3df6d16ef17574f4bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639081, "uuid": "02b5e77c-1e76-440c-8d9e-268b6d9dc8f8", "comment": "Malware payload (RedLineStealer)", "value": "3a4ae20d099c82d8aaa8d1e525bc044e48bed395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639081, "uuid": "31e581f4-dbdb-4052-8d30-4fe3c8dcae88", "comment": "Malware payload (RedLineStealer)", "value": "c5820264c6966ccd4e31e678a91204bed3f4ef1fa7f34bf69174e0efc8f9dddf994ced0d33c275b4db0b8e668073b296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639081, "uuid": "605b436c-070a-419a-9623-ad73cd846577", "value": "T1DC060111214D6E6FE53A363623DC4593F86C9530DB0A0D5522D2ADEFC89DE83FAA25CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639081, "uuid": "9c0f183c-e0ae-40f2-9ab1-c386828d82db", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639081, "uuid": "d9423b8a-7a3b-4401-96fb-1a921e9dcfb5", "value": "49152:difqy3vEO+bJa+tJ9KReTkomjxefV5ddUiyy5X7tB3bTpuL3yMcSt55IcxNr2L10:PyfFzohdFRLzX01ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639081, "uuid": "ee94cbf2-a5b2-4b57-9a41-0fbb3b75b77e", "value": 3795272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639081, "uuid": "10d70f14-d619-41cc-930b-cefc6db2d155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639081, "uuid": "120fb298-427d-49e1-b508-a013979a2846", "value": "0e7c8949d1c4baab0bb02d727f8f1ef88db1d81ef769a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a486fc0c-1bfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688647810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647810, "uuid": "72e34f61-86a2-4fb3-8955-3150fddeffae", "comment": "Malware payload (Mirai)", "value": "cdabbc82eb63acf2fba637de42017765", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647810, "uuid": "f5fde039-f6eb-41e6-abee-3a7c17380f86", "comment": "Malware payload (Mirai)", "value": "0ebb10f67434efa56a0c38ae29832ce7b7bf889a0920f507df25f330450ad041", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647810, "uuid": "daa5702e-89b1-41f1-af6d-1363b8f47d35", "comment": "Malware payload (Mirai)", "value": "010ce01191295ed725a8616293a11132905d83f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647810, "uuid": "408dc60b-31e7-4688-b88a-2ec0bb578839", "comment": "Malware payload (Mirai)", "value": "4b6a21b8cd028d435535e16612d4cc20a26c4b43dea160993ebe721074797e609c45abb27d10d5bcdcad06e449e02666", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647810, "uuid": "3130ca8e-fdac-4ab5-89bc-c1a6df8a76a6", "value": "T10153F8C27C81AA25D7C05777FE1F018D3319A798E0EA73438C191BA17A8ED1F0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647810, "uuid": "68f039fb-26b8-408d-b149-381e8369e8c1", "value": "768:RYinm+8+ecZ2NfGIvLHhYkSGVi41RxmHv6zJpq2TevcJK5VQHiLwCVy/Jx+5H8hc:aik0ZTIv9YkbE41KcmcJKLJeZWW9xnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647810, "uuid": "8dbe0222-b7c2-4c54-8da4-d6b4ed6bf631", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647810, "uuid": "a56c0a40-6be9-40cb-85e3-b46514143060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647810, "uuid": "5f799b9e-6cfe-4b69-88f5-907cda9e7aa5", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea9b95a-1c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665463, "uuid": "1be1f19a-17a2-43bb-a6d7-58f3ccb34377", "comment": "Malware payload", "value": "0f13d26af0c24cabcacba9604bf6862f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665463, "uuid": "7339243a-573c-441c-b427-e81f57da2ebd", "comment": "Malware payload", "value": "0f04e68d258b3edcf493d8453484c8e540a2b4747f1eb761f27f70d03cc7f810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665463, "uuid": "c273d7dc-940a-48b8-8fa6-be9316953779", "comment": "Malware payload", "value": "a533607111d1c8fa8bbc79b95cf6289106b8f2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665463, "uuid": "64472ef4-058e-41c8-9c1d-2db17c11da74", "comment": "Malware payload", "value": "d6593f114166eecbc878b837315b41a954d4258b7300cf7262bb18976e1b633a82a9cf8694241dcd985f55d14b1798a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665463, "uuid": "93d50907-1d7d-4f9c-90b1-8901be656d6d", "value": "T1E6173336B38282ADC495C5F93631B33996E8CE52D4CF954B528DF9BAAE3CB4059033D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665463, "uuid": "a3a87736-05a6-43e2-91b8-0c91360638e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665463, "uuid": "23db766e-ff8c-4766-b39e-d86fe41a74c3", "value": "393216:0CxRC77E1SF2LumzVbugLjS19kZ+L1FVqXxjvyy:VxRj3um5bC1FVqhjvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665463, "uuid": "4b777f84-9c79-485d-a67d-ec9297ec189d", "value": 18826752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665463, "uuid": "b880694d-27ca-4173-9c87-56e90e7195ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665463, "uuid": "55d9a894-b6a0-486c-9b44-04af715d145d", "value": "gakljeqwkfqw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5670b154-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623627, "uuid": "39aaa418-2bb3-40b3-a884-b43b825b3475", "comment": "Malware payload (Amadey)", "value": "94e1aab14bdabba9b6d674340689405c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623627, "uuid": "3eb61595-67f6-4a46-a382-c6525b7dd1dc", "comment": "Malware payload (Amadey)", "value": "0f0eb06f46b815a0a91b226be8f7d71e02127acbe9f63fc370ebc7e440033dad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623627, "uuid": "db8dba23-d38f-4325-8c96-7aa93611fe2d", "comment": "Malware payload (Amadey)", "value": "312d2ca04b9330f57d30756ca17f7511ceb62e88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623627, "uuid": "564c0c64-3024-469c-bfd2-e688ca9735fb", "comment": "Malware payload (Amadey)", "value": "8886339555853152f9ce1f5e44043f87d7f102ebdbfae044e9dfd809374d519a7893118acfc85752445f0d02f98442d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623627, "uuid": "6aaf0190-3640-4622-bbdb-7a7851b94976", "value": "T160160149606D4D6FD63134352BED1993FAACA4742B1F0E0122C2ECEFD9ADD80F69199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623627, "uuid": "65b77ba1-8959-4347-8ff2-113e78aa8736", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623627, "uuid": "1691e334-a3ae-440c-8832-a34762799a69", "value": "49152:3RBTN3JIiW0QsudBoHY6Xp8TbHTb+vBeqgV3tZuigMYI6NLcDe4JHMSrnozGdj4d:FWxxap0R8igM1qcL/nQwMXzrc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623627, "uuid": "748aaafa-a7dc-412a-9aaf-38f73f9e4aee", "value": 4089672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623627, "uuid": "2a833593-d286-4fe8-a734-cc158d0500ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623627, "uuid": "0a4731cc-0943-44b5-8c9a-d8e02fc98143", "value": "94e1aab14bdabba9b6d674340689405c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e94d56-1beb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688640991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640991, "uuid": "6ded286c-8e2a-4003-ad62-30f698110d57", "comment": "Malware payload (AgentTesla)", "value": "9edce3e24cca80a19e1b156d4b29e507", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640991, "uuid": "dbe6a924-89ea-4337-a78f-7d655686f10d", "comment": "Malware payload (AgentTesla)", "value": "0f4265ab37866a573407a69f1d329549f6e57447041207dbd14b966a59dba034", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640991, "uuid": "dea7bb42-2d3e-423e-9892-a406e53d0a03", "comment": "Malware payload (AgentTesla)", "value": "33531d283675f10c6cc10abe82e261eb8375daf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640991, "uuid": "e2d19f00-915c-4ec6-8679-f77157e833c2", "comment": "Malware payload (AgentTesla)", "value": "b298457e747503057aecb9fb6db756b72339b1ec5bd10beb6340657b1ef17ba9357715347a146d31738a0478d54d0809", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640991, "uuid": "b88c7fd8-901d-4c5f-8419-550b2119c5ae", "value": "T1E605125862BB470EC59A7FBC0D900172C7FC2C95B833C21B1FA7A9C9CE267111E86997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640991, "uuid": "3135c482-2569-4e20-aaf8-d90c2d364c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640991, "uuid": "c0107053-26ae-4c5c-b87a-db6e15d22035", "value": "12288:nW+J/M+Jhewx/NscEQ+vgXK1HsaPryU+urlGBRuYRexZ9spiJAXQ0NYHhtHFo/q3:nf/thewlqB6p/uUDwxZNcCC+Ion6ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688640991, "uuid": "79a4669d-feb6-4393-a595-6b5732287133", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688640991, "uuid": "c215fcf7-d694-4404-810b-7ec59f3c0bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640991, "uuid": "14e104c9-717c-4149-8049-fbb300cbc22c", "value": "0f4265ab37866a573407a69f1d329549f6e57447041207dbd14b966a59dba034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c25c517-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678639, "uuid": "734a01f0-169d-42aa-aec3-f3b0ee560f27", "comment": "Malware payload (Mirai)", "value": "5af24d8bbd3660aa901ebb38eede96a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678639, "uuid": "d66c1b53-616e-46dd-b91b-d866b38f26d0", "comment": "Malware payload (Mirai)", "value": "106ee71b79f440f50b04adbcdce8d40853ea8a5da704a4bf7f97a30af1f8cf5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678639, "uuid": "54c25bad-5ca3-4622-a6a4-c99b3253c4d1", "comment": "Malware payload (Mirai)", "value": "a4501146d323ca0a0b2933bf56d82342ce31e950", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678639, "uuid": "3777e43a-c2e9-4481-ba62-a9ca0bdff602", "comment": "Malware payload (Mirai)", "value": "4b2d9210eb4d00d117ea5b84ed87da75663afd0603a7290cc818089516c462810092a6303c19204f0eeeba2090f4ffe0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678639, "uuid": "ccfd7071-db9e-41c6-acb8-20650d385345", "value": "T15593D8C1AD53BDF6D6C3EFF492EBE22856F299051B2A4645F7D89CB0C61B9C83009358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678639, "uuid": "dbdf0ed1-0993-46f6-b6ea-9d2155632915", "value": "1536:0bZyh8B6L3hcXzNwjoVep0WnoqE3EZ4LXt5vPCvC4TTE8Wi39/Rsqxu:0bZp61cXzNwjao3EUZ4jzv6P3E8WY9/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678639, "uuid": "4066e39f-f50f-4219-a7ed-49dc12b5fcaa", "value": 92737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678639, "uuid": "186a4f2f-ab65-4c40-8c96-606c653c6821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678639, "uuid": "88af1798-6e88-45eb-a340-6bbf2f1c1dfc", "value": "i686-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f925d-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677026, "uuid": "9fd1503a-d37b-4943-80ce-50ea0a18f6f5", "comment": "Malware payload (Mirai)", "value": "6a52349440c57542e4b6021a45172e7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677026, "uuid": "f3743d96-f867-42af-a978-7d0ba33133ff", "comment": "Malware payload (Mirai)", "value": "10705dc7b350e532a9063b10f9f239ca1ed273e1e35b35b56a1970044adf18ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677026, "uuid": "9b11ef6e-0e5a-4e82-a2d5-20e9117f1294", "comment": "Malware payload (Mirai)", "value": "9eda5791d16d4443a9d847093bf1347ffc3ae24b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677026, "uuid": "d75fe973-c4e4-4a30-8d1d-dee473d3f2be", "comment": "Malware payload (Mirai)", "value": "9190b1b6920142b64a49373f2d938ccf494a72cd5126bec8759e2648f41827aa41a89505f89aeaacb99816a41639493d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677026, "uuid": "1c81e166-72f3-4ae4-8683-ee4f2788acf9", "value": "T1C6C2D0E0F5586ECADAEABD705CF1D7E2377067C1A2C0CBD120C49B229B0545ED716E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677026, "uuid": "73ad05ca-3a97-4f01-9a0c-bf3189346bd7", "value": "768:9iQLDqbw2DR5C7IW+PQhKnc1F9kGpvOeAAe+2HLpGdy2xqu4uVcqgw09A:9ybwyXCkZYhH/9koBdeTHs8Pu4u+qgw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677026, "uuid": "d88388df-4477-41dc-b7b2-7f0fad1b4fc8", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677026, "uuid": "9e4097f3-849d-4dc5-b1ca-511c23a88d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677026, "uuid": "8669f870-856d-40aa-8612-747aad6fabfd", "value": "6a52349440c57542e4b6021a45172e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca504df-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648334, "uuid": "7e60ad76-9bda-451f-812b-3d023fe7bd58", "comment": "Malware payload", "value": "7054f69beafa8e61633f8fc5e1b1dfd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648334, "uuid": "2647ae5b-b819-4165-b249-18cfcabd72c8", "comment": "Malware payload", "value": "10abc7e98ee0c33b37460e25d8bc0b4f73670956feda2c1f4ca5551ee5c81ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648334, "uuid": "a606b3e7-700e-4bbb-b6bc-2bcee6aaa523", "comment": "Malware payload", "value": "324a13dc83fc2398f2226916a00ba9bdf32c7138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648334, "uuid": "e5d41de9-8b8a-4213-ba7e-2ca5e7a242be", "comment": "Malware payload", "value": "6cd28f4aa7b2319b120ce1ebb58264627471d97af8ea3c33d18586106e0aad6a24770732bb2e914fdb3e9d7ec4e9cdef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648334, "uuid": "20b65550-b46e-49df-9728-c14229205429", "value": "T1C1053A3FF268A13EC56E1B3245B38250997BBA61B81A8C1E07FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648334, "uuid": "90839d2b-f4b2-4249-aefd-ad1fd5e4e731", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648334, "uuid": "945e15cc-a5d5-43e5-81ea-3a4a36c1798d", "value": "6144:YS005y5u11vsH0Db0cHEdzopG5rgfLNWI0bggvVmHuUiVk2yZ/h2kfYYq4qNrCsw:YS8cmUDowAy0bgTziwE3UCuaWRNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648334, "uuid": "f8ce60e1-9c27-4325-99d7-950704574f27", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648334, "uuid": "32b1b529-0180-43c2-9186-16ff61468fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648334, "uuid": "b9884497-f324-4cd5-8ccf-f595db31590c", "value": "10abc7e98ee0c33b37460e25d8bc0b4f73670956feda2c1f4ca5551ee5c81ec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc953838-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648307, "uuid": "65807eb5-fc77-485c-aff1-95784e2229da", "comment": "Malware payload", "value": "199716802e46378f72698f30b59a92c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648307, "uuid": "f9ae321c-753c-4739-9354-b47ef6abd28f", "comment": "Malware payload", "value": "114a504446981106db7363b5d048d8a0d3893a0db3663ee7a91d6dddeee58a4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648307, "uuid": "6f6da716-6c61-4219-a45a-106b8eb5a77e", "comment": "Malware payload", "value": "9bbb720a425edc20255b0d1f55a091a2ae0fe282", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648307, "uuid": "4f652130-e55a-4e58-947e-1d80624a235c", "comment": "Malware payload", "value": "48765918ae8faa4c84dfb2facf3397c83d12418afd219b5a3e64414ecbcd426fdf3fd611df8638f893d8677fcd86103a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648307, "uuid": "02573ba1-5ef2-43b2-aefd-740b1a34814b", "value": "T1DFC3F8C29D537D33C2C29BB5FBEBD14837E35624939B3301A5986FB04B4BACD0A19259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648307, "uuid": "7d9e640d-1d61-41ce-a466-5104a39942e2", "value": "3072:Qk4S5oWmEaArX2AYKz4mDKfG9FGF2RUXyS:gSNmEaMX2uKfG8XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648307, "uuid": "fe0c51b3-897f-4626-ba51-c61dae6b1836", "value": 118740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648307, "uuid": "5c06c3a9-0fd9-4a89-8b4e-2b7619500efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648307, "uuid": "9ebae4f9-ecbf-4ee7-b979-337bdadc9402", "value": "armv6l-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84140b0-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637133, "uuid": "6b15144a-2cba-43d2-a8ff-a3a53f36e41b", "comment": "Malware payload (Mirai)", "value": "935a8185084674e224eec6ac6462c05d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637133, "uuid": "f01486fc-ce85-4d29-8f92-39aed0be32d0", "comment": "Malware payload (Mirai)", "value": "12bb91ae62f941f933a714a62c4d9ff5a9b9566497efeaf76e8a489ff435d409", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637133, "uuid": "c9cdd21a-6ffd-4b42-a3c6-5a160e271e4c", "comment": "Malware payload (Mirai)", "value": "f49e1b37dadd37ed6996ec5c071f190e5b45356a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637133, "uuid": "f4110e95-8147-4d5c-8012-939ac63b37dc", "comment": "Malware payload (Mirai)", "value": "90bcdc398dfb894ab61972927b95e1a9f6f2fa10d6625c9dd9dfdc1dea20dbd841e56f6b302184a1eb0be2362962938a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637133, "uuid": "c699b877-6897-4471-a42e-056f7bfea73e", "value": "T102D2E1EB64BFF277C036B874346011C4FB383913E71D576F09E9AEA859F66812B50A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637133, "uuid": "2af75f29-5b85-47f4-abfd-a0c82e53c50e", "value": "768:DYSoXdJZ5U05VxmHSSc+H2c+lPbt1Sx0sp:DYJdJZ5UQVH/+KRgtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637133, "uuid": "8d6dad6b-b36f-43bf-84ca-1212649d1f70", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637133, "uuid": "a66e5e68-5369-4f21-a4e6-95a60bb261b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637133, "uuid": "99d0d253-f396-4209-8715-22e0cef2c9bd", "value": "935a8185084674e224eec6ac6462c05d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640807dd-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688622791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622791, "uuid": "5d989283-91ec-441b-b39a-aa981fa11402", "comment": "Malware payload (Mirai)", "value": "d3a538ec8296efb5b5a9cbe3b3568552", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622791, "uuid": "4a7318d6-9b24-4f28-9188-0d6de9f9fd25", "comment": "Malware payload (Mirai)", "value": "1332d3386699d436c4d777e20ebf8a677a2efc7aa4fea3e969ef39120d4496a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622791, "uuid": "5e3929ad-129b-4f02-9629-2778e3fb36c3", "comment": "Malware payload (Mirai)", "value": "b931ff093c2358f1c9df6b4cfc0fa29bbdfe4ebb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622791, "uuid": "dc5138f9-9457-401c-907e-83e9c3c666e5", "comment": "Malware payload (Mirai)", "value": "d85ec3d9ac70922fb7b217dba796e711a825050f138877674bd74034dc4abd1a6b500bb620f8a14509019f1269cd6832", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622791, "uuid": "105ea80a-f8bd-4f6c-9b69-b03940f9a0dd", "value": "T1EF03F2D5D69DA853E3AB1A32C97D494BB3049DBF61F03B6452304748BBD1E87462C863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622791, "uuid": "db2d30db-31f3-4753-b4b7-f4fab3054560", "value": "768:+bxiFIdF4KTNT7j5gcIENCzY6vbZyeCAPSpv2iBkdRzUq3UIG2yB:k8FInzTfgc1NePbdXa5Ez7FyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622791, "uuid": "78935d64-9acf-44b9-8930-5eeaa07210ce", "value": 39272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622791, "uuid": "c5c00607-5289-473c-89d7-a71368b80914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622791, "uuid": "74d94a2b-b752-4507-88d3-04df5d1993cb", "value": "arm6.nn-20230706-0553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59172544-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688642959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642959, "uuid": "a8f82d37-0ec1-468d-bf62-1c052718dd11", "comment": "Malware payload (Formbook)", "value": "6d594b093b4d5aef208807fcebf40e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642959, "uuid": "034ac90c-a4f9-401f-bf35-227f6c02b4e6", "comment": "Malware payload (Formbook)", "value": "136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642959, "uuid": "8a65e5ad-03b6-43d5-a9b3-8294c42015f1", "comment": "Malware payload (Formbook)", "value": "dcb78d2eaa1f882f3ab142e11844bde48f1c6834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642959, "uuid": "47f9ba8e-947c-450a-92e0-09dd5e5e224a", "comment": "Malware payload (Formbook)", "value": "d8002f3b6722399387a39b46959f7687793ad356bded74e53c30d92192d67f2abcac59a741c13e066438d11e65ce16e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642959, "uuid": "2f403ca2-9d8a-43d2-a7a8-5bacef6925f0", "value": "T168F401A833A7611ECD6E7FBD0C9607B8C6F8BA063517C3878EE3655DDD18E448A40267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642959, "uuid": "0731c9a9-fa31-465e-96f9-699875c03b7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642959, "uuid": "b802e0d4-120d-4b12-a67e-b9a796955436", "value": "12288:/d6L7PVYfgiKbhaDnLMzIL2q+RTdOL8c9Ve20pNiWtvGQAPpPM89ztTVqvbTlTPe:IOyqGUL8cmNrtwP95zRVqv/lz5iQ5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642959, "uuid": "75057106-1f42-4b51-af93-9bbfc9434907", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642959, "uuid": "8a8fcf9c-72af-486c-a724-cd3c930064ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642959, "uuid": "412dbe37-5d9b-4217-a25d-06b41067d015", "value": "136c006862c2262205fa40f61daaf18a5d4209bebc0236d7c8743ec554d0482e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62390b0b-1bd7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688632237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632237, "uuid": "9faafabc-75b4-4975-9974-5efd4874b309", "comment": "Malware payload", "value": "83e019c98255f9f96dc6ff7ed9de27a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632237, "uuid": "bc41478a-7af8-4ff0-b7cd-3f689cb9ea74", "comment": "Malware payload", "value": "13a1952f2169d11262d09b55e4ee637375cb283146b54de38a164e6f06661542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632237, "uuid": "dd2b7c6a-557a-482d-923f-ff52cc564e51", "comment": "Malware payload", "value": "059aa111ccbfaa1bd127f8ef83038702a6ceb459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632237, "uuid": "6e12e97f-f680-4693-970b-5cacd8d5c542", "comment": "Malware payload", "value": "f8e81e32c3b0095870043db699c6ecc8cd2aabb77fdf150ba5d6021e2ced88c8bc11ef19dc28f74704b0cc0b02876ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632237, "uuid": "f78dee50-3a06-48b8-bd1e-e10608a4171b", "value": "T163A423A36F1918B6CA9087300557E531B768F836DCD14E4BA478E49F2C6EB607E96C3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632237, "uuid": "396ae9df-c9eb-4f77-8ee1-c15d17f9c90b", "value": "27dc0f4c205d130a62467054fe8065d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632237, "uuid": "2b50a4ce-4129-4654-a023-d27971fc4201", "value": "12288:u2d7dqQUFtZ7/Bj1fkTzFUqBo6WJ4XB5QpGHNu44nUyv:dRdgY15VxZI4Hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688632237, "uuid": "51405588-0eb4-4948-867e-efccc21d0d2e", "value": 484904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688632237, "uuid": "6529abdc-6ebf-4330-b4b5-def709441890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632237, "uuid": "bc87ea94-5a1a-4c02-b3c7-78dc1b6ba629", "value": "F3369B39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c33217f-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688641327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641327, "uuid": "326a9e76-4b2b-41bd-b241-bdc4a3954a55", "comment": "Malware payload (RemcosRAT)", "value": "63a22deccf7a8916cdf1dd0e633393e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641327, "uuid": "3f30c1d7-7728-49c9-b7f9-aa1241898f71", "comment": "Malware payload (RemcosRAT)", "value": "1441b168107cb5a38d4ef470b80e7a68c215732d74409f97461076ae0a3b43da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641327, "uuid": "c98a797a-42fc-494c-825f-49ad3bdfc628", "comment": "Malware payload (RemcosRAT)", "value": "eeb2cf0fa02aee4a59357361f68108e873b07994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641327, "uuid": "c581c980-8391-4e2e-83d0-551b66f37ec0", "comment": "Malware payload (RemcosRAT)", "value": "2a1228b24259e7092f301b1c10efb33cbce0a62c2858f2eba890f99efb367e87fb0c2c44db8a85525203827373ffdbd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641327, "uuid": "628ff506-ebcd-4a19-a37d-101b6fcda893", "value": "T14535126873A6A40FC82DAE3C1D4A67B9D2F919D27052D3835EE7788FDC5DB8D5A00183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641327, "uuid": "cd9bd23b-c95d-40d7-9810-4392bb0f16db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641327, "uuid": "d315dc91-0c3d-4299-b374-9d46c0b16e5b", "value": "24576:HpQOyqGUL8wWJgEOjS3/KCsvEFbH/oFLFt9pCP:aNqGo8cEmSPqM1f2r9pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641327, "uuid": "9ecac26f-46d3-4571-8279-56fea46640cb", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641327, "uuid": "3d008c82-8876-4f97-b078-75b325c963b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641327, "uuid": "624a31d7-806c-4c7c-9402-c3b93440877b", "value": "1441b168107cb5a38d4ef470b80e7a68c215732d74409f97461076ae0a3b43da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e77ec2-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688651896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651896, "uuid": "e7b25858-9226-4ba5-9d02-f796e1e91728", "comment": "Malware payload", "value": "1a5a07479f497aa1db945de48ea85de9", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651896, "uuid": "4dd129cb-c9f8-4910-b5d8-30cc287d9291", "comment": "Malware payload", "value": "149784b07294ec991db4ed913ff726a602d6e071899ddb051a05498a3790bd63", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651896, "uuid": "30f5dd97-fc06-421c-b417-9c98786b9c08", "comment": "Malware payload", "value": "294392bcf166953c552443fe95ba1e8f15487f74", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651896, "uuid": "67e60a94-1b5c-42f2-8fbd-4cc7ee1694a9", "comment": "Malware payload", "value": "96afa4f9bbedb695353c0da885ec98e95c3e4203459b904c71337b7287197847e3a9bb2cbef401477f8d71f002f118f9", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651896, "uuid": "f30fc2ff-a69a-4188-a73d-00ad2e17706f", "value": "T12F867C27B9A05924C29780304AEF57A25B31F9354239EEEF2375E7392F22C16DB5D306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651896, "uuid": "f697d3c6-dce7-4da4-a56b-e7f956b3f598", "value": "98304:1riXe5vyBLPFzng8fqo5Ab/iz62ZSPBXa6SPX:UOo545Xap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651896, "uuid": "eea857b4-6001-4f33-88ce-11ab33aab896", "value": 7843456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651896, "uuid": "7125b861-3e91-4943-b4e7-a67d7fce572e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651896, "uuid": "12e64e5e-3ccc-4022-9e93-3c4766bb40b2", "value": "PearLand", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef72548-1c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "01c0a501-0f2e-41e1-a5cf-465f35b25689", "comment": "Malware payload (Mirai)", "value": "3aa23b69effbd3883bc383d860b27b1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "2a16e121-d4b3-46a0-bd71-9e27e7970582", "comment": "Malware payload (Mirai)", "value": "14eda020db007e7ca2c9746aa26cbafcbe01e146fe2ead060d7d7de28ab41032", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "ce945119-9515-4162-a3dc-596c3f474cdb", "comment": "Malware payload (Mirai)", "value": "0f98ca258f30ce6cf4d68d7fa3e6f24f095e23e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "b7861b0e-39d3-4d2f-98a9-5c1eabe59889", "comment": "Malware payload (Mirai)", "value": "36a99d0f714d2ba8198e4f6187e60509e1f29a9312cc55d8a49e432768fb640ed71c3c1008ccbec4a1b63b8dfc8bfe63", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676604, "uuid": "7c4f3e42-32c1-4f2e-bd70-29ee6642690b", "value": "T1B833F1B1EB5F78F15A30593BCB251D12B059B2B461EB737EAA25E9E708C24030CA175B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676604, "uuid": "21ce0a95-44ad-43fc-a581-c5b491b1416c", "value": "1536:TM2aADOmAq8iIkoS3lpr3g10fDL8PqF1aBexo4W/vT:Tzl5l8zSVpk1sDLmqFUdvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676604, "uuid": "530258f1-da56-4674-b528-c62be1ad974a", "value": 52552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676604, "uuid": "deaf546f-ec47-41c3-880b-099984ce51e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676604, "uuid": "296d89fd-8cfe-4a40-aeb4-85cdbbd9691a", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78957fe-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638420, "uuid": "c891c207-216a-47c3-be10-46d98fc7c2ac", "comment": "Malware payload (RedLineStealer)", "value": "f39580d308708fa451880052f772050e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638420, "uuid": "205721d1-3c8a-4aa4-8a32-db52a9568a15", "comment": "Malware payload (RedLineStealer)", "value": "15e96daf20e993e6bb6d3b8ace0b4e7aac093120b155f626b4e2f96739f5ae31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638420, "uuid": "c83bd326-54e4-43d0-84a6-f15675effcc0", "comment": "Malware payload (RedLineStealer)", "value": "6d33624a8f70212c449ed3caa7600a20a1d3fdc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638420, "uuid": "0d2a643f-c9aa-48bb-bbee-487193304eae", "comment": "Malware payload (RedLineStealer)", "value": "9c12c9b0a361c81a2d5abf09c18ba35c3afb5690c954a9d1c50b1a1f43fff23f5bf83526618e545de0a4ea68d8e1d16c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638420, "uuid": "0cbe3b8b-f24c-4a09-92be-b9ce47c39f6f", "value": "T1D6060101219CAE5FE43A357573DC4953F92C60B0EB1A0D4522D66CEFD8ADE83F6A648C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638420, "uuid": "c0cc5be6-6c82-4887-8184-d51033cc5837", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638420, "uuid": "ca79a3ab-ffd3-491a-8cba-e880daaf5e73", "value": "49152:7+fTFKjd4XZvdYBHDxEgLO5n15wVAevJLTVTEmH67JE8DeFm9tD0CXm2LPkZiCYf:MEA0JfdkZDtLD9m2LSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638420, "uuid": "fa6a0dc7-d3f0-4df0-bb40-442e01ae24e2", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638420, "uuid": "52e4838c-63a6-47dd-8a96-4a7453fcc38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638420, "uuid": "0dc98ad3-3d9b-4102-8631-a236ae86d100", "value": "f39580d308708fa451880052f772050e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a695f9-1bd7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1688632244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632244, "uuid": "1c9922dd-41c5-481f-829f-0d751f15962f", "comment": "Malware payload (Cobalt Strike)", "value": "e34a1b007a4d634e4dbb350f632f2c5a", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632244, "uuid": "bc39ec67-e5d6-4933-8b8b-5f4ebf3cdda5", "comment": "Malware payload (Cobalt Strike)", "value": "15f10df4cbe41600513bfe4b1d2bd1acb15e7fa226bce2d5fe8675787019de52", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632244, "uuid": "2c6a063e-238e-4dec-b931-1393f82a4b73", "comment": "Malware payload (Cobalt Strike)", "value": "5cb155e3a8ae9a8d65ce6b4cdac7ee5828d4c16f", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632244, "uuid": "0a4fef86-da2e-4e6e-8643-ada54246696c", "comment": "Malware payload (Cobalt Strike)", "value": "24c8e5d40d51c19ed968701f97e3e4e14e90f7b6087e49fb26dd8275dc928d51aa0ff0162daa7a034ab64434cb9b23b3", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632244, "uuid": "641f7a51-e26e-4eea-adc2-eab4f4ac368b", "value": "T15F85A50AB6AE1181E475C0F6A09231E9BC75387D433492C366876A793660FE49FF9F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632244, "uuid": "59e1b8a5-84fb-4fdd-ba21-684ef520e404", "value": "0a782e4781b2a67bbca2432a97b09d39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632244, "uuid": "0f46d374-6335-484c-8e33-db3f401b1f62", "value": "24576:/71U9t06QeLLeWdONm9ljT1qsuaOH6j6m6:zC9t06QCeVmBbuzM6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688632244, "uuid": "4ebf967d-61df-43ac-ada4-787976161960", "value": 1870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688632244, "uuid": "ba3cfafe-8579-42df-afd4-813f97b4d192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632244, "uuid": "6808c078-d761-4189-aca6-f038e131e433", "value": "75280A54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d0ca91-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688654074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654074, "uuid": "0741fd80-b03e-4027-8e7d-c9158f6666f4", "comment": "Malware payload (Amadey)", "value": "53a9231b11e978b952ddd9c2338df933", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654074, "uuid": "4297c47e-dacb-4cd5-8ca3-a9d76878ef69", "comment": "Malware payload (Amadey)", "value": "160caab0601980fc428c13a1d1359ecf8073ac542dd27c64be2c12a11d58a24f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654074, "uuid": "6b7b13c3-9d3d-4931-8261-1f408e321620", "comment": "Malware payload (Amadey)", "value": "e78245faaec716883473bd254a9d8b684ef1aa02", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654074, "uuid": "dfb3fdec-5f6b-46cf-86c7-afdd95db54bb", "comment": "Malware payload (Amadey)", "value": "cc5c5126b7bc90bdeef9545217e4331bfb67d4c9f57f8330f719935fae6ac58669b7a05fd775abeb5de7caf090053c52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654074, "uuid": "8118a632-e94d-4c64-b790-fb4d4c42cea7", "value": "T1A7B4023339609953E08AD9309A7645C1FBF9E3A53BB255DB766DE0356F832D0C33422A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654074, "uuid": "86132660-a2cd-4c5a-a2c6-841780bf355c", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654074, "uuid": "bccda287-e58e-413f-8e0c-5e99eec4c3d3", "value": "12288:zq4ufvYaRdnQgKSOzQeRZWfhZM0R+kBvR0El:zq40vY82gkzBQT3ckpLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654074, "uuid": "48cce257-90e3-4fdd-969f-772329d79312", "value": 513864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654074, "uuid": "cec63634-7ecf-43c1-aad9-8133f03a8491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654074, "uuid": "3160c09f-1816-4b8c-af6e-2ca9c53cde1d", "value": "53a9231b11e978b952ddd9c2338df933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29fcaec-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624319, "uuid": "1cfb4594-8934-4a5c-918e-27193f5956cc", "comment": "Malware payload (Amadey)", "value": "e76ab4fc6dc5a936319a6a91655b895c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624319, "uuid": "22920c65-b69c-495f-a520-c954377b8dc1", "comment": "Malware payload (Amadey)", "value": "1625a868f2b4197a81fe2c196ed749ffda1f8870d1f2112cfda992dbc19618bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624319, "uuid": "f9096abf-fee1-4727-83cb-ee161888aa55", "comment": "Malware payload (Amadey)", "value": "a0d6810d9a3657221f98188bd370f1d1db868cdb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624319, "uuid": "f7d71198-b1e1-4290-8215-ef6bea2b4898", "comment": "Malware payload (Amadey)", "value": "08a03047f9d44608e3163fe94a8dd1e92b37dfefa2b31d726f9dd7ef90442711e770318b247b9e8bd2ed45fa0e59103f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624319, "uuid": "1b9e10be-e6cf-418b-98f1-6db073148cdf", "value": "T13B060111254C8E6FD03A793A77EC0867F96C5574DB080D4626C22DEFC89DE83F6A668C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624319, "uuid": "de4bbe9e-eaaf-406e-ac75-8cd2d0cf2fa0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624319, "uuid": "25759210-ba4b-483c-9913-c71fc5643f1e", "value": "49152:RfqFL/mq9JIHW8ezhhC/KuD1ZuvCnRJ+ApfJU5g3kMwLK3Ok8ouT/+JFF3KLi1kf:lqF38hDv0nUz34mcFZRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624319, "uuid": "935ecf22-430f-4879-83fa-63a20883414c", "value": 3763528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624319, "uuid": "7122024e-5d1a-4ec4-8d28-47953efd8ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624319, "uuid": "c8c223f6-923a-45b6-a96e-22bfee4266a7", "value": "e76ab4fc6dc5a936319a6a91655b895c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3add85-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688642995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642995, "uuid": "caad5e1a-5f2f-40b9-9004-9e67efe1f447", "comment": "Malware payload", "value": "d9f4a8810aef5e965f14905fde44759e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642995, "uuid": "a43f5d2b-4fcf-4089-90b2-49c112592226", "comment": "Malware payload", "value": "16666075be895ff3160f0661665abd1622b104da6f6d6cf3ddcdc0cbd946740c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642995, "uuid": "6ddf13cc-e907-4f0a-9424-632118a9d123", "comment": "Malware payload", "value": "888737d2996750904e305caad63ea112875a5b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642995, "uuid": "3314c1c5-451a-48b2-ba89-f3f0f08d4adf", "comment": "Malware payload", "value": "396fd7f74cf2cc0cb1b9d2e8619bbc4d43ec20ba3fc8f8c4610483c0ee6bec7687766cbe02cf8e64f143ec856c9f3071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642995, "uuid": "b2f1c94a-4504-4e9a-92a1-c9e810fe78fc", "value": "T1C0F59E217E4DF47AF5522E31C9999778B256AF603A3C020711533AFAFA30B419938DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642995, "uuid": "d8473ed2-98da-4e22-b41b-acfbb5f78865", "value": "13acd8bd1035fd8e1cc12c1d3b481dce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642995, "uuid": "02feadd2-774b-4ddf-a8bd-eeb75077ddab", "value": "98304:yQCG0BbbgZeY2qAwfdaTgNoZzI+ZGcjASPuUlO4OiZrq1DfPHNADtV6v+mc/:JM+eYIrTsoZzySPuUlO4O7NADtV6v+mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642995, "uuid": "695f2539-d7a4-4e2a-b018-ca13e80a8c44", "value": 3559960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642995, "uuid": "0e2b039b-0afc-4a1c-a9c5-625a5d7ec0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642995, "uuid": "da6e041e-07f4-4bbd-a5e2-ba17e1404c63", "value": "F2FF0FC7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95d0da8-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688652113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "9611302c-2803-4ad6-a82e-77feecce0a96", "comment": "Malware payload (AgentTesla)", "value": "fd474eb491bbd805597c2d6f9df3ed32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "40664782-ff17-47be-a0f7-00ef610333ab", "comment": "Malware payload (AgentTesla)", "value": "167aef05154cd6d6aee1e044770d579f5fe29433cf451bb1b7afb8054f214fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "bd562286-1cf9-4311-af46-03d9f3c2db3b", "comment": "Malware payload (AgentTesla)", "value": "6e6d414ed2b8490f43e6970ba316f89fcc28fbcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "13da9a32-0c8e-46a7-97ca-4141fa1947a3", "comment": "Malware payload (AgentTesla)", "value": "2b95340464a2faa9eb341cc42bab2658fc04c002a46856741bb2f24d4ae4a56f749d2572021c11809ca3088beb6a6ffb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "516ef6b1-3042-4c8a-81d3-a19f56a92750", "value": "T14CD4E0013AB79B52E179C3F639B210402BB5365A24BDD22C8DC7A0FE5976F0156A3F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "17ab21aa-a4bf-40c6-b094-3ff205a197ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "f967c036-a0cb-4aa4-8925-b37af3100042", "value": "12288:kqjd92I/xpa10mkTY7MZmOXTu+AXM7h7e2N:Nr3aWl8IPXTcM7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652113, "uuid": "1a02482b-acbb-4a1e-b134-4931beadeea2", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652113, "uuid": "db641dab-4392-4ff8-bfc9-dd13c9c4f6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "c6ac5398-bf78-4bf0-8684-1423a61ff782", "value": "z42CVLicHSOlivettiRenzo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54004c6e-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688648534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648534, "uuid": "d610f2a7-9b4f-4947-93b3-41b4963ef004", "comment": "Malware payload (Mirai)", "value": "562a8347cd09f291099587c8ff276378", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648534, "uuid": "63279535-fb9c-4c37-95dc-203cc6013ca0", "comment": "Malware payload (Mirai)", "value": "179d4437ab3e35c36595bc6cddcb5fe8468083a0e8b051748681867c69f402b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648534, "uuid": "b4194258-f1b6-4a38-a3ac-8fb52a9765a0", "comment": "Malware payload (Mirai)", "value": "bbce8329884c07c538f131116960ec98dcff3982", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648534, "uuid": "7e15c147-d653-4e2a-9730-438626cea650", "comment": "Malware payload (Mirai)", "value": "6afe6745983425d0d937150783ee571ccb40ca6b68335c109358adac68707f3ff948279ec2259fe0867053691b42c5db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648534, "uuid": "9924fb53-333f-4856-b5b4-3e25d9def555", "value": "T1EF439E65C9A89D64C21845B4B614C53DD323E404AAE33EF6CA46CA5AC06FFECF0997F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648534, "uuid": "35e9fada-24af-4869-ac5a-c3cf567d5a3f", "value": "1536:J/At4MX2Ma+Kb7gv7V2ppfs3Gd4o+kwfzPC3E2:JYtN7d0I7V2Tf+A4o+kwfzPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648534, "uuid": "4d8e3c00-915e-4bf2-93d8-138e4ec7ad72", "value": 59644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648534, "uuid": "78436403-2eaa-45d0-89af-c68c9f7dc75b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648534, "uuid": "59ed6f12-1ff1-4b57-baa2-d3d846271f5c", "value": "562a8347cd09f291099587c8ff276378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104d602b-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638113, "uuid": "4152e12f-cd10-4bc4-a4c5-11118416a596", "comment": "Malware payload (RedLineStealer)", "value": "c13c90fac565b4129ff3a7ee5a5a7613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638113, "uuid": "f37d7e42-9b3c-410e-85df-c3ccfb396011", "comment": "Malware payload (RedLineStealer)", "value": "1842efd149cf3f8d5d07c0ce3a7c04ba5df6bc9dce237ef4e2f2baaf51544540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638113, "uuid": "a41f0704-dad1-4dea-a1cd-f66b75c34a43", "comment": "Malware payload (RedLineStealer)", "value": "c81307e53d20ec3d2194799fbd0b09d4f290fd5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638113, "uuid": "8ba547d5-ecad-4976-a0e3-51f901e984dd", "comment": "Malware payload (RedLineStealer)", "value": "8f039b6ef757c384d78c6baf87b8b090b7727bb397f626a71f15dba40649c9929c79d8de1baccd5910163f13d707bc98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638113, "uuid": "2fb2943f-7793-4ae7-b17d-999d0930dda6", "value": "T15F060102259C9E6FE43A353533DC4957F86DA474EB1A0D8122D12CEFD89DE83F6A648C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638113, "uuid": "d3739e5b-8a9e-412d-86bd-2b4e447dc812", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638113, "uuid": "9da84480-ef66-474b-90be-5391ad4cb124", "value": "49152:M+fTFKj54XZvdYBHDxEgLO5n15wVAevJLTVMOhHLpXu1mM9pbtaio2FwmnbmriO7:LEA0Jfn9uPFz5zwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638113, "uuid": "2ea4f7da-d7ec-4e61-b02f-6e8b347b2fe6", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638113, "uuid": "7ca727e9-f884-4723-8f3a-3b7984e5c250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638113, "uuid": "2eee33f0-dfc6-4e6d-882d-94dd0a64cf51", "value": "c13c90fac565b4129ff3a7ee5a5a7613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25c467b-1c21-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664208, "uuid": "f9bdd8f5-1498-441a-85dc-36b7baf0110b", "comment": "Malware payload", "value": "1bd5879fca03e9398079dc4ec9789c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664208, "uuid": "7fb55246-ffb3-4680-b5bf-aac71d3c6073", "comment": "Malware payload", "value": "18463a1b8830da861b3a7ce1926abf1c4cf77663b3b8722103a21dfa097f08e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664208, "uuid": "f079c8b4-965f-4d82-8db3-172ae13b6b11", "comment": "Malware payload", "value": "9df9d7a04254191d5e38d04f06b0b8256202956f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664208, "uuid": "06140fb7-b9aa-4090-b199-232b3fe9b323", "comment": "Malware payload", "value": "90ded86bed18303ef2832529e716ad03a78d4aa0d56fe23db52d197c1a24ab6536c7d34a9d41f2812b209a36cfdfe14e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664208, "uuid": "b83005ab-6215-4e5d-992c-33c39a988c53", "value": "T15884231CB191D193D9734B363DB9AD2ABAB0AE2250BC4F4B27202FB77E11956D41C363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664208, "uuid": "55cf4d5c-dab0-45e8-a911-47fddf2f05c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664208, "uuid": "a9e91cbc-cce9-461f-903e-d706c433c016", "value": "6144:/Ya69ldN/GtkYtEqr5ik9JEB+v0Rlq5mT9LdWRiCBA7Uk+XeXLaTSP/2O+gzzTV0:/Y/h+tYG4kr8RI5mTdd0BqUrXeb6G+Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664208, "uuid": "2fe0351e-c838-487e-949c-d384c5f754f9", "value": 383329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664208, "uuid": "802956b8-b3c8-41e7-aba9-44dacdf6241e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664208, "uuid": "c35d98b7-6a72-4067-83c4-b0b200d94733", "value": "win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be17b9f-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688638132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638132, "uuid": "d9958232-813c-4fc4-af67-e7800e92f44d", "comment": "Malware payload", "value": "02229cb2a502ac01aef1830222b0f7ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638132, "uuid": "3d0af455-672b-4c26-a78d-db77fe0316ae", "comment": "Malware payload", "value": "18845ab122e5d7f1672b1e464920592723c772a890f976b133fa4b239e94b76a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638132, "uuid": "c76ce2ae-13b1-4b0a-a1c7-9882b506c213", "comment": "Malware payload", "value": "0df079ed882faf398519e7e594436c735a66944e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638132, "uuid": "77656171-5ea0-40a7-9596-a3ada10ce4ff", "comment": "Malware payload", "value": "7d6547ea7927be6860d3e4b7f2ff4928f5bc67c36944ad60fa591a2725e0dbea6228149ecf1a4945a683f9239c3c7c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638132, "uuid": "b4ed197a-cfca-4250-826f-45517012890f", "value": "T1C63522A925FA450ECA6A7FBD0C010BB5D7E8489574A3C0178FDB6DC9DE06F114CD88AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638132, "uuid": "3878ef60-2019-4bf8-8cb9-da0eb81e2f22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638132, "uuid": "b5d71245-d4d7-4b3d-9962-1214305c752e", "value": "24576:CF1iewlqB6pYs7jd522u+apCubJJxj+elJnbIE3vB94:CFQe2q8pRPYljd+ebIqvB94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638132, "uuid": "572fc980-7e41-4660-8208-5ea9b37a4a99", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638132, "uuid": "ae6511b5-7272-4417-acf3-3d52b5d7f947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638132, "uuid": "f9ae86f3-78c2-4a8b-a804-1646a6700d1a", "value": "18845ab122e5d7f1672b1e464920592723c772a890f976b133fa4b239e94b76a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ce2770-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628181, "uuid": "7bbc8560-1c62-46cf-80bb-5893fba7963f", "comment": "Malware payload (RedLineStealer)", "value": "de3dbcd969c5c1eb35f8ca23ee70bf2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628181, "uuid": "d663b1e4-11e8-4e54-acd7-1fd70050f258", "comment": "Malware payload (RedLineStealer)", "value": "18a220cb9e0681741d28e3a1a8baa5821937f22741246e3e59a661421c540ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628181, "uuid": "fca8b52f-3eda-4c01-85f9-32ec2dae913c", "comment": "Malware payload (RedLineStealer)", "value": "3c62f20914506e7f0147c1aa311ae2e520ca1e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628181, "uuid": "0a0333de-991f-4ff1-a052-7fd952d7b874", "comment": "Malware payload (RedLineStealer)", "value": "caa98472e8879e2b6ffc79e2f714709171c9332986fb55dea3d1250ce96aa42c2b5d7ff0fb6f3af5575a66ce39f98c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628181, "uuid": "0ba843ad-9a06-4c6d-b3a1-b2a814194419", "value": "T1AC55BE05A09D1D5CC672E7B2BADC23523DBC8474291DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628181, "uuid": "c4984a9a-7898-45a5-8ca4-b833c4d87883", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628181, "uuid": "3331e5f0-c66f-4e2d-8293-bd827fddc836", "value": "24576:/Ei2dGfYU5xpaCozrddBehxOFEYjIj2l9Vu2:/Lg1CujB6AEYHPVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628181, "uuid": "c9ddfe4e-ac0d-421f-a996-281378ee23af", "value": 1343818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628181, "uuid": "6ce21a95-7861-4cb9-ad0b-a14cbbb462d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628181, "uuid": "1cbf0539-db20-47b8-8cfb-de77ffd3118f", "value": "de3dbcd969c5c1eb35f8ca23ee70bf2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98b52b0-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623418, "uuid": "f6dc4667-51e2-434b-ae1c-5f4c1dd673dc", "comment": "Malware payload (Amadey)", "value": "71e1b5011945c959b7e8d61b4140c326", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623418, "uuid": "d2cc2d67-6702-4f7b-aebc-920446ac6196", "comment": "Malware payload (Amadey)", "value": "18e9e5792184c5cb388082ec82eb4183fb8707029d32b7b0575d52861589245d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623418, "uuid": "f942d682-6921-46cb-bdc2-0bf2d320896e", "comment": "Malware payload (Amadey)", "value": "1c1639c2836e3a2d936cc22f123b00cdec623631", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623418, "uuid": "19c7468e-96a1-4c88-9813-50534368e5c5", "comment": "Malware payload (Amadey)", "value": "f8f0b38b277dcfa34d9598ab812b7a8bd5c030ec1cda19773c2bcbb1fce6db418335c9be77436d2da83a3f2fafbe85b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623418, "uuid": "72612385-f36f-4494-aab8-5a356f089fb3", "value": "T18416015A602D8D5FC63135712BED1993FAACA4702B1F0E0122C2ECEFD5ACD90F69599C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623418, "uuid": "b09929c8-c279-4076-a54a-48743b858dd0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623418, "uuid": "379e3847-f979-4617-9cbf-f2abc732a7a6", "value": "49152:/a1GQ95eyK7b4u7mOFkb7G2vm6FDg5mnPz+WN6/LfRSIerx9t58q75xvHjUZ9LNd://7LIpPKT5rAk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623418, "uuid": "887416a2-686f-4b56-859a-ebae568ca2e8", "value": 4089160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623418, "uuid": "fd6ce946-9330-4ed2-bfc5-08eaf9005266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623418, "uuid": "d6e316bf-355d-4b46-ba95-1dba662a604d", "value": "71e1b5011945c959b7e8d61b4140c326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54795b4-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677017, "uuid": "a5cd9837-d592-4c72-86e0-61a9576d557e", "comment": "Malware payload (Mirai)", "value": "d4b48fe08680ab4b21b4cb21aecb5eb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677017, "uuid": "762afec8-8c64-4b07-a628-8e2bffc20096", "comment": "Malware payload (Mirai)", "value": "1966fb63a9864fd5d5f6e2e467e29725c2cab52d8755d5332782fb8efc7e1c0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677017, "uuid": "2fd48ba7-9842-41aa-9253-1dec6810199c", "comment": "Malware payload (Mirai)", "value": "44ca9005284cf6dd5ce58aeb9dcf39cd7ec05b5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677017, "uuid": "d65ec79c-0b9c-41e2-8ae0-adee106b7a86", "comment": "Malware payload (Mirai)", "value": "36faebc9c55d10d2745825bdf62c3378d73fb5c7e40d4610b3876c8736d685dd7ff2b3d0cade2663fd0585c19d6254a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677017, "uuid": "eb6f3fb6-ad17-46a5-8e96-f328d9a90094", "value": "T1C1539EA5C5ACAE58C61441B8B954CD388723F408A5E72EFBD646C796900BEFCF1187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677017, "uuid": "1f3f85be-3afb-4ada-88cf-7b64f55d4237", "value": "1536:PXaA1Nnzd/mUUV7tiYmG6mZSjs7Iofs3wXxrlzN0Z783Cz:PXv1NzdeUUPw94GMxf+whr5N0Z7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677017, "uuid": "7b88b270-bdeb-4a3d-a301-440e46d85cf1", "value": 63764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677017, "uuid": "81137dd5-9ccf-402a-8b91-e0c4524e7642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677017, "uuid": "fe22fb6c-566e-429f-a625-54afe56a8804", "value": "d4b48fe08680ab4b21b4cb21aecb5eb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bad9d8-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624222, "uuid": "5bb81c8d-45ac-4f01-9393-bf9158322f05", "comment": "Malware payload (RedLineStealer)", "value": "cab531e24fc48dcbe7d62fb35c049200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624222, "uuid": "36ed1fba-c8d4-4e2c-b0be-2df121ee3268", "comment": "Malware payload (RedLineStealer)", "value": "1967d510f8383dc2144ac0fd4fd6fea47f0e2fbc5d8ae9c5a991bcd6048124ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624222, "uuid": "033069e2-20e5-43b9-921a-25a50ce44966", "comment": "Malware payload (RedLineStealer)", "value": "5d1d9e676cd1f73b34d8385d13aab6e41dbc88d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624222, "uuid": "700e1939-fef4-4c8f-9543-89079c2d1963", "comment": "Malware payload (RedLineStealer)", "value": "ff2404166da3256dd9b4cc12e687395ce66c800f75c6cb954a243e01eea7cda2b3ab7699c90424cd8009e28438aa8691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624222, "uuid": "231e56f5-e977-4a1a-894b-252ee4d27486", "value": "T1F7560012290C4C2F957239252FDD5163B8AE57695B134D5232C2EEEFEBACC44F68272C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624222, "uuid": "d5d7fa1a-fd82-4c0a-8b97-e0e7b45dcb5d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624222, "uuid": "ed496845-9831-451c-a5fc-413825dc0de9", "value": "49152:Dy2wjxThOM40mMP0YmnEgm9Bf/YCT4vmm/NPTNoex2GxhC2AYITO4gwC618rX9gY:G2iVsK0mDkQ0wY4rC6YXVNlspBGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624222, "uuid": "16ba9cb0-6ef8-4e54-8aa3-3ffc551129e1", "value": 6010696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624222, "uuid": "721de318-5016-4e14-a06a-3fd8d5256d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624222, "uuid": "4b63b011-dcca-4d9b-b107-ce47fc9c26f3", "value": "cab531e24fc48dcbe7d62fb35c049200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f795d9-1bc6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688625014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625014, "uuid": "e35edad5-0a15-498b-a56c-252e58605241", "comment": "Malware payload", "value": "ff44bcf82c18bae13827832ac42b05c3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625014, "uuid": "e852046b-2d0b-4916-ba5d-1d41c8d48a1e", "comment": "Malware payload", "value": "19fe00c742bb852c0c8ed6b93e2bf0b437c3cb4bba50618123d5317460bd00d6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625014, "uuid": "4ef94181-1f9e-4202-a889-25e7f2d88f14", "comment": "Malware payload", "value": "9437fd80cfa0c7e880b309a8bf29b1061af0df09", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625014, "uuid": "3b20200f-1d56-4050-a322-d8b3951abed8", "comment": "Malware payload", "value": "565ceced016494a96a1be6c5bad1012f33ddf5e4d349268e6d7c933791797016a851c6532807906a05d5a3fbae92017b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625014, "uuid": "94e7f02e-f3dd-4e9e-9291-92dcdaf79d0e", "value": "T18F03F1BACC1622B2CD53DA649450626549F0169F3B628EA1EF80BF8C3313B101E17FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625014, "uuid": "770d5ea2-5fe1-49e5-aed9-aac290803c97", "value": "768:4DhRnbulRKnV4Sx8EBf7t2ZP8euvK4lu+54fYlg4MUzSzxEF55uZ3m0MMF+rF:4bbEEO0rBQEeYKqu+mfYAQIGulm0MzrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625014, "uuid": "b0f4209f-2732-4bd7-bd67-95275808dd51", "value": 39993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625014, "uuid": "cfe02559-d9b5-4d5a-afae-7ddcab68d08b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625014, "uuid": "96f97075-7d32-443f-9130-f624bd5136aa", "value": "44664bd2a3d7765181762af85147d679d2765ca95b8bc1cb1edc4487b76e58a9.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d84e5b-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645871, "uuid": "c98d573d-707b-411d-9590-19eda9c0b1ac", "comment": "Malware payload (Mirai)", "value": "f9ee58fa5927dc85c2e53b91438dd19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645871, "uuid": "b344a055-d9bf-4f29-86a0-467a60457b1f", "comment": "Malware payload (Mirai)", "value": "1a1334709872612f17fb46746e140a28d0b67587fadb6679b3a7155dca02a14a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645871, "uuid": "439b123e-d023-4d3d-8bd1-665d51efb965", "comment": "Malware payload (Mirai)", "value": "e97c86970d8ebc979b84dd3caacceb8ede9ff5d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645871, "uuid": "f4440f60-9f12-4912-8cd9-c395825360f7", "comment": "Malware payload (Mirai)", "value": "df0acca9e05a1a35b74bb82dd65c5ed0dfb8c5e7ad73a7cb39a40fb9f6098f98342d89f44d73a7779de5018ec46d6857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645871, "uuid": "540e679a-396b-40eb-8b35-5d615a4ab2bf", "value": "T1C1F2F1A018907A77FDD08DF6E3EC838023698DFC724222F6B55811B474CA55271FDD2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645871, "uuid": "97cffe6d-d3ad-46c6-b429-0ec892a8030b", "value": "768:7fcd8mf94eXjbxae2Y7hStDPhgIuZEOsmE3U7:7fcd8q94OxJB7hStAYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645871, "uuid": "7010affc-2830-45c7-a366-91b1774ded72", "value": 35956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645871, "uuid": "271d005a-0f96-47e8-994a-ec79fa3cd8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645871, "uuid": "d8fce71c-ed6d-426c-983d-1504220d542b", "value": "f9ee58fa5927dc85c2e53b91438dd19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a149378-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688651953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651953, "uuid": "b25183ea-4302-445c-a088-1463e6769c61", "comment": "Malware payload", "value": "a2b214e13b90a307f72bf769dd81b390", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651953, "uuid": "d3aa265d-b188-40e9-b0ed-cbc114204f97", "comment": "Malware payload", "value": "1a5db06dca0667a72d24e092c81f1a3a6d8b535696813012cdc636fc652de743", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651953, "uuid": "7e3be4d2-6369-42e9-a2a6-91b7599a596c", "comment": "Malware payload", "value": "73cd59019daf63673ac7a786faab88406c32b3f7", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651953, "uuid": "875bde1e-15f6-4375-9adf-51cdf4e949ac", "comment": "Malware payload", "value": "96186ec90129c3c71f6c8125d5df7831b9126994768f073a5389b3651dab836abc8c05d2acf81d611f762c818bf1c42d", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651953, "uuid": "b2e0a8e1-c4b1-4426-8fd6-b7739c8c54ec", "value": "T1F0F2D713D84A1D22D3836976B4C3D483266DA8472910692839FD835C6F1B9BB81F5EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651953, "uuid": "3dd0c189-89b8-498b-8e87-6c117ee738e6", "value": "768:XmlbbgZGdJRa/HYce8EiHSmrFinSpypa0/AkKt3KcA4AdxIp9L:ibbgZGw9ebiHSmrFinSpypXokKt3KNOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651953, "uuid": "d9625ad8-8cf8-4e45-a514-86bffd154543", "value": 37497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651953, "uuid": "b9c0d597-f8b7-462c-80d8-06b014bfdbcd", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651953, "uuid": "bb027482-ec0a-4f04-8a1f-44cade9372ef", "value": "game.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536ab9c7-1bca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688626629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626629, "uuid": "fc1534a0-f50c-4850-bd3b-e292b542fbd6", "comment": "Malware payload (AgentTesla)", "value": "b7c5cd913870250b323cf11e1d574847", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626629, "uuid": "847a689c-0d47-4d68-a8bb-edeca4032af5", "comment": "Malware payload (AgentTesla)", "value": "1aabc238b8a45e97b218758d81ab426ea4e5702ca07e1cf6b47e1fdce70f4d2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626629, "uuid": "e30e8cbf-03cd-47e4-b047-9c4ff9d149f3", "comment": "Malware payload (AgentTesla)", "value": "9b3896c9008441a7f8f49f2e1f9882eac239e6f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626629, "uuid": "f26e9789-ef14-4a3a-bc05-c6b8f044d1d4", "comment": "Malware payload (AgentTesla)", "value": "5e5dfa65fbae0df6bf0772d034f118bac40af9ec88b47ee0c087610169ef9cec7b91ad7643c26d0a194a16f8a9d53c4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626629, "uuid": "e409fd6e-fd52-4fdb-9c7f-63b99b215ebd", "value": "T111C42360A50FEA92D40F9908F9E31EC6BF976CCD82434F20E65C444E9429FB74DAE467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626629, "uuid": "2d262456-612f-4432-8c19-49681e798232", "value": "12288:5pRXvwrcWNQaAwQSy8ERxpvqqTyF5Ryo87dF6FMZJbyVNSX1r:5bwIWgwHyPLdqMKaRdF6MZJuVNSFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626629, "uuid": "71c8f995-915c-438e-a1b8-f9f0d0ead6c7", "value": 548287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626629, "uuid": "db4a2702-08bd-481c-ad69-f40557a85840", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626629, "uuid": "a2ceeb3f-0f4f-4869-b492-606f0cbcc856", "value": "freight forwarding.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970a3a4a-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623736, "uuid": "046c7976-c863-4fbf-b9fa-998ce6a87dce", "comment": "Malware payload (RedLineStealer)", "value": "ae1dc0d30898e075014620d934932c89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623736, "uuid": "dc360953-f894-4812-bdeb-9f7088b3605b", "comment": "Malware payload (RedLineStealer)", "value": "1b0a550c9b650a529f17686a60a0479039973273707b6806ba2ae507b6982d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623736, "uuid": "67778f9d-41c0-40c9-bbcb-6763222505d6", "comment": "Malware payload (RedLineStealer)", "value": "cab01ec65de5d7e9c1d5cb744ba65831baf3d405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623736, "uuid": "ef9040d4-8467-4f63-956b-83ab71397aab", "comment": "Malware payload (RedLineStealer)", "value": "5bc3253dedcf59bc6d6f54257a80bb8145c67b5d9cbea7b2fcd7fb101ccdc2ccb893172ef691becc6bd1eaa1a1703468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623736, "uuid": "3c7971f3-1c60-410b-974e-73066672a5cf", "value": "T1BD55AD05A09D1D5CC572E3B2BADC23523DBC84742A1DA13952E21DEF99F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623736, "uuid": "6ba47713-9361-4042-a3e4-03b74e4d4ab3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623736, "uuid": "1a82ea1c-aa02-4bd6-a949-3c42da014425", "value": "24576:OkJccaNqPsIClzVJCFcMALT3GxXclLL9XWCycUK:OIGqxClmcMA/GxXcd9WlcUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623736, "uuid": "d365263f-c300-41ff-bb8c-e13e8d0abff8", "value": 1343820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623736, "uuid": "9e9e5fc2-a2c2-49a0-a9c0-15bc18fe8645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623736, "uuid": "ebddcbaa-9c90-44c0-8381-e578cdb49c5c", "value": "ae1dc0d30898e075014620d934932c89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d693ebf-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688651905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651905, "uuid": "68375d11-e0e5-43f5-947a-5c62dc1b3726", "comment": "Malware payload (AgentTesla)", "value": "0c3cc1c23b64b9a0de860a046ffda54b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651905, "uuid": "8c60a873-eb81-444b-9f43-8d198eeb400c", "comment": "Malware payload (AgentTesla)", "value": "1bb519bfd532f9d0eeaec8a7470b37c180983ab8de10be6fb96c5c511343ec32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651905, "uuid": "521ceced-7ef8-49b3-8d74-9302ab6c2486", "comment": "Malware payload (AgentTesla)", "value": "a7a5ab03b40050e297ab8f702b7ef7790d997be3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651905, "uuid": "d8e056e6-54a6-4381-bbf2-2bcc918aec24", "comment": "Malware payload (AgentTesla)", "value": "8c5eda6bd51da47ee4a724bd37fcb755cf6d529a33bb1255c88d19cd579e20a73b8bb6b830f66e23bae4b5d6ba09459e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651905, "uuid": "8a4e6fed-888c-448d-99a8-1b7890a70337", "value": "T1BA45D43D9CBD4237A674C6A6CF94B866F094D3B731122D39A4D35285862BD4B3AC313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651905, "uuid": "a241745c-c786-484e-a21e-8f41fb0be79d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651905, "uuid": "585de845-09f8-48d4-88c0-bddbf2f94284", "value": "12288:9IxFXuOIQJ7XEPSQkLPxGVABpVu+JVFDsF:++OHJ7XOkLPx205n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651905, "uuid": "5b55b719-0bd6-4aca-a132-fa3e0e633dd4", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651905, "uuid": "a83a9795-4c1b-4040-895e-0d7a47ef012a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651905, "uuid": "2e9920aa-b42e-4b58-ac88-d011a259f211", "value": "1bb519bfd532f9d0eeaec8a7470b37c180983ab8de10be6fb96c5c511343ec32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6417288f-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645555, "uuid": "5cec5b1c-a130-4f18-ae62-63669117a495", "comment": "Malware payload (Mirai)", "value": "112ba06f526f4684a075e00e51526ada", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645555, "uuid": "39e53772-843d-4e28-9235-b8866513c3c7", "comment": "Malware payload (Mirai)", "value": "1bbeaf73a244ccacb7f84b68e2ce85fba2aa6d890ad8fdab51eca2ff15cad33d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645555, "uuid": "01ca1bc1-0e6c-4b4b-a210-c17b06d8984e", "comment": "Malware payload (Mirai)", "value": "3487e1616a46977ca5882651a56a1007e0909ef5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645555, "uuid": "236982d6-e95c-4fbc-9e4e-5c3f568377a4", "comment": "Malware payload (Mirai)", "value": "27475e9918f41770184eb0ead04736ba8be3135978ed3a0337b728e1624eabcd15eb765a669c649681d01a69bfc27fad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645555, "uuid": "f4434492-8114-4408-a0d9-928863ad46f9", "value": "T105A3C70E6E258FACFBA9D23447B34E21A75833D637E1D685D19CD6012E7024E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645555, "uuid": "955a33a3-29ae-4f00-8dd5-ff601fe63a54", "value": "1536:lJAHVvH+FQI4I6QgAF+xKjHLT4LD0b4AlqernhND6sqH:jkVveFj6Qg9xKjHLTU0bRlVhhPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645555, "uuid": "c13cd1b3-1a51-42d5-a047-efb11c1f17cf", "value": 97776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645555, "uuid": "1bdbeba1-95de-46d5-986a-542ac09c0dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645555, "uuid": "7d129bff-cef8-45da-b6c9-6b9a402a4b18", "value": "mips-20230706-1212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b30ced0-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688648519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "94b41286-5c4d-4d3d-aaca-01088ccacf06", "comment": "Malware payload (Mirai)", "value": "030e35ceaf470721c7cb30d3c556ff13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "8a62f2f9-04c8-46b9-ab20-50bfc7c651bc", "comment": "Malware payload (Mirai)", "value": "1bc791ea85afeb9481486969e90b29b438f6a055e03059723b01171f7011e502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "ef730594-b3a3-4e83-9a70-e5b7b16c1117", "comment": "Malware payload (Mirai)", "value": "453d9f9022f970863f62624aa79e5144f4fd7afe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "d0b9ddda-399c-4501-b142-d02af3e008ef", "comment": "Malware payload (Mirai)", "value": "c4c9492a6d16d7842b765fbe889ba87a8ab4aacb55b432b6aa53d68f290d3a1bbcb136b60633224e5ffe94bbf03b9023", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "6fefd6b1-be00-44bb-955f-483ccd3ea756", "value": "T1A6535CD9B8019E7CF88BEA7E40224E0BF522761144935B377777FD83BD321699816D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "2541b100-3006-46fc-b474-26c0c86d9546", "value": "1536:PkoaQmWmHv11dHVMMEVrS7jON/g1pp8QKESgLEGK1QSQ78W:cB8SeSppJpDmhQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648519, "uuid": "533e5718-5a61-4d18-831d-996659a6aa06", "value": 61572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648519, "uuid": "f7afa8fa-6486-4f9f-9284-d1bbcb5b07bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "59f5d6dd-7399-4e3b-ad51-03a619d33bf2", "value": "030e35ceaf470721c7cb30d3c556ff13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55719de5-1bf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643382, "uuid": "05beac05-762e-4317-9146-c90f76626614", "comment": "Malware payload (AgentTesla)", "value": "37d6c5670034a59025388f7de306de4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643382, "uuid": "ae959882-f443-49f9-baff-e06abf6efc96", "comment": "Malware payload (AgentTesla)", "value": "1c148df5780e4fd46144d5134c5a805b3e528a2ad6b6056314671e5f7652a128", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643382, "uuid": "3fd1de32-fdc5-4df0-9185-617915d5f796", "comment": "Malware payload (AgentTesla)", "value": "196c991189cef9818232d6e9253e21fe0fa59822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643382, "uuid": "20aaa86b-17df-4132-b181-5b99743280c1", "comment": "Malware payload (AgentTesla)", "value": "f4543d324887a25a2931f25ad7350b4b616e81600d2f56bac8011efd895e7ac987647ca15ddc797972164d7b71c8df98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643382, "uuid": "9c59edcc-b308-4ab6-b597-095d60822f63", "value": "T18505025906FB831AC81A3FBC1D641171D3FE9B957037D60B9FABA9D8EF12B184950283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643382, "uuid": "fe9cb910-d03a-462a-90da-3a3d20f1c93f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643382, "uuid": "7b412a58-7cc8-4483-9e38-60fb0e47fab5", "value": "24576:00biRoSErVxIE5wCoG3kjhmaqF2TZeCv:0y4oRrjIwwCoG0jOMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643382, "uuid": "dd64f58c-0b6d-41c2-9fc9-a7e28c78d2f1", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643382, "uuid": "d582e0c4-3a48-4905-bb07-f5ccb0de476a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643382, "uuid": "4778945c-dfd1-464c-81b3-f1a69dce51e0", "value": "1c148df5780e4fd46144d5134c5a805b3e528a2ad6b6056314671e5f7652a128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cae89d-1c00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688650060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650060, "uuid": "42fba87f-55ae-492f-bd22-2ca5b94cfd3e", "comment": "Malware payload (AgentTesla)", "value": "001b7651a94515271267d93b3ad099a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650060, "uuid": "76b8c832-d67e-4356-85e4-e9c35463ad26", "comment": "Malware payload (AgentTesla)", "value": "1cd1f5ab76966f57655f53e59b4d210ece1338051884e1fbe167e99020fc7ce4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650060, "uuid": "e892a92e-04f6-4af3-be96-a9893b01194c", "comment": "Malware payload (AgentTesla)", "value": "babed1b681f923723a3f9a287633607ec8d40ffd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650060, "uuid": "f0e30150-d949-4ce1-b2b9-ce0543e55fa2", "comment": "Malware payload (AgentTesla)", "value": "eba36dbff80c409b62b326bd87e646324e94b28d8e89745e58010b2277a15c7531c80d37f0f2d41d9c72937d8cabe28b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650060, "uuid": "c36c3546-8336-49c3-82a4-3be6fb40d59f", "value": "T135F4010973BA8F6AC43A7BFD0A191272C3FD512A3073D7525EC325EEAD11F444A90A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650060, "uuid": "82df8320-92e4-4ac4-9e88-aed600f09dc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650060, "uuid": "746df888-3995-4b2b-ae52-b8b043e7922c", "value": "12288:h92iNyOe42KMu/N3mWhQmwmJCMpUgZxDRHwBSzj+A+t/Rn/lQupjJ3pTKk6CYqAj:/1wOV/NOa7ZZRHvzWzn/lQulTX6CFA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650060, "uuid": "0dd008b9-50cc-4f57-99e8-594d453d8881", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650060, "uuid": "f15f9075-0555-40ba-8a03-4547136e5bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650060, "uuid": "d973914d-39bb-4235-96cd-9acf4cfb4e82", "value": "1cd1f5ab76966f57655f53e59b4d210ece1338051884e1fbe167e99020fc7ce4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d63993-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688641180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641180, "uuid": "0c6c4b60-575b-4323-bd48-4a9ab5467d01", "comment": "Malware payload (Loki)", "value": "7f8a2a95daef7e69f02b4be2191636ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641180, "uuid": "35cd5a28-0756-48e4-a6ab-ed414e66a820", "comment": "Malware payload (Loki)", "value": "1d42e9031f45127f4dab62ac48f7774db6cfa1c785b87efdcdfa75073227b4e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641180, "uuid": "48002527-aff7-492e-89f3-6059f10e0637", "comment": "Malware payload (Loki)", "value": "7bdee38947928948a6e20e51d5bb27dffd597929", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641180, "uuid": "6e163972-d080-443a-8575-496ecd3151a0", "comment": "Malware payload (Loki)", "value": "408bb0582c6d35c04b3220ed4fe4bc2687ddddffc3d6324fb517bda53efe34f28dd1ae1c2ee66513bb7aba963a977097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641180, "uuid": "be97324c-061a-473e-83df-2107aae7e800", "value": "T13EE4022867E3A00BC91D6EBC0D8612F5D3F89A967513C3478FC7789DDD8EB898A02157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641180, "uuid": "c6f9cd8c-169c-4354-8305-ebac3973e99c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641180, "uuid": "1427f690-76ac-42a1-ad43-6f5f01ab49ca", "value": "12288:YeSF4+H0mIvgcx08Q4eqbq7u79ljQss1VIJFwbhaDnLMzIL2q+RTdOL8aLTATNZ2:PjCOyqGUL8+6NZS6nTEku0IF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641180, "uuid": "dec974c0-5697-4be7-a8bd-f9ef4bc4955e", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641180, "uuid": "7fea2960-265e-45c8-b64e-704268b5722a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641180, "uuid": "c891248c-e788-4418-965a-5d4104361c09", "value": "1d42e9031f45127f4dab62ac48f7774db6cfa1c785b87efdcdfa75073227b4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaf0dde-1be3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688637573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637573, "uuid": "9cbc868d-94cb-4eb9-8569-1ba8af8af53e", "comment": "Malware payload (Formbook)", "value": "20415c88f2e2b61a101c2bcf27540315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637573, "uuid": "d018b668-6faf-4d99-9953-7b0b57b468d5", "comment": "Malware payload (Formbook)", "value": "1d8ffbf2a386718acac9f307a0b0315be1831b7a3407aeed7cd4b510db02a72c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637573, "uuid": "ef2211a6-3713-4b09-b8ab-f294ac58b174", "comment": "Malware payload (Formbook)", "value": "7959b8aa326ec60be4ab1621c6ce636a5f705a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637573, "uuid": "9a50bb26-0965-424d-b326-88247e110c98", "comment": "Malware payload (Formbook)", "value": "4ee958201d150e468bb5e61b13cd68a93beb878b86d5ec753dd309f534354532390cc0cfcf337244723d465285a7ffaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637573, "uuid": "af254741-40b7-486b-9cf1-86cef6ae86d9", "value": "T141351202BBC544B2C4A21C325A7A5721693CBE601F79CEDF63D07E6E99319D1DA313A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637573, "uuid": "729dd28b-52c1-4c4e-8a71-eb39bde53572", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637573, "uuid": "9394d4ba-bb91-4d70-b066-c7d59a95672b", "value": "24576:wTbBv5rUk0FHSwWGawARXI0V7p3QEfBnX7SWXMdAfRd/Y:iB3aywWZRXlnTRXPMUlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637573, "uuid": "14ba208d-28be-44e0-8a1a-4ff7133df250", "value": 1147349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637573, "uuid": "f6471be2-0b03-4a2c-97b1-86af19cb1c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637573, "uuid": "072fb0f6-fd31-4abd-b4fc-d4224af7418b", "value": "1d8ffbf2a386718acac9f307a0b0315be1831b7a3407aeed7cd4b510db02a72c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbf7f76-1c0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1688654755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654755, "uuid": "0dfeb098-3fbf-4cdb-aa8e-b32f5e03bb7b", "comment": "Malware payload (NetSupport)", "value": "c1f91c2f2fd16253b6000d2c5f3bb2b9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654755, "uuid": "8bc5f777-d5e7-4924-94a2-e84b43e97e47", "comment": "Malware payload (NetSupport)", "value": "1e76df35c2173175d518bd8d64d72baef7f0d18508522596f9965258120afa0a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654755, "uuid": "2e00cba7-3390-4bb7-bce1-1919317f4a2f", "comment": "Malware payload (NetSupport)", "value": "e3b43e45d193774711ba2a0311d5a5f6f463c6c0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654755, "uuid": "1adfefb1-baf2-4492-9645-abe940203bab", "comment": "Malware payload (NetSupport)", "value": "630cce61e3cbd3c7c1856b2954a85a5facbff94b12640a3a80f4f54e6d6f288aa771f39d8a1bc5910b33de7a300c9516", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654755, "uuid": "1a3ce465-a865-4633-8030-b1f55c0315ff", "value": "T1E845DA38397A7C2443DBDA1334F14B961CE9564FD1703A3B299AD8139A352C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654755, "uuid": "4fb16111-dd23-4a25-ad98-5e7ca1f5de52", "value": "3072:hbGYsSyvBtCTeHiu5hDbzLexsAWONJuJ1Qu9ZkPIT6nL:hbGYsHaq5hrLexsAWO/uJ1r9ZkHnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654755, "uuid": "0623260c-314a-46a9-9c80-99d21efd5ca2", "value": 1277129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654755, "uuid": "443e58f6-2e83-4dbe-8a81-5ef47c2d248f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654755, "uuid": "ed654c6a-fd21-47db-8956-a083774728f8", "value": "result-pdf-win.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa1e018-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677035, "uuid": "61124cf1-d197-4445-8e83-10afa7590209", "comment": "Malware payload (Mirai)", "value": "100c685c8224da9e913c11244e5ab83d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677035, "uuid": "b704fd22-35b8-4ef8-a9f9-f54b8b4bdb41", "comment": "Malware payload (Mirai)", "value": "1ee9758a32bf5e0b784d2bb4f6f3c5d8687b271891f5190670523cf2a9ab42af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677035, "uuid": "b4e26035-514d-4122-abf2-5871874e99df", "comment": "Malware payload (Mirai)", "value": "4060e4c404df21d14a68ffdbfd1b3ac9717537d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677035, "uuid": "0c96a80e-a5df-46e1-ab3b-30f3f19693c6", "comment": "Malware payload (Mirai)", "value": "ffca50e794acbd66478b7ca8adbc0963082f9aaf21acf12a28511aa74c5934bed4d4cb7022c7981d0932136f5b7dd0f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677035, "uuid": "8f22563c-da3c-4e41-a18b-a041e1b6d94b", "value": "T1D1E2E13027CCD936DB9218B78500C94BDFA91FBF7AEE30366696038D2D1468E01BD687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677035, "uuid": "c32c73a8-1f28-4fbe-a682-cf8b5e9b6497", "value": "768:O83lxPcOu2LHi56E7n9W78PuXL5q5mu1fbBE9q3UEL5C:zlxFu2LHi5N9s8Py5ebLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677035, "uuid": "53813dbc-bf97-4860-8f32-780d22485f57", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677035, "uuid": "39813645-be80-416d-b376-bedc377b188b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677035, "uuid": "be0c91a1-aae1-4f18-8dec-42ab0abaccfc", "value": "100c685c8224da9e913c11244e5ab83d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175d1545-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688644137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644137, "uuid": "a735de57-e97c-42ce-a3ab-4af29e98bf58", "comment": "Malware payload (Amadey)", "value": "0228bdcf8cc02265d8735926cd010a98", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644137, "uuid": "07c8cf1d-39d6-40b3-a8e2-11f23b929fe6", "comment": "Malware payload (Amadey)", "value": "1ee9f2730e5dc009beeba69607a9e89184af1285338267ad741a01a7bc9e4f79", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644137, "uuid": "7afb56f4-85fc-43f2-ab80-3376542d194f", "comment": "Malware payload (Amadey)", "value": "6c66b1e56adf424a80b2fea5c4d4e371d0c42967", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644137, "uuid": "78107597-f2a2-4e2f-9550-c03b6c66aa31", "comment": "Malware payload (Amadey)", "value": "c8620238524aa52b4ddddf7cd53c52987686a98fe5c4a9eac49e9dd5e29ac4a496f21583d1f530187b8d91e3a062ff65", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644137, "uuid": "62cd07cb-dd83-4e5f-9a4e-7de10bbd813c", "value": "T1A4560012291C0D6F91B534211FDC559378AA53B95B130DA232D2EEEFEBACD84F68172C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644137, "uuid": "96da07d8-08cc-42fa-a107-500f9d44c484", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644137, "uuid": "4e6e0a12-144a-48d3-bbf0-eb726caf6b05", "value": "49152:PSnyulRF7DnnuLjszw6iZSIg8z4HBL6mZpKdezYGHKPKEw3bnCAfipj+W+OJ1PEn:PSNrjhLfmj/KFG9sgJ1c7HSRJrFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644137, "uuid": "343ed34b-211d-4ad8-a2e7-645cf8466926", "value": 5999432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644137, "uuid": "d1a9171e-72a8-4cd9-afc6-30eee0fe655b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644137, "uuid": "a9e8909b-af54-4327-b563-0055b721ff12", "value": "0228bdcf8cc02265d8735926cd010a98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1987c9d1-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688645429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645429, "uuid": "82680488-2b62-4e85-a596-ed07b9e1c4d5", "comment": "Malware payload", "value": "59ec3eccd63377b32a4d0148ae618970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645429, "uuid": "ab655f90-5831-4f46-a829-e9e5a723c958", "comment": "Malware payload", "value": "1eee9a0a3bdec7a774cfd42a8e224adb713e2841d128a2b59ec3934eb3c9d966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645429, "uuid": "5c8d6e34-0d02-45e3-869b-88ffe57d7122", "comment": "Malware payload", "value": "a8820a5a6bb2509271c79e6008e0a838a041fa5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645429, "uuid": "aa41656c-3146-42b4-ab86-de71d56a2c7e", "comment": "Malware payload", "value": "56e0c964c678468b13595f3ce6679c2a0a33fd7463b7d390f72a4daaadbb47072f6b7463d96fbcf36404bf023f5f4e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645429, "uuid": "c0d764ce-7477-41b7-9457-c5024648406c", "value": "T1620633BD94E85D47CC3E1CB492ACAD4D8FB129965A2F783D3880FC2F0E152DA946944B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645429, "uuid": "e8baffc9-f7aa-4472-80e8-d1a419d5e9c6", "value": "4bfd1be901a4c0d571291552b2d7a34c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645429, "uuid": "778bca75-4c89-4b7a-9ded-01d8a327d642", "value": "98304:JhQmbHdIECin0RQjwFB7rHaTDRv2sZHygx42IkSkYKK:9H1UC8FZHaTDtZZW23aKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645429, "uuid": "de105e51-e2b6-40fe-ac0c-c8b7f78ca2c5", "value": 3927968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645429, "uuid": "1105ebcb-81e4-45e9-952e-62578db27e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645429, "uuid": "cafd8fcf-1043-412d-a25f-90513a76f193", "value": "Inject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a563e5-1c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664725, "uuid": "820b2ba8-ef3a-4daa-b66c-728594c5327b", "comment": "Malware payload", "value": "b5ee81565f48823a778cbda861c6ceed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664725, "uuid": "ec41bac0-5169-4a2f-b43d-d7db0784c018", "comment": "Malware payload", "value": "1f5d71bd404c723acbbe5c5a07d2ef55d2c0e3bb5d99338928b959e2671506f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664725, "uuid": "46942e91-1bd6-4ab1-ae88-9ddc0e4323d1", "comment": "Malware payload", "value": "b9b07ae8b80a7a9669bd7aabd7364d2add469f60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664725, "uuid": "0db48d87-fe1d-41fd-a191-63f9fbe99efb", "comment": "Malware payload", "value": "6e480442571d14961687d5ffcb4cb01aa1a960748128538255fa27f5b8fd6e3358e02c311b5e6fd9e54d544363ecb652", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664725, "uuid": "a0755ea9-668e-41f7-92ea-545ce1de94ab", "value": "T14DF4C072A2908436D9B32938BC3B627498357F113E2968862FFB1F4C5F376817765293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664725, "uuid": "0fe7d400-9c55-44eb-a8f1-be6a2737e98a", "value": "08383c68100f077c71c5d27a0b483b53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664725, "uuid": "691d9e1e-5288-4101-af27-e76ff0d00205", "value": "12288:fRpkeLSL1jG9AkHBN2Z+QzeuYZYCFICfCKROOoifXuhW/lJ2StabsaTgOTOT:5aeO5K9hhMIQrYZhFICf7AO1fXRlJXtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664725, "uuid": "b49d2e39-ddb4-4f35-9aa8-685aaa336c47", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664725, "uuid": "bfb925a7-4e23-4050-8697-12ddecc84d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664725, "uuid": "3d9fbb51-5794-4f7a-98c2-4d1f88b6ac8e", "value": "polyphonicPeguan.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9befb8e5-1bef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688642642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642642, "uuid": "1e2d87f9-52a2-4963-b22e-179cc229bbdb", "comment": "Malware payload (RedLineStealer)", "value": "9e2d34e26f7b9bdedc5e06a562aff269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642642, "uuid": "189cf5c2-ab30-4a7b-84ae-4f8e83966592", "comment": "Malware payload (RedLineStealer)", "value": "201c93c69e74c2d3686e5f06496570cafc57df96a3180d4b7e7f4569f9fdd250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642642, "uuid": "abb4f4f2-5ebd-4744-8ca6-c2b7858e0d82", "comment": "Malware payload (RedLineStealer)", "value": "88b4b7014144970cc7f64e4e09ffce3856950d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642642, "uuid": "56b721fb-5646-4743-9faf-f190506aaccd", "comment": "Malware payload (RedLineStealer)", "value": "7bcd0a71a27d461b965b8be73264ea22ac2eec58ce499a1b018bbb03e137e5be651c0fef79f0244268ea6377d302b68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642642, "uuid": "aa5809e0-2fa5-4ee8-a8f1-c783f7bbdb5f", "value": "T104060102614C5E2FE03A79B537EC4557F86CA4B8EB090D4522D22CEFC99DD83F2A259C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642642, "uuid": "0b0b19ca-1f44-43ab-b9b1-33973a8a70e7", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642642, "uuid": "bb2ee500-4a4b-4405-8c28-6fcc6bc37ab8", "value": "49152:f3ks4PAL8hHNso5PHmWA+JqFUeHYuolPHgKurscjAQHd695zLeIoHGrVmLBMqGL0:8AoQ4z5QH6vI5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642642, "uuid": "5dda7b9c-fd24-4c79-8075-d3569cd33b0c", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642642, "uuid": "b423dcfb-e910-43e3-ba9e-ef61f2538561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642642, "uuid": "15ec8b0a-1bdf-45ef-95f2-b9404d818418", "value": "9e2d34e26f7b9bdedc5e06a562aff269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3e3969-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624311, "uuid": "d9f161ab-c41d-4c84-8fd3-8e951ceb9ef8", "comment": "Malware payload (RedLineStealer)", "value": "e58ef6093f3cc397c79273cfbc7bb124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624311, "uuid": "1bad4910-56e4-41f7-a4d1-84caa63de70e", "comment": "Malware payload (RedLineStealer)", "value": "20a0028e383c23360a26c8b11ee61df752231cf0630afc9d55798c071c6ebe90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624311, "uuid": "8eed90ea-d1c0-44e0-a69d-22933a88e59e", "comment": "Malware payload (RedLineStealer)", "value": "b9119a570897af2f1a894a78b4e64886578f0020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624311, "uuid": "4beb8ed7-ca49-4b11-b1f4-4762abb275eb", "comment": "Malware payload (RedLineStealer)", "value": "d4b1c417f0a5b86103e21c5e434ebea3d8733380bd3a1d227b154103df802e204a26684bff301fc47c95df942cec9e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624311, "uuid": "c6567e3a-7e5a-4f2c-a478-969ed750efae", "value": "T1EA060112618C5E6FE43A397563DC0857FD2CA474DB090D4622C62DEFC99DE83F2A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624311, "uuid": "007d12f4-fca7-45ac-8b29-3c38603376ce", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624311, "uuid": "82f54dc2-d4db-457d-ba77-8a541be4e5ad", "value": "49152:eyb5C+fAaUcgh9SXHm3lJUxFgIGV/zsmEGSl5a2In/qH63nT2J/GQxzeCx75mdGc:9CjfzsljLnJGQx375HuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624311, "uuid": "2f7a70f4-4181-476f-91bc-336310b7ea49", "value": 3763016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624311, "uuid": "5facac7d-19b9-4320-842e-97ca593583e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624311, "uuid": "e98bd554-8c1a-4126-889c-1952a1b112dd", "value": "e58ef6093f3cc397c79273cfbc7bb124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4d1522-1ba7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688611828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611828, "uuid": "a8a2c129-c837-4177-bf99-884fa21a80f5", "comment": "Malware payload (DCRat)", "value": "acf6705c2224e0af212e55cecfeff4a1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611828, "uuid": "6f51eedf-cda6-4949-9b31-4fc8ff407613", "comment": "Malware payload (DCRat)", "value": "20f26777b254ab107707728d2750f34386a38f0eda13b3c1c4914eeaf654d014", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611828, "uuid": "23a80fe7-8f34-498e-9eeb-a7681b224075", "comment": "Malware payload (DCRat)", "value": "70810c3d34025f59d81b7bd68ef7be0ef47a3237", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611828, "uuid": "a953d012-6137-44bb-852f-4fb606325a82", "comment": "Malware payload (DCRat)", "value": "d675e923178171e7ef5f19aadf7e46e621d10b63df847e2674c20ca00baffd5356b8a350a66641510b68f3943ab31c12", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611828, "uuid": "7f4addfb-9875-4936-ad2d-b349e57f374d", "value": "T13107334388A093E0C88CC43BA47A0F34519B0E569FF54A974A47CBF337AD6E547A5E9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611828, "uuid": "57be92b9-73c9-4b94-8d41-b1b0f0b71a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611828, "uuid": "7f965de4-23e3-42f9-aac7-cf6243679748", "value": "393216:fm2RkygitasdViZhpMhuqPH8zX7HE/oNqI1QiBh:e2aywsDiZeH8L7kwNjbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688611828, "uuid": "1a2304a6-6225-4f7f-8cea-479c01eaa48f", "value": 17261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688611828, "uuid": "9b66d091-f5db-4c13-a219-9a812247e9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611828, "uuid": "af9cd3e7-135f-4542-832c-c00b4114a36e", "value": "acf6705c2224e0af212e55cecfeff4a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feca5b44-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624339, "uuid": "cbe839ad-5837-415e-868b-93d7e578555e", "comment": "Malware payload (Amadey)", "value": "f6cd8013c4d97eee52f4468e155584e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624339, "uuid": "30a6fb46-b4bb-4f51-925c-2fc25067adeb", "comment": "Malware payload (Amadey)", "value": "21660b1afc287fa8ec9a0fb43ed3b1722dfd205018996e7ccecb254f665f8aae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624339, "uuid": "777b21bf-3e7c-4527-af4a-91ea8fcda3ab", "comment": "Malware payload (Amadey)", "value": "47545504636fd35902692ab99c7331d906dc0d12", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624339, "uuid": "1d155da5-29cd-4026-b24d-ae6ff67ec317", "comment": "Malware payload (Amadey)", "value": "a3792457e27d00fea594a97dc8f2ae0264032315ee7323e3e1e97540e73c098d52a24783f76548c3114e395ac6815aca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624339, "uuid": "b775b400-8075-4d86-a200-04fb399a4737", "value": "T132060102648C9E5FD43A3A3537DC4423F86C9574DB191D8422E62CEFC99EE43FAA658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624339, "uuid": "b7dc8838-106a-43bc-ba27-d61d331fa749", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624339, "uuid": "9a6691f7-32f0-45e0-88fd-a6f5b1c01fe2", "value": "49152:iDI0fuc0hkKWVmjotaWh2rEFoCAVtfVaH82z9ET5qZ3QMa6MoOrcauti3COxUOI9:uMNVZVacMZXIUbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624339, "uuid": "13fa5e90-bf55-4a42-80f1-db9264eea066", "value": 3777352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624339, "uuid": "c765f54e-5e9e-4020-9d8c-93e7c9e65dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624339, "uuid": "74ee3362-30b3-4597-9aa8-71fd046cace4", "value": "f6cd8013c4d97eee52f4468e155584e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4d8523-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623743, "uuid": "bcaae0e2-6d8c-43eb-a9bc-52fecc7e76e6", "comment": "Malware payload (Amadey)", "value": "9c8bf8bd63600db904946718ee7084df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623743, "uuid": "b396631e-251d-4c0f-b14d-fac747c5dadd", "comment": "Malware payload (Amadey)", "value": "21b90704c865f2b6ec046552509de120a0eef290b8a1e03e5ca846aae4e7f5b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623743, "uuid": "e8037935-58b3-44db-b138-cd4f3074fd4f", "comment": "Malware payload (Amadey)", "value": "9fb2e9b46780182f38a7fed83b230f7cc857da71", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623743, "uuid": "5c75f591-ae0b-4b46-ab5c-d5a4af2ae888", "comment": "Malware payload (Amadey)", "value": "3087a87ecbc70c2eb066bc44f3b8d51635b0ca9f060439cb8c6a89ca73f29e3192914b2d6d6e96bb30506188f26cdba9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623743, "uuid": "2a0dcd3e-8737-4181-83b5-3ea035abab7b", "value": "T187061111204C4E6FE136747977EC5557F96CA0B8DB090C4522C22CEFD89EE83F6A699C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623743, "uuid": "b99a8313-011b-445c-983b-4e747a472872", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623743, "uuid": "9a8cf85b-0156-48af-bff6-fb035436aa19", "value": "49152:OKW2210LtCYO7sywkOq18HPDsLG+HW6t0ycsamCww2h4pbNClBLFh3hjdnaY4eQ5:IAL1AH5+mNw2ENClR3vn65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623743, "uuid": "b5a923ee-9836-455c-b76c-b5684e3d0f74", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623743, "uuid": "6d3e6b99-ab0c-47d3-8fcd-e54a1e77e7d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623743, "uuid": "ca2bafd5-cea7-4ff4-bc66-414cad04c576", "value": "9c8bf8bd63600db904946718ee7084df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de848a-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624323, "uuid": "5830e80b-7a0e-4e16-9bc5-5290a4450349", "comment": "Malware payload (Amadey)", "value": "e75d92d3d21b3b55e58b4e22b29bf884", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624323, "uuid": "3658e360-bfba-4fe4-b332-860f7030000d", "comment": "Malware payload (Amadey)", "value": "229a2b6f39e908bd38c77c559148d48124905d21bb549b26f993b6777ff3ce00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624323, "uuid": "5ad94289-180e-45f9-aed4-e2edb3ad1754", "comment": "Malware payload (Amadey)", "value": "1b5e40758b679f3853fa4bd38f30aa3c90ce9ba0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624323, "uuid": "ea96b8d4-ee0e-4788-af22-2aa9991250a1", "comment": "Malware payload (Amadey)", "value": "aff9677846cc65f466d53c75e76f38fba702e61a2e0f2ecb999eecdc564b32f97742f244e88dac8f57855ed16da307b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624323, "uuid": "b379314c-0e36-4aaa-9324-7e4299ebdd5b", "value": "T138060101258C8E5FD53A383A67DC4853FE6C6474DB090D4522C22DEFC99DE93F6AA98C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624323, "uuid": "0c874907-da67-4aa2-8506-007f3019e33f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624323, "uuid": "57c7f4d0-905e-480f-80e8-1aa67ede197b", "value": "49152:odxmJLKDzrM8U0cg4bAb1fuIFRKwTTelOdAbPH9urf0A2cPiMOYnlbu8LJYgsLU2:udel2AbH9SPiPkXdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624323, "uuid": "11cb5480-06fa-4b61-9768-be627f77be7b", "value": 3763528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624323, "uuid": "8c5a188f-a3b3-4808-9404-7760cae59784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624323, "uuid": "81ee8d71-77b5-459a-9a70-26748161338a", "value": "e75d92d3d21b3b55e58b4e22b29bf884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff1cc6e-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623751, "uuid": "ef5da58b-d1cb-463d-901d-b1bb6c777b93", "comment": "Malware payload (Amadey)", "value": "ccefe39448add200c98199f6a8fdc0af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623751, "uuid": "cc88de9a-bbd4-488f-9f39-0e3a728c467f", "comment": "Malware payload (Amadey)", "value": "230973557b0ed449be6c250d13a9ff9986b4eea3669fec58ced65129ff081138", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623751, "uuid": "ca24676f-92e4-4b0c-8c1c-d61d2710cbc0", "comment": "Malware payload (Amadey)", "value": "22dc151207e3fdde72baaf6b3e764b56060d6253", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623751, "uuid": "39f3816c-4983-4df6-94ee-caba426ccabc", "comment": "Malware payload (Amadey)", "value": "d38ac83471c9b1f280ff0bd54d01effb18424375c31010f7ca8c57d9fedfe2424cf76f937668f9df9b7c023f611b80d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623751, "uuid": "6dea7be4-eb43-4311-b9fc-9f715ad606a2", "value": "T134160159641D9D9FC97435722BED1953FAACA4742B1F0E0022C2ECEFE4ACD80F69199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623751, "uuid": "db1e2228-edcd-4b84-b8f4-acf5c29e07d8", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623751, "uuid": "4fecefe9-1471-4863-be67-c6f86f7e89d2", "value": "49152:CT+E/aGoc3mypjnUTvuo5dYeVKVYtk5ETyurZn9XwxhVwpgO1wE/jWmU4YHuCMW2:iYmGl0xcPwOdb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623751, "uuid": "7254b7be-0f9f-4115-af30-104e221e4d11", "value": 4085576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623751, "uuid": "95324d7c-e598-4916-8d68-b01c8bd922df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623751, "uuid": "cb4b756f-ac5a-4a70-8f3c-066d622f63e4", "value": "ccefe39448add200c98199f6a8fdc0af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45227422-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622739, "uuid": "2a2251a2-22a1-43dc-a9af-e20571b5c003", "comment": "Malware payload (RedLineStealer)", "value": "4e1cbb956eb622d61850f31954969c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622739, "uuid": "4cacf90e-fbd9-4636-b232-de9de54a5dca", "comment": "Malware payload (RedLineStealer)", "value": "230babb0130d12efe2800428967468359838667b901f8e86a240cb91cdf2af9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622739, "uuid": "4576d021-99ce-4bae-ac9a-c41afc81a6a6", "comment": "Malware payload (RedLineStealer)", "value": "69b007b44a94de6c827d679dcf60ec9d02a7590a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622739, "uuid": "c4c2e811-be2b-4dc8-a788-80ad9e3c44d0", "comment": "Malware payload (RedLineStealer)", "value": "50ed7c1144c63a22c90e38ecdad081d3a820d9fc03bf675e8832b634862d98eabb256a68f68f84904c92e368d4144244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622739, "uuid": "8ab409fd-c94b-4658-b279-32774932eac6", "value": "T12B55AD04A09D1D5CC671E3B2BADC23527DBC84742A1DA13952E21DEF99F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622739, "uuid": "331c0056-3ac3-411c-af85-03e62da78f84", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622739, "uuid": "5839294d-1f75-48cd-8b2e-6bcf8775a5c6", "value": "24576:p7TMIlfhO99k5sKVQM2CkM+nOmUJ4Xtm+p0W1GVZ6:p7bOnkBRtTTmUJ4Xtmy0W1GVZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622739, "uuid": "278f92a0-7659-481a-b040-95b26c7dc0b2", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622739, "uuid": "be59163e-8d8f-4e47-bb67-f073ff269824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622739, "uuid": "902334a1-0b55-4795-84c9-a0c5d221d2b8", "value": "4e1cbb956eb622d61850f31954969c7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2717fb-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688661651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661651, "uuid": "e815e883-ef39-453b-af8c-3ce9431ba77b", "comment": "Malware payload (AgentTesla)", "value": "bbfcb16a3d79f16ffbabf5f9d7565a54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661651, "uuid": "96ddc5e4-4d98-4283-9125-0e94d0b49246", "comment": "Malware payload (AgentTesla)", "value": "2356897255a0d7458b3cb9e363426abb9aac3034190c84dcff987adcc0c3a41d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661651, "uuid": "3e0fdec6-786a-4683-b8c2-4b53faa062b2", "comment": "Malware payload (AgentTesla)", "value": "cbdb52baeb017f54e9881183ec64a06cd6cf8f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661651, "uuid": "8a49a693-0375-4e0f-8139-8d25aeb24e49", "comment": "Malware payload (AgentTesla)", "value": "68b446c10e2e2d8891081af0ffef1babd75a40e91099af7e78d035dca345f6ae164ed0969cf026bfbf147ec387df5e78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661651, "uuid": "d90baec4-d665-4d1f-bb73-dcc44a196f65", "value": "T156841205D7B4C523DC5346340A7B1D6A6FE6AA3221E6EF1B27016B4E72735418F8E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661651, "uuid": "a36e565d-6830-4ac9-bc73-fe50310b92d2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661651, "uuid": "38769ee5-ee69-4018-a50c-48092392e26d", "value": "6144:ZYa6MXn2ASUvLOGw7G870PQwDJDv5cvDHrh2QJl4Uz0Vzy0vvyYiby6I+dugiq:ZYenpCb0fHArDJlWGEOxIID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661651, "uuid": "c64baadb-6f09-41e7-b546-e77057823414", "value": 388567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661651, "uuid": "8a6e2696-95ff-4f4c-866d-1031aaca1624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661651, "uuid": "b960e7f3-7121-4866-a232-3d70acac4121", "value": "New ORDER N. 2202325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171da42a-1bee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688641989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641989, "uuid": "427684e3-2eaa-406a-bd79-639845ac1563", "comment": "Malware payload (AgentTesla)", "value": "8541058f618f74daf31cc2757e04af25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641989, "uuid": "595f1fc3-9852-4aa5-a8f5-0cd1a04d40d6", "comment": "Malware payload (AgentTesla)", "value": "235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641989, "uuid": "a363ffb6-f2f2-4c8c-ad23-b4157f42e577", "comment": "Malware payload (AgentTesla)", "value": "ab2efc7c00b5b44c9db8e34e33f39201fa1a4930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641989, "uuid": "3d5d13e0-fd72-4c94-9a81-ca66e762ef5e", "comment": "Malware payload (AgentTesla)", "value": "a2669f203de1ea3a4b2b25bda1ab71c184cca7c3321b7f31904525a62ec2d0c2d9223df6717a2eb4a912304a3b757c85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641989, "uuid": "530e8aea-3c33-43ad-965f-efd193947c92", "value": "T102F4019833E3555ECE6E7FBC188807B9CAF96A063117C3478ED3745DED98E858A01263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641989, "uuid": "bbea4754-7ba8-4504-9d45-0b180ffee761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641989, "uuid": "5740f2e5-c23d-4e38-89c0-da81e2298903", "value": "12288:Nd6L7PVx9fyiQbhaDnLMzIL2q+RTdOL8BqRs7AVgkusqmp0ErQh8+i365OmX9u/D:eOOyqGUL8Bq9VEsqgB65j9GyTOxM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641989, "uuid": "a5f1f2a5-73f6-4649-802a-e6ddbe831ed9", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641989, "uuid": "fb2ba7f0-733a-4c35-8fbf-65409ff8571b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641989, "uuid": "1a0f7eaf-6f6f-4b1b-a786-ec3346116c90", "value": "235f214f8493ad0784c683df8ad2b3bb3fc4125d90b900ac44241acdc43a28fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6313d810-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678624, "uuid": "f06ed24e-ffd1-4953-ad61-1844b2c241a1", "comment": "Malware payload (Mirai)", "value": "7ff601aef5bf0f8b142a52ff63e3a792", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678624, "uuid": "0a86b4bf-7296-4d8e-ae72-46a7e8e7367d", "comment": "Malware payload (Mirai)", "value": "2367f6a939e0362ac8b181311d0dc14576eac4ad5deb7e773b3ed84a3b9709f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678624, "uuid": "8bc0ec4b-4a09-4383-a583-54c96f80b6fc", "comment": "Malware payload (Mirai)", "value": "eceed15f33c18d2027d05cba77797447f6ea4613", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678624, "uuid": "72531cd7-448e-4c6c-be68-23919218b8b5", "comment": "Malware payload (Mirai)", "value": "f340c9c83044b0e94434f6001a5b7eba411f122433d670a208e7dfa7f4515320244994fdf9dc44be741e04760c267200", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678624, "uuid": "f099dcb3-53ed-466e-9268-1354a411691e", "value": "T1DBF31AC6DF427E23C1C26BB5FADBD14533E39714D3DB2305A558AFB02E4BA990E16209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678624, "uuid": "a762a74f-dd21-4e3c-8c0c-321941d9a69d", "value": "3072:tVWOdudmVOEamHVKluyE1e0b2FwvKS3ngaTLtM/9RXUsZ:vduEsEamHVKluyIe0Br3ngaHtM/9RXUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678624, "uuid": "3c861bfb-eb07-4684-a439-a486fb6b0d28", "value": 163958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678624, "uuid": "d7b8b592-d141-4474-8408-81337b8c353a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678624, "uuid": "01ea9a4c-6f56-4d0a-aaa5-30ba74a6b8b0", "value": "armv7l-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400a404e-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623590, "uuid": "46fec3c9-3960-4718-9a99-d59b44f65650", "comment": "Malware payload (RedLineStealer)", "value": "82f2334a852c42338a1706b9e27b0fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623590, "uuid": "39730306-0979-4209-a86a-fb3b3597b9e0", "comment": "Malware payload (RedLineStealer)", "value": "238ade8a78f9019fa38240efc257f5246c699a9a20bdb0b0098a4df03508a070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623590, "uuid": "3029d057-52a5-4332-86c4-dd3db5de6acc", "comment": "Malware payload (RedLineStealer)", "value": "c0ab2b1d81630d96efc8d352ebc0da3fca9c19ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623590, "uuid": "aaf59f84-7c20-4c23-a83e-56839c27f2f6", "comment": "Malware payload (RedLineStealer)", "value": "b311c91d7466c9059eabc852629e022bad43e9a510badf6e670a737178e2b9ca8abcfa5ee5a94df7a27fda2f0ecbe2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623590, "uuid": "577da945-2a6c-4968-9cf0-0867979ca0e7", "value": "T18355AD05A09D1D5CC671E3B2BADC23523DBC85742A1DA13992E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623590, "uuid": "6b3898cd-7b25-4a16-baaa-3d50205ae167", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623590, "uuid": "4df56ef6-ae34-45af-85c6-6e29a1d08825", "value": "24576:2Jx1buwUS/lk5g+OsFK1TpQZRCodm9g02QKGYQkD8E:2J7KVS/lySsFSTpQZRCodmG02QdYQkD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623590, "uuid": "16054bef-f4a3-44a9-8fd9-f3b69142e4cb", "value": 1344329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623590, "uuid": "aa6d5940-2f5d-4cf6-ac8e-2254f08abfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623590, "uuid": "90470b18-1a65-4ab6-8de4-daec37ce0d22", "value": "82f2334a852c42338a1706b9e27b0fec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef5abdc-1c45-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688679718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679718, "uuid": "b7181c3e-1516-4271-bf73-c5aec888316e", "comment": "Malware payload", "value": "d9a0303f1ecff2fdbc8d01c241e3f9ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679718, "uuid": "7cab4216-6765-42ca-b36e-0a63837cfd54", "comment": "Malware payload", "value": "23997631433b5ddef861c11dc4c03f79be797a325980ed4ecc957152c0cfa439", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679718, "uuid": "76083ea2-4e70-4d21-9788-e9485e5eeda5", "comment": "Malware payload", "value": "2293511a924c86d850d3b6c13c2c5adee481e8c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679718, "uuid": "51d4c805-e51d-4256-b3fe-f3f7c8dc8b29", "comment": "Malware payload", "value": "00e20b04b6307e7e65b7e9bd0442d7be14888dbfe1c5ad37ee4f47ce6dac38227e492548c386eadc3da8592a07a27a0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679718, "uuid": "ba17f5a9-a253-4194-9b2a-f69e80e372d2", "value": "T1E6939D1339D0E072D497C870A0B4DAE16F7DF1922BA151873B5DE23B5F227D1533A2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679718, "uuid": "86a7aa6a-3d6a-4b97-ab5d-c5e5c16de051", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679718, "uuid": "c4eb6e8a-7eee-4c34-9f21-9dc1230bab44", "value": "1536:9kBCPG+3m3Z3f4AkYo21TWPuRGgydoppSX7qQwH7Pxs:+EPVWp3AI1YuR7y6pSXejxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688679718, "uuid": "dbeb14df-9c36-4474-8ffa-59e02d70eb45", "value": 96072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688679718, "uuid": "243e7813-d45b-4f05-bc41-3eebe2bc5907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679718, "uuid": "d2a8e65c-547a-49a5-8390-c70a8917b7d6", "value": "d9a0303f1ecff2fdbc8d01c241e3f9ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a44935-1bd7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688632271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632271, "uuid": "7b7980fc-a662-4cdf-a11b-465f8352e075", "comment": "Malware payload", "value": "6ec4691031b2a5e1d8816eb73c07b233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632271, "uuid": "098c073d-fa3d-4daf-91a5-b4fe98ab114f", "comment": "Malware payload", "value": "23dfa6cfe6934f193b23169c9d7a247cbf048c2e940fba477e00f6d8dcf15d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632271, "uuid": "fcf18ee1-ee53-4c10-80fd-208fff463c42", "comment": "Malware payload", "value": "96aa8823fa83ab9f42b20e6255f7f6fbf519ff98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632271, "uuid": "30b1a55c-f06e-4329-a874-7f51963ebdbc", "comment": "Malware payload", "value": "599719027df3c84101677ff51dbf630d8d5b790ddd310c713386b31501b6156cc6ea9e112eee752559ee045a48550459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632271, "uuid": "5e36522a-7275-4059-ba0d-73e6c6c13911", "value": "T1FE35125BF29195F9C56F4179C6552A01FA31B4210B32AFDF439682772F32AD84E3AF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632271, "uuid": "c17f3e48-0e52-481d-8a92-70e2480918fd", "value": "e6b2b6fdc8594a303c626ba3b13127a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632271, "uuid": "5cd5818a-7288-44dd-8afa-8ba493d06e54", "value": "24576:eY6IZpwvMfw21FLC4G7eXTMs6HBoI2mZn2UUxA:eY6IZpDfw21FLzGqXAs6hbZ2UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688632271, "uuid": "766102f2-f603-42f5-a123-ba66e9752684", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688632271, "uuid": "31acc23e-7040-4159-acaf-0c54274263a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632271, "uuid": "b8eca9f9-0d79-4f02-bfe0-9b1035478492", "value": "651B29E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c1dfb1-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678630, "uuid": "b69d4c6a-fc20-4bf1-9676-24e4b08d9d40", "comment": "Malware payload (Mirai)", "value": "f928a7a6b7fb329f7dcc739d32b2df51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678630, "uuid": "8c8612ee-e3f0-4dc2-97b2-68e58bfe8c02", "comment": "Malware payload (Mirai)", "value": "23f1058d0944f78b553883efc92cffb218fb044452c20f2c4404cc9e885c029d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678630, "uuid": "99f8279c-2e89-4c31-a016-6c0552226bb8", "comment": "Malware payload (Mirai)", "value": "781c3873f13cc29a8819a7d4a5b20847c470c1a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678630, "uuid": "6414a04a-c5af-425a-8b9f-1ec1e3040211", "comment": "Malware payload (Mirai)", "value": "5cb5d5bc5a83f556514bac4a1d92bffc5c86a00fc2a87113ea1841e7ec4a27842ef1e1de1b3eb085b2937e0e5004dd3a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678630, "uuid": "6b1fa3fa-af27-4bcc-908f-c5304658fa5b", "value": "T1EFA308C36A537DBBC5C7EBF4ABE6E02405E3B8391763125877D8EDA1595ECC8281C248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678630, "uuid": "05ccb7a9-30a9-4e26-887b-5e3cbc66e051", "value": "1536:2aNMU50DxRqrABVdUXtvWDa6xhsPk/Bn9BlGRhjOjWB:2QMLRqrAFUXgDlxOCB9BlGHjOjWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678630, "uuid": "aec2f2c3-bece-49a5-9608-903665c77864", "value": 106369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678630, "uuid": "0ceeb1b5-7dca-4e60-b555-1756ece7b063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678630, "uuid": "08819b40-de43-4cc6-8590-fad5222cb095", "value": "x86-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88f2cee-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688652166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652166, "uuid": "da0ce4fa-0deb-4b36-8903-82b970220943", "comment": "Malware payload (Formbook)", "value": "fec814b7deb0cb5ae9c125dc73e46f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652166, "uuid": "4f8678d3-7ad9-44e7-b802-7e00f92283c3", "comment": "Malware payload (Formbook)", "value": "244be6e97ebec790a323a32fc4fe43dade04804c07ae684191c4d527f5312ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652166, "uuid": "cdb419d7-4dba-4692-b09c-0711af276dd7", "comment": "Malware payload (Formbook)", "value": "07fe33befe485b5a3ff32f973000da0bb0a3a479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652166, "uuid": "43e0cd43-573d-4921-9617-ec82e0df9d73", "comment": "Malware payload (Formbook)", "value": "02ab5397a52b72c3b145d28ab54339bf739559cafd35bccd7ff79d067dbe3b79fb34e12fbad0039741050e44103930c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652166, "uuid": "a7c390c8-fa2c-4b3a-9382-06addf73702e", "value": "T18005E080713E2963EAB98BF90250527093F62E1FA65DF7E84CC6B0EB52F4F854641D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652166, "uuid": "f0f0ec96-561d-40d6-8894-84103eda6e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652166, "uuid": "aedb3ebf-2a03-4e60-b8e3-2bd0786ce63f", "value": "12288:ZlKnu5EXqXdVFWgoEnLS5gzpJc7yq3FGdTdGDqW8qHooW2ZVXJN2YvZDp:+I4qXdVsgoEn258oyDJnjkVXJfhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652166, "uuid": "72ea8e04-0693-4bd3-a745-61383462cc2f", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652166, "uuid": "0f84ee42-4c08-4c47-90d9-7ef0edf2c6ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652166, "uuid": "6a65a224-ecca-49d4-be10-980aad9f97ed", "value": "244be6e97ebec790a323a32fc4fe43dade04804c07ae684191c4d527f5312ad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dd4234-1baa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688613030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688613030, "uuid": "8e786147-8786-43e6-b9f1-50707ded7182", "comment": "Malware payload (Stealc)", "value": "af22e716a2900fbb9216b4b735b52cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688613030, "uuid": "df313639-2884-4e3a-8922-e01d5fe54b6f", "comment": "Malware payload (Stealc)", "value": "2457ee370eeb9302e4c64fb392fe0322f92347912e81eab4e81d354947db0c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688613030, "uuid": "eeca2e9f-b1bc-4488-8206-449026be885e", "comment": "Malware payload (Stealc)", "value": "4ad2506b865751008c7c50b7c60dd697198d5427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688613030, "uuid": "83983b72-2058-4abc-bf13-8c390eaba3c5", "comment": "Malware payload (Stealc)", "value": "4db732bf673cc7b1615a48a46048980a45904472a07b67b3a8c67ca88e17a95c0cc5b928ddeda240c80a1e33f0d45631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688613030, "uuid": "28680dfd-bf88-47bf-bda9-2ea8f4d06008", "value": "T1134733C462B0DDF0EE52E47A74B40FBA27A4D06127F05CC7DA11798A18FB3552E624AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688613030, "uuid": "b48a1b40-1d70-4440-9f8f-03dc764fd736", "value": "ff49fc5a9a7c8e3ae3ba4abbcff60845", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688613030, "uuid": "9aede525-d482-46c1-8fe9-a28c366ba832", "value": "393216:l59oDG1ngJ6nfX8tEtlz4c5ADd8QOTlLebSX7a1CAddf9ohUdJAL:Td1ngJ6nfX8tEt+D1OTIb6a0MZvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688613030, "uuid": "c3e7a08f-244a-45a7-9ade-56849bc81fbf", "value": 25814024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688613030, "uuid": "caca3fc4-f423-4435-aecc-efb9c54e7e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688613030, "uuid": "e07bd88a-f844-4682-83cf-c3fe617b459a", "value": "af22e716a2900fbb9216b4b735b52cfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14393fc4-1c1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661741, "uuid": "a8070aa7-3ca1-47c8-b784-c036ab27709a", "comment": "Malware payload", "value": "ee65c83461a36e951cef7462ed104978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661741, "uuid": "268fd2a8-6b05-4f93-9798-8f507d9c3109", "comment": "Malware payload", "value": "24d3636ff42996b6f1de62253abceb4daae94c2b0e963a40bedaeb1af76041a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661741, "uuid": "65d4c687-3857-4c42-a676-39fe594974c2", "comment": "Malware payload", "value": "ef04718256f78f9c3c3c46d17267f2794064e8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661741, "uuid": "f827e6b5-ed0a-4806-abde-fd6d38ac0bb2", "comment": "Malware payload", "value": "69eaa3b9aabbcdeb3ed1b28be21871f9a77e810578f1c298604c9c8565ecd70c60b891f77deece6a61f74286dbc5f775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661741, "uuid": "df2c20d9-7b95-46a8-926a-cb4d216c854f", "value": "T1D4B5285AF7B541E8D4BBD039C653622AF9B178644B30A7C786419B1B4F32BE0E93E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661741, "uuid": "2b001cd4-8b7b-4d84-a017-715f2f845987", "value": "7ad619d0eb6ec3995454fc92eb4bebcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661741, "uuid": "dfa63353-e6a5-48c3-bb25-088731b00f89", "value": "49152:zDILDssssssss3WaQ/4oUwyij8f6PU+Op14tQSn/:PILDssssssssyUwyijhU+Op14tbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661741, "uuid": "ca6db378-8b9d-413b-86a2-c7cc621db7f4", "value": 2394624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661741, "uuid": "a893daaa-5b04-42e7-9295-5e2411bfab4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661741, "uuid": "6099a411-aab8-4e73-8405-2c682454ccc9", "value": "24d3636ff42996b6f1de62253abceb4daae94c2b0e963a40bedaeb1af76041a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e723efc3-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688654364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654364, "uuid": "51a2f533-f67d-498e-941a-774ddbbb9157", "comment": "Malware payload (AveMariaRAT)", "value": "8e57f86bfc01765be16f25d4cc92793e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654364, "uuid": "0ec9ccdf-5361-484a-afcf-5393feeafe71", "comment": "Malware payload (AveMariaRAT)", "value": "250f31c1794ffd8511b85fc183fff5a1a15809498bfaae679d9fc7eddcda126a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654364, "uuid": "d67c3b02-8729-4d01-89dc-d3ccf44386e6", "comment": "Malware payload (AveMariaRAT)", "value": "1e55d68943716644217bcbe08507a5836fa0bc18", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654364, "uuid": "73da79a9-6bda-4852-b5d8-2ef45daee94a", "comment": "Malware payload (AveMariaRAT)", "value": "affe49402255da4cbaaf3cf76842b81b568575ebfdccbf595c758e54aab853aa01a852ce114941dce42a8ca7c32a3e64", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654364, "uuid": "938ac008-2d89-4b82-9f6f-7872c93ce308", "value": "T1A451E6B898485C27CC19053BC979BDB941D7F82E0ADC4E94B40FFA25187A692ED37E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654364, "uuid": "111cc7e2-a33b-43ba-9dd9-dbef26a0eb51", "value": "48:JPqNfkDA6SA9zeKHYcsK2FROkGOEMKoGnyWvi/xYbBeJYKj79h6nFay:0QALATs9LOvMIBqZYIqer6wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654364, "uuid": "fe1d1814-79f2-4b2e-a77c-6e34819e2c2c", "value": 3062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654364, "uuid": "558e0c28-52ea-4681-91b7-94e13c42fcfb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654364, "uuid": "06a33afb-0d6e-47de-b926-7ff02eafe55e", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.230.9640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a66197d-1be3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688637432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637432, "uuid": "995ecd4a-77b4-4ded-b7b2-3ab2ee633d4d", "comment": "Malware payload (Formbook)", "value": "fdcce1cddad53c6caa7c70d5fea375da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637432, "uuid": "b0e2a0f9-63bb-4bfc-8276-319e44e8e5e1", "comment": "Malware payload (Formbook)", "value": "252477ddf7161822a10afaca4c4322246669041ebef55db41b148694f0cce6ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637432, "uuid": "2c177573-2a83-4494-9346-c5a00c744bf3", "comment": "Malware payload (Formbook)", "value": "7a894258e685163e062222b785cf39ac00cc7c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637432, "uuid": "f5ecca02-d84e-41e3-a3c5-b1a0f67bd15d", "comment": "Malware payload (Formbook)", "value": "34857877fcaf80ccebb75ea4ac0ddc71dfe6795f296273c4471cfc7249584ba3952ca7dec83cc6e45e5adca74fc41d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637432, "uuid": "1f848e38-1992-4473-8e3b-9d01ff452366", "value": "T1123512017AD194B2D0B229769A792721B93DFE202FB9CEDF73D0452DDA229C0D631772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637432, "uuid": "69a6f653-d7e7-494e-aadd-182262638583", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637432, "uuid": "8c769016-0e3a-4401-b517-43a044397e67", "value": "24576:YTbBv5rUTX+yFHzuazKfBnX7SWXMdAfRd/L:aB4+6TVmRXPMUlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637432, "uuid": "37376f46-2d52-47e5-83ca-38e434bff516", "value": 1085173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637432, "uuid": "89d16b3d-8416-4119-8dc6-84f09f10d168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637432, "uuid": "8dbe327b-2bf1-4a1d-8518-92bf90cc9565", "value": "252477ddf7161822a10afaca4c4322246669041ebef55db41b148694f0cce6ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e0f340-1be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688636109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636109, "uuid": "6d8fb319-cd98-4763-a9ff-f2dfa7a17023", "comment": "Malware payload (AgentTesla)", "value": "7e6ae847033227fd88c5b0a743850dc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636109, "uuid": "19727352-9c58-43ae-b0be-b4664ddc6c6f", "comment": "Malware payload (AgentTesla)", "value": "256aac4e7028994ef1b2a0d4ee23e88c64fca975f7aebabd05d206b7996d9783", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636109, "uuid": "3e61bb56-c343-460e-a2cd-8601f8b0b646", "comment": "Malware payload (AgentTesla)", "value": "c1bdb264cceee51bbd7f7575b1323675358a8bf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636109, "uuid": "a88d137b-d2fe-431f-92be-859a33878331", "comment": "Malware payload (AgentTesla)", "value": "ebd9fd117362a8ab47d0b55d13d4ec58c94fda6142dce02b3b58eef141a722aa093e0a361bc2d9c6cc658f3c97903bf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636109, "uuid": "6588dc8b-eade-4e9d-99c8-3d9f5826069e", "value": "T147E3BEE46B8489E29F8D5B97A1695DCC6332207F9F8A20CC5015FBE62D737018E0DCE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636109, "uuid": "13594d2d-9f60-4dfe-a310-48a52b6eafd5", "value": "1536:LCu0yO+BHHE6/7tFTU23yZV7fYtilU5BPY9xQwZZTmDvY5SmvSl0JCFCTiQ7jX6J:10yrlh3+1S5APTscC22AFwnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636109, "uuid": "060d5fcb-389b-4a73-aa5f-de73459af403", "value": 155582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636109, "uuid": "ff84cb6b-7bb2-48b4-adc1-6a33d42bca04", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636109, "uuid": "c5d51602-3db0-426d-b4e7-a0753d1aed3f", "value": "RFQ NO. 1000033818 (0733-837622).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8bc86b-1c00-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688650105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650105, "uuid": "3ef6563b-4d82-47db-baad-1069205be7f0", "comment": "Malware payload", "value": "c99af397bf79b31eac3d6e65b3640033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650105, "uuid": "954de005-94be-4353-af5f-6fb05decd634", "comment": "Malware payload", "value": "25fb96694b126e76394f544cc30dac854dee43b0fde6c14f52c19f888359962f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650105, "uuid": "cbd5b993-56bb-41d7-b88e-0c0b9ffd173a", "comment": "Malware payload", "value": "d25c8506dbcf970ab3f544800a01587fb39c2c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650105, "uuid": "3ff187b3-8303-406f-bdea-1c5bc680fce7", "comment": "Malware payload", "value": "1e9ff1780ce25fd099377d3ce48754b2d8979a2f62efe138bbc75b95354a4623718b7b6b9f6639b5190691c72e9decef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650105, "uuid": "5bdb4461-d53d-45f3-8128-6b7c850d46a6", "value": "T17605A3807054E510E9AC32F65D39D4D0132ABF6A2C00D356B8F8BBEEAC75617CE5726E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650105, "uuid": "23048a85-63bc-4cde-a77e-4a621129c17f", "value": "12288:SGU1IKVue+AycZa/un2gTzeOd3Q3mBnJPyO:9+A32yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650105, "uuid": "824fb504-6b81-43f1-9236-1e20e0933d51", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650105, "uuid": "6cc8d354-1c56-431a-832e-c54ce959b234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650105, "uuid": "3942efee-1a0a-405d-be88-ef60b8f8b8d1", "value": "25fb96694b126e76394f544cc30dac854dee43b0fde6c14f52c19f888359962f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70261d84-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623670, "uuid": "583d3c9a-8887-4ce2-b867-123cf3f9da88", "comment": "Malware payload (RedLineStealer)", "value": "aa92d22b300bdf998e62b9d3a137b05a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623670, "uuid": "d976797a-a2ab-438f-827d-57cc5e220a3e", "comment": "Malware payload (RedLineStealer)", "value": "262cfadaa7d3802e485df7662edb1e1da1ab8cac9275239378b6ec3f67ff6d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623670, "uuid": "46f6c358-1c93-4412-9b21-6b2eccca767b", "comment": "Malware payload (RedLineStealer)", "value": "a370158aace3328b6f6339fa7c926fc875294049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623670, "uuid": "aeb0c194-ca2b-48ee-b419-4f7ed89a6da3", "comment": "Malware payload (RedLineStealer)", "value": "d74c8bc14df0dd6918d5b43a419d1788fb57e0606fdb907041e8d47998895f7134a89733bdb3d13d58b57ddb7e65fe05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623670, "uuid": "34c45fcf-ee82-4644-a7a4-3d1c23e3fc40", "value": "T1AC55BD04A09D1D5CC671E3B2BADC23523DBC85B42A1DA13952E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623670, "uuid": "bd01eba2-c4a1-4310-98a1-a146b9061693", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623670, "uuid": "d826f34b-29fd-4dc4-81e5-01b04fad548d", "value": "24576:A8sM+ijUP2JCrNt5tKhGGsZ79riyBbAMg71xODOUssoPZeN:AnMW35gh6ZpOyyMg71GObsoPZeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623670, "uuid": "3c4f25d8-fcba-4418-870b-c98242b3482a", "value": 1344331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623670, "uuid": "0fe71bd5-a734-4295-8709-441d1cec0c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623670, "uuid": "ba5678a6-5da0-4ba5-b7d3-bc473ffaef52", "value": "aa92d22b300bdf998e62b9d3a137b05a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879103f6-1bd7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1688632300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632300, "uuid": "94d81023-f2e2-4dc9-ab19-a959c8220efb", "comment": "Malware payload (ModiLoader)", "value": "4544acda453bbf8cf375a8b2f44e2338", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632300, "uuid": "82760831-f4dc-4a0c-92b2-e42c38e736a3", "comment": "Malware payload (ModiLoader)", "value": "26678c5ee8beb13a2b78021ab916614fa81510c955bce194dbb0085dab487960", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632300, "uuid": "f905c8c6-1bcb-40fc-991c-d7630fb83c24", "comment": "Malware payload (ModiLoader)", "value": "6db48e1519e569d1056b1c46d4e1cc4e579b68fd", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632300, "uuid": "1d4f3a84-549c-4452-9671-f73fdea5addc", "comment": "Malware payload (ModiLoader)", "value": "b146ae002f3d672cd3ae40abd6e3852c49e560e38a460fe4cde4ba8c0621f63d09561eac63da29ac6af98e58e78942f2", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632300, "uuid": "b0507479-a82b-4724-8578-c8956a54e076", "value": "T197159E15EAA04C77D4666978CC0B57B96828BFA03D355443A6E83E4C9F3E7813829F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632300, "uuid": "eb3fe691-b93b-4f7a-8192-93336e569181", "value": "f5b94f87a323eb9c8534a95d7c6241cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632300, "uuid": "7366733e-e5d3-4f1e-81b3-cb7853a6e917", "value": "12288:/39wCUzsHZGNTBQ+qqKY6kROWtMgPHY796WAQvXZb0nSojh:/twsHZCQoKY6sLHY796WAQvpb0Sot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688632300, "uuid": "0f084d2d-4966-4d19-914b-6467fdd1e729", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688632300, "uuid": "88f930b3-dd2f-4c56-8f30-ac8f80b60f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632300, "uuid": "719614f6-12f6-4e4f-bc7c-a2505f9f9efc", "value": "DHL_MS-PPT_881220128163_10TD01_20230128_17377 PPT.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da29888-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688637786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637786, "uuid": "c04df58c-c154-41bd-b219-15afbaff3816", "comment": "Malware payload (RedLineStealer)", "value": "4718fd36e2067ed424f4bd2163115098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637786, "uuid": "a9b09733-61f5-4e7f-868b-26d5beb22e84", "comment": "Malware payload (RedLineStealer)", "value": "2669ceb812f0d7c57186ac6565c5efced88dcd7745c8c56a89a18ef367dee591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637786, "uuid": "321fabcd-29b4-4d00-a089-8a52141ae9cc", "comment": "Malware payload (RedLineStealer)", "value": "8ab504f41acb1b8631eaccf6cbf0015fd4ee5161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637786, "uuid": "66d010b0-76c4-4b03-9708-0e76aecba3f7", "comment": "Malware payload (RedLineStealer)", "value": "30d92ec28b499bfe1075fc60833c16e9d3886728601b21036dbd2033c82d7ab39c1234c1d8b0c66383a9e0139300c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637786, "uuid": "9182ed2d-cdbe-42eb-b230-c740956a67b3", "value": "T146160009216E9EAFD83535B027CC1943F9AC6471275F4E5122C2EDEFD8ACC81F6918AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637786, "uuid": "12830858-8965-46a7-95b2-d3e64cc53bab", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637786, "uuid": "c393db01-ee77-4415-bbd5-859a7ba6218a", "value": "49152:KCK3ADSVWhlgHRRzfg47ca9FNxEbZAihJ215gbY0gNgOrqhSRYBqz48wnT+OnIIc:dzlIvjzN2BJgkBD8+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637786, "uuid": "66597403-1adb-4c3c-8066-fe2528c692a1", "value": 4067656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637786, "uuid": "78aa98dd-0544-4449-bfc2-7655a38c6d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637786, "uuid": "3e1b4e87-6fdb-4014-a9ed-992eedf745c5", "value": "4718fd36e2067ed424f4bd2163115098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c85602-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623443, "uuid": "95d9f6f9-610e-4c68-a140-887a3a70bed6", "comment": "Malware payload (RedLineStealer)", "value": "46b68d88ce375bb605818709d1845913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623443, "uuid": "89d88529-9941-4bba-a9b5-8cc6a1823a3c", "comment": "Malware payload (RedLineStealer)", "value": "26a5a7eabb7b7a08a41ac73226e615bc272671efcaada75d4367386a125a152d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623443, "uuid": "8deadffa-0458-4a98-9a46-abbd3a705627", "comment": "Malware payload (RedLineStealer)", "value": "1f5118f3471f587f4f284634983642bd8b1f86d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623443, "uuid": "017accf6-e6d9-4410-b961-019f58bb6cc5", "comment": "Malware payload (RedLineStealer)", "value": "4bd236494fa1ddc3912aa6fd9f64cca306537980f72988f0fc760b68218b67ca4243c2936aa13b64374418c1c4ceacdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623443, "uuid": "84ddb0d5-14d9-44d8-95e7-c72eccd866ec", "value": "T14F55BD05E09D1D5CC572E7B2BACC23523EAC8874291D613952E21DEF95F9D0E72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623443, "uuid": "06f3373e-0bd4-4f91-960a-a2c41b368706", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623443, "uuid": "52ae7562-548e-491b-ad09-e660e6a97900", "value": "24576:8USFKRmxaSBggiyQSpXQJnuJvH4IEPxxZmAS:8VF8IggiypGWvFAZmAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623443, "uuid": "029779d8-6937-4a06-91e9-8e03620f6b2e", "value": 1343822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623443, "uuid": "6329d9b7-8b30-4f6e-aab1-8c94e2014f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623443, "uuid": "33bb4d14-460a-4723-81d5-ed558e5e3276", "value": "46b68d88ce375bb605818709d1845913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fb2f70-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623757, "uuid": "1bb1e4ff-8c9e-4ec8-9bcd-bf8c5daaa22d", "comment": "Malware payload (RedLineStealer)", "value": "605b6d5b830274c64f27d3038c63e718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623757, "uuid": "052dd620-596a-40c9-a893-c14ba78ce23a", "comment": "Malware payload (RedLineStealer)", "value": "26ec2156d8ba3e25a3d0149cf0e2d31babd3f2082d4642802a7fa0866d234bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623757, "uuid": "e56eb706-0870-4dac-9891-c6cb1dfaba42", "comment": "Malware payload (RedLineStealer)", "value": "9c1c204ac934cbcd9d181315fd83d52cc092df97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623757, "uuid": "9fea1338-c944-4c8e-808a-88285652aa45", "comment": "Malware payload (RedLineStealer)", "value": "84d3f9d5761cb43c3867bf6bf8eca5aa90107a1c3e0382733f2d88d92702d1eca5453dfb9562dda0afee4fdf81bd6ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623757, "uuid": "1a85d974-4569-4fde-8a52-1319b8766240", "value": "T1CA55AD05A09D1D5CC572E3B2BADC23523DBC84742A1DA13952E21DEF99F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623757, "uuid": "8982db3b-ab8e-42d6-9ae8-5d78a4b6af57", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623757, "uuid": "63bd3a2d-2f36-4af6-8d37-e8616d6a6410", "value": "24576:OkJccaNqPsIClzVJCFcMALT3GxXclLL9XWCycUO:OIGqxClmcMA/GxXcd9WlcUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623757, "uuid": "5a89cdd9-2025-4db1-a67e-b4e8cc7fa14f", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623757, "uuid": "1d2b7cb1-1a39-4549-9a8f-0def4dca28ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623757, "uuid": "da0d1d55-a2f9-4f87-8c6a-f121b3b0e9ae", "value": "605b6d5b830274c64f27d3038c63e718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b2c11-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688624132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624132, "uuid": "90fcb962-1db0-4a5e-974b-3fca5d0026eb", "comment": "Malware payload", "value": "fa46be511d4bf793f9e8ef28b412ed21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624132, "uuid": "cc10eba7-f429-4614-a1c8-036ac393795e", "comment": "Malware payload", "value": "278305d714746ff033e5b15a7b93a26ec56fbf9f32a8b0cd036b352667fe8c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624132, "uuid": "ce045571-5bdd-4b09-af8e-5aeafaa03f32", "comment": "Malware payload", "value": "e1e2f6863cb70d6ba4377a33199a643eebbb6471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624132, "uuid": "10aa2a27-0eeb-425b-a6b5-b2d5eedc1b9c", "comment": "Malware payload", "value": "b31ca565bee716aab7122ee79c9c030e3ac683125553864835fefdd25825ff10a30b53d10e7eba6c6eb68e45826d974e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624132, "uuid": "c01844fc-99cf-4919-98d3-ac2efca5b459", "value": "T12B652211B6C28572E926193406E6A7B1BB3E7C301B29CED79B541F6E8F305C18E36B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624132, "uuid": "facd5a3f-589d-49eb-aa17-864a5b7f3067", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624132, "uuid": "514d2af6-2ed0-42e1-93b7-09f7e56350bc", "value": "24576:JLllLl7tEt7URtGdtQsKbmaQrn4EF8TXrdpT6qzlSYimfmb1cAt/VttNu:hllL87URtGdtAmaMEXH6mR+biOtfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624132, "uuid": "e0932fd2-6013-4441-ab10-7e75f70f6cb7", "value": 1424431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624132, "uuid": "5b346ec0-95c4-4871-91e9-f61f700c3398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624132, "uuid": "9f07c1b2-3f7f-4a46-bb11-90ab1920ec0a", "value": "fa46be511d4bf793f9e8ef28b412ed21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef9757d-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638110, "uuid": "0ea1c538-5884-405a-90a9-d228d84da254", "comment": "Malware payload (Amadey)", "value": "c9f6f05cd6edcef6f6600a301a3b4dfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638110, "uuid": "b55fb2be-dd2b-4944-a5af-7cc73d29558e", "comment": "Malware payload (Amadey)", "value": "27c447b117d70d5d16fc5186438449e690cc09c35f0695b85721fd345d97f219", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638110, "uuid": "5adec20a-f5e6-4ef9-bf67-1a8d3e598c5d", "comment": "Malware payload (Amadey)", "value": "94c45c83130dde6ae3237433a5ad97601354e6f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638110, "uuid": "6e7e0e4d-9ce9-4ceb-bee3-2ba60f744c3a", "comment": "Malware payload (Amadey)", "value": "4e74a498a8e7395ec1b6945e4273a0a2b62f180bd74a705ade6bbda2354de56ab36e5631218e159dbb840dc04d600d04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638110, "uuid": "bbad2131-5bd1-431c-b758-4c5317524387", "value": "T188060112608C8E5FE536757527DC4423FD6CA1B8EB090C8522D66CEFD48DE83F6A668C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638110, "uuid": "546d5f25-45dc-4d5b-b859-4ee504a0b966", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638110, "uuid": "becde0c7-1c16-403f-9cee-5f738b8ee658", "value": "49152:JkwlBLjpMkfNvaJJDBLeT0cNgftAEXqp35kaxqtBBgRXFrClORR2Io8BRgJdoq7c:LgfRqrikWU2d4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638110, "uuid": "b2dc37ed-7f0b-4c0a-bc38-7f727fb4c178", "value": 3770184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638110, "uuid": "1f20d318-f9e5-4570-bd70-a07c7f1d6508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638110, "uuid": "40ccd3fa-b793-4059-897d-85db423521ee", "value": "c9f6f05cd6edcef6f6600a301a3b4dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e0d600-1be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688636104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636104, "uuid": "c348ed75-6e4c-4bb5-87a9-dd76a3229f87", "comment": "Malware payload (AgentTesla)", "value": "285b745ccec34de6f51cc6ede37cd35d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636104, "uuid": "6fe8c9ef-000c-408c-870f-dcd67273769c", "comment": "Malware payload (AgentTesla)", "value": "27d828e79ef1c0b2a643e253cfade420b0c37a343a829949ee8e7bf1fb7821f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636104, "uuid": "bc211233-d366-45e7-b047-a28de3c26f70", "comment": "Malware payload (AgentTesla)", "value": "c8d5c8eeb99c4ef443bcd4fb609d82b8357d093c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636104, "uuid": "8ddb77c8-89b2-40a0-965d-8d15ea247759", "comment": "Malware payload (AgentTesla)", "value": "aa6f7974a29b79dc8db243ecad30122dbd291f4cdf9b1168831ffe7647011a5631c503d4982d578afbb74011d4751850", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636104, "uuid": "fa1004e5-eb87-4c89-9d0d-b2d2b8c72c78", "value": "T11FB4239AF1D2A9166FD70AA4EB534CBDD3E822B0C71C60690585AD63C70F26AF0F4D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636104, "uuid": "a5ca130b-301d-4fca-ba3a-00b1b8875af2", "value": "12288:vwdhM9AgdD26HSeAsTRTj86rW9JfCuxDg1Em+drg+lSn0FT:4dhkASqsosdwagfnxDg1ERPldFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636104, "uuid": "86c1043d-b9ad-4324-843c-ab8bc2cf97c9", "value": 505586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636104, "uuid": "0384233e-757f-4a4d-ac7d-2490e5c6f0fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636104, "uuid": "e9234f9d-c1da-4e52-a83d-db99f24667f8", "value": "CV'Profile ~Admission.Scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eefb0bc-1c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663638, "uuid": "d9a685d9-e7da-4079-b02a-cfa57b75c85a", "comment": "Malware payload", "value": "ee8109d3d94b76a443025fc9ea06f07c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663638, "uuid": "44bc252f-4d01-4b24-9614-2dd6968778d4", "comment": "Malware payload", "value": "2817e17cbaa3588d1f1d8fb8a371489693bbdea53a05a34fac71b41bf91e7081", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663638, "uuid": "1e984d35-0376-4888-a80a-f5ef6f5859d7", "comment": "Malware payload", "value": "ee015bd5e9a4434b404a436eb00b9866939f1f22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663638, "uuid": "1bb39f46-a646-4eac-9f16-ccce1ebfcc59", "comment": "Malware payload", "value": "72467adc1a50b6d1dc785dacfd4e39e89a932f6cbca53bf807f4638d283dcb18454b600abd4782a9bae2cc6eb06830ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663638, "uuid": "67b23303-c989-4a97-aabe-0415767f8963", "value": "T159A44862A7FE1248F6F7BF04AE7916654E7ABE92AD3DD01D0260114E4971E94CCB0B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663638, "uuid": "ccf1600e-bf04-4cb4-9e13-994208b794ca", "value": "6144:B0qKirP5U79tBfSbgXXR42WRzGK4iQ1x+UiyiW+ZHV2e3:qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663638, "uuid": "859450d9-3848-4f8f-bfff-b38e165245fd", "value": 486534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663638, "uuid": "3ba902f8-49a7-4751-8a41-1346631927ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663638, "uuid": "fe778d82-ed2a-42a1-8022-4e9ebf391b4c", "value": "data_6_jul_3432437.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3450de20-1c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688655353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655353, "uuid": "11cb48aa-8981-4f77-835a-36f9c71e6b4f", "comment": "Malware payload", "value": "abf3fb28c2d2e17c9b1bcacd36ed890f", "object_relation": "md5", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655353, "uuid": "db14a3da-376d-4efa-a5a0-ac9a8cfeac64", "comment": "Malware payload", "value": "28549faab4a2757dc4eb922a7ad3bfa7981f9a132218ae530856ae6da3bc03e6", "object_relation": "sha256", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655353, "uuid": "56dde30f-fdd2-4ad8-a7ea-f44af62fdda5", "comment": "Malware payload", "value": "a465f84d8f77193a2a4ca50c3ac309f60d12c604", "object_relation": "sha1", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655353, "uuid": "cf0029a1-b0b8-43ab-af77-276ac28e4fb1", "comment": "Malware payload", "value": "c0b92d865781fe789b0ae98984a5778a42487833699b8b3e0c80ae1bfac91cd3392cc8b61b419d064c7b5a71bbee6345", "object_relation": "sha3-384", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655353, "uuid": "801c3312-509b-44e5-9b2b-d2d4a7642396", "value": "T13B73D8D668076D97A283C41F0186F963561CA0079D0C6438B6BEE3D9EF2E9A9C1F4CF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655353, "uuid": "23b38300-45e8-410e-8018-4fcdf6d355be", "value": "1536:/HGZS2C+WUuj70wAXvbpwpY+w00M6llsuKvW5+4Roh0f:/HGZS2C+WUuj70wAXvbpwnw0iGuKvRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655353, "uuid": "e16529ae-8e95-4f1d-a3cb-afff3867b7f3", "value": 79309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655353, "uuid": "91a0f25f-1a8f-4816-8980-a8f6d757d386", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655353, "uuid": "1dc79f91-5bf3-43c3-ad77-6b363434a18b", "value": "installer.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbcf059-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688637997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637997, "uuid": "7c2e3196-8807-4fb4-96fb-e8fed928209e", "comment": "Malware payload (RemcosRAT)", "value": "493f5adbdac23a33d86bf9f70f69d6d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637997, "uuid": "dc3fcf51-a983-4e86-9634-440fbd6ae79f", "comment": "Malware payload (RemcosRAT)", "value": "286b8ef7610f9448e729a7216357dad81b5f62ef866c31d2636358adce2c36de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637997, "uuid": "956b0434-84c9-4fbf-b2a9-f68d4d2d7a76", "comment": "Malware payload (RemcosRAT)", "value": "f9b18f12f6aa5b23d16d9ff3a567c74f231aae20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637997, "uuid": "0c0f8b2b-7fff-4fdd-9446-37140e47dfcd", "comment": "Malware payload (RemcosRAT)", "value": "384f73a84b0e3dda2ad1722bd941dafde8cdc205baa0f559658cd13a822c6925a45d2134784527027c5f86517caa2315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637997, "uuid": "d045b64f-9842-4972-b69a-d26e2b6c6eb3", "value": "T12755F6790D4266DFD1BF932A90E81D1FFBA1A846FE56F94C78C2038B31A264E76C510D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637997, "uuid": "a6dc689d-6f70-49dc-8f69-20d4e5b790db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637997, "uuid": "7eb555a5-2f77-4757-ba89-73f75af4a358", "value": "24576:8nTZB1DdNZmFE4BNCVZ6r14XpfFLPjGa8:8DDUEm+6r1yFLPKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637997, "uuid": "79b14dcf-e446-4f76-b82e-2f3d1dc23a22", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637997, "uuid": "611a6905-12ee-478c-a631-fd46c1353ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637997, "uuid": "850b85bc-dc0a-4972-a870-e70410a12f52", "value": "286b8ef7610f9448e729a7216357dad81b5f62ef866c31d2636358adce2c36de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119f6335-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623941, "uuid": "c6503ec3-081c-406a-acbe-6cabf982b36e", "comment": "Malware payload (RedLineStealer)", "value": "8f928a6d3421be20243c91dab9240f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623941, "uuid": "fb93e074-202c-4707-99a3-c8003169d0e3", "comment": "Malware payload (RedLineStealer)", "value": "2892b6bc692da1c048501118790c77b7182823bf8e26c13467038105a88c875b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623941, "uuid": "debfe5be-6756-4288-aa99-41871eae6737", "comment": "Malware payload (RedLineStealer)", "value": "a2af3bb4e1d5d2cf2e150c0e16a5dd939c3433a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623941, "uuid": "9aed783e-a85b-4f97-a7e6-cc350a0ee79a", "comment": "Malware payload (RedLineStealer)", "value": "d129b901614254e67610a6db1581e140c44d2b5af94e0096ebd45eefdda1abfcf4be1dfd55b189d3e9496df882fbfcab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623941, "uuid": "7aa71881-e919-4617-b6ff-668d99a23a3a", "value": "T1DF06011124AC5E6FD03A3A3663DC1597F86C6030DB1E1D4522D6ADEFC99DE83F6A248C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623941, "uuid": "0f51f2b4-c21e-4ca4-a1ac-4587c68e48d3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623941, "uuid": "72a52df4-f801-43c8-a621-f1ddee6fd038", "value": "49152:ft2cshqIMQvUlZdUs62vGuUv/GHm5zwa+UtgrMtMuRLD5lmOj/R+Kr9axPzVTmks:0cskU9wargsz3j/Me9wRSX5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623941, "uuid": "ed29a317-9c50-4b2d-b7ae-36afcf5d5817", "value": 3792200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623941, "uuid": "c0882e48-78f6-4d8d-a3c3-784d8849f2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623941, "uuid": "4a7b0b3d-af5f-4fb4-8b92-014ef67139fd", "value": "8f928a6d3421be20243c91dab9240f30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e3f244-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688637070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637070, "uuid": "d193bcfb-d158-4ea1-9de5-8a1872ecd2ef", "comment": "Malware payload (RedLineStealer)", "value": "12919c876e703024ed39366eceb1b0f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637070, "uuid": "ed170c85-27bc-4285-9c89-d8a795b04604", "comment": "Malware payload (RedLineStealer)", "value": "28bd123d3697792eb060b50b12f98fc087a3a99358955c6f271cfea52221910a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637070, "uuid": "0a47f893-75d6-46d1-8778-340bb6baff2a", "comment": "Malware payload (RedLineStealer)", "value": "c2205ff4c92084cf07018e8936d6523c52e1572b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637070, "uuid": "1205e34a-0c3b-42bb-8178-8a1b42c2ff23", "comment": "Malware payload (RedLineStealer)", "value": "205dc702c5a07f5de3489843b381fe334b8798768c51484fbe4d2249de76767f320aabfb425692b5edaf0cbd35bf6f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637070, "uuid": "30d353a9-5c39-4092-8f3c-b85ee09c1aee", "value": "T1E944D02135C0C2B3C0B7153145E6CB395A3A70725B6A95D7BADC2BBA6F213E0A3361CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637070, "uuid": "567fdf02-c0dd-423f-8d88-4fb6deb8beb9", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637070, "uuid": "8021ddc5-7886-498d-80d9-76d848be8906", "value": "6144:zDKW1Lgbdl0TBBvjc/4jMaSUYpY8uD3oF3ATcT:nh1Lk70TnvjcETDYpYnD3AAT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637070, "uuid": "7171926e-6c12-428b-be73-451cf732e887", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637070, "uuid": "efb42ff4-985e-4196-a890-2b98cec38ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637070, "uuid": "647991c8-7f20-4bbf-82e9-f042209add45", "value": "28bd123d3697792eb060b50b12f98fc087a3a99358955c6f271cfea52221910a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7fb8d6-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623424, "uuid": "8a9c29f7-7a43-4364-b664-f0bc0ee0cc12", "comment": "Malware payload (RedLineStealer)", "value": "8d652f16fd29713dbcd0e322648caa7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623424, "uuid": "52ff8575-3675-42b6-b7aa-fe944b74330f", "comment": "Malware payload (RedLineStealer)", "value": "29683ce78fdffb1360c16c1045331bd2a85854409e552989a1b31f6a89907783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623424, "uuid": "1d0f93a1-76f7-46fc-aced-c85db7fb635b", "comment": "Malware payload (RedLineStealer)", "value": "e111a888c678344b9af9687f528a23461fe03482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623424, "uuid": "e832eb22-de43-41aa-82e9-6f424c81e45f", "comment": "Malware payload (RedLineStealer)", "value": "b0a955bcf39ad4893f4249cafd90b7bbc86247d6c39490f705d8deceaad507452850ecacf9ef5e1fc853fcdbc8118317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623424, "uuid": "ec4531af-75c4-45bb-ac01-87ced8177244", "value": "T11C55BE05A09D1D5CC672E7B2BADC23523DBC8474291DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623424, "uuid": "936dc0a6-6527-46f0-93ed-b0633c82c057", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623424, "uuid": "eb2e44ce-b5df-426c-849b-a1a4e0558663", "value": "24576:tUi2dGfYU5xpaCozrddBehxOFEYjIj2l9Vua/:t7g1CujB6AEYHPVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623424, "uuid": "fadc2237-332d-45b6-849b-7f85b36c6363", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623424, "uuid": "6b8e7f75-44cd-4029-869f-932d1194c9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623424, "uuid": "95abe565-1327-42b8-baca-a313def41dcf", "value": "8d652f16fd29713dbcd0e322648caa7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be1ee7e-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688643017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643017, "uuid": "17d32648-cf34-435f-871b-f6d37dc127e4", "comment": "Malware payload", "value": "55df763b7416512ab6feb71b8ebe7f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643017, "uuid": "804f7651-faac-41a7-b47d-bb32ef0f0a4d", "comment": "Malware payload", "value": "29ce3fb20340e008764e391f60b975da9a556991118c7313598cbe6bc8a805a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643017, "uuid": "5607d770-f191-42b7-8a02-f9dcb80923ff", "comment": "Malware payload", "value": "a512fd0069901c77744bfe747820835eccec3d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643017, "uuid": "9f3ad21c-afee-4bc3-9d7d-d11b5737b192", "comment": "Malware payload", "value": "9bf492b58d10d9c5a5c3cd45847f630bd4fd39e0e1ebf67ec5ce63e7de324d5861b33ef80fe056e5cacd1ea97bfe8854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643017, "uuid": "2ec29abd-e14f-4790-8251-9b4863123855", "value": "T1B3459B3AF21FF192D0D5F038E0D1624156A76C9E3E4C6A7A3558E621DA3AE847E07F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643017, "uuid": "8699a2cf-e937-431d-9b50-b9fffc408f2d", "value": "4283d818ded90aac29cacfea6647de44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643017, "uuid": "cd308f90-dde2-4a9b-abb7-a1b74d0cbba6", "value": "24576:TMGdkFxQsdc3nXyrG4Cuzf7D0AQJPb1Y/Jk40kDkTkOuIcSO:TM+8Bu3nM7UYhk40a2k/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643017, "uuid": "e94b1c51-7e5e-46ab-83ae-03e7092cf8fd", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643017, "uuid": "4f145288-8013-4516-a2be-0bd655f268b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643017, "uuid": "1fcecb89-aed6-4658-8c0c-966f97ef7f12", "value": "1737D7FD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f897a98-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623938, "uuid": "c808ae65-3cd0-48ea-8e01-745d912317ab", "comment": "Malware payload (RedLineStealer)", "value": "cdb902807aa4ee9c4777184062e11342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623938, "uuid": "6d38a0e7-50e4-402f-b9e5-e9997a24e7b8", "comment": "Malware payload (RedLineStealer)", "value": "2a0532009b3e0e78531711b3d2d775bbb83700179dcb1756d0b03938fb1ea7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623938, "uuid": "8340bf6e-9131-4ac0-93d0-5856ecefcda7", "comment": "Malware payload (RedLineStealer)", "value": "dbb2eb7ba496f70e82cff2211d02fe47a5da865a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623938, "uuid": "8271f44a-174d-40f8-aa0d-2ed277c70638", "comment": "Malware payload (RedLineStealer)", "value": "669f6198b4db85d04648ee8c0ab65db8629e8b1e1543640551005754770252f20a441da08ea27579b1eebcb29b7d967e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623938, "uuid": "a9d0ca33-83f0-4615-bd17-d50218d92a7d", "value": "T1EF060101605C5E2FE53A357937EC5853F96C90B4DB090D8222C62DEFE49EE83F2A659C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623938, "uuid": "b913fe8a-64ed-4b2e-bafa-770af966d877", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623938, "uuid": "a0558d55-dde6-4dea-9501-7c0258ebfd58", "value": "49152:cHGFL5UbuCUmq/TJDVOVhbN5T5PwoBmHQmU2rTYDTRpnXqDhdfKKgyyWgozrOI82:tyoIhmHIDgZKWrfpbZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623938, "uuid": "92c35c95-7f00-49ee-abbd-74450392d5ae", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623938, "uuid": "0022a864-32b9-4ecd-80f0-fd4b05d2b9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623938, "uuid": "a2083c60-421f-48bc-8c56-e12614755c3d", "value": "cdb902807aa4ee9c4777184062e11342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f4a8f0-1be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1688636105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636105, "uuid": "230950fe-a399-4e0b-9588-06ce9d4f61a4", "comment": "Malware payload (StormKitty)", "value": "84f321203e4bfe709180e7eea42823a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636105, "uuid": "aeaff6dc-33c0-4fa3-ae5b-69fea6c18738", "comment": "Malware payload (StormKitty)", "value": "2abd2490ab6bfc2a7fdf5359dd94cfa43b2059e25ab5389d1f9426b2473d175f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636105, "uuid": "61466b93-8bb1-412d-8b42-a0876bb2f472", "comment": "Malware payload (StormKitty)", "value": "1e0b0d84cfb15b4ac8e0dbb688b718f13fe4ca0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636105, "uuid": "098f3e37-1160-4344-b473-f52a6032429f", "comment": "Malware payload (StormKitty)", "value": "2bd8091940d18e4301608283279d55aa8007247b4cd2175cae2451eacd710dc485f453ec2c94ff6c012b5981d3029666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636105, "uuid": "83a7ac6d-e3b3-405f-b3bf-9af5f548f55b", "value": "T1D9D46B3C1CBC7223C174F6B28FACC421F654956B3E518E3765D39999061EA0269CBE3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636105, "uuid": "0cec7a0a-4e7f-4d56-a9b0-7e69116a8f0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636105, "uuid": "b38d75d1-fe7d-430a-b882-d8537a087c1f", "value": "12288:t/iIGb2cB9Ba2FP+hBnruQ61jtiWdemP7eLWupzmseK3JXjE:7GzpFQRre11tPCiGzmsHJTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636105, "uuid": "5a3e679c-1ae3-4585-a195-64a2c6adc1b0", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636105, "uuid": "23b86a62-6917-4e31-ac2c-60788545182c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636105, "uuid": "1bd33a9a-a57e-409a-b46f-c3c1b4add765", "value": "PO-2023EX268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56178f6b-1c0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688656268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656268, "uuid": "8bab691b-6c73-40c2-ab86-581922a9fed1", "comment": "Malware payload", "value": "e415186a6a2209817e01f4ec932f3c9a", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656268, "uuid": "96580f2b-f9e9-41af-8a54-cb1b89c4f89a", "comment": "Malware payload", "value": "2af0e212ad70eaf8b96a645045ef2764700b5adf7b1187ae3d82240f96f613e2", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656268, "uuid": "f31dda0f-db7f-44b3-893c-5eef73f0e14f", "comment": "Malware payload", "value": "091f960fe4317696fb30abc3b36d2c8a7eef4b65", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656268, "uuid": "1bfc5197-271d-4214-8573-a660a7c6a8e8", "comment": "Malware payload", "value": "dccff4e18c501a499a2c88111abe469a66d02d14486b6a34b4177bdc45bc8c104868deef270d80c1cd179f3d7a61b95e", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656268, "uuid": "2fd15765-f1b0-458d-a530-3200f4343fb4", "value": "T1F1767D27B9A54A74D287C03049DF83A26B71F9364235FAEB1775E7391F22C128B4D34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656268, "uuid": "bc16deb2-a905-4cab-b2e2-e6714325f562", "value": "98304:Wkl7JAfQ0RAQvv54nrvTssssss+f3Mj8L9QyS8Xceh/MfSPnaNhlWPSPSt:FlXPssssss+48RQyS8XhaNhlWBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688656268, "uuid": "6a3ddc46-45c3-4c51-afc0-5e8437310e54", "value": 7695008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688656268, "uuid": "eac457c2-1b8a-4f3f-8c70-a8a439b33203", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656268, "uuid": "eb19aa22-d272-4ffe-9614-40770f1fe6f5", "value": "realst", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6498d5af-1c40-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677338, "uuid": "f02e40ac-e709-4edf-bcc5-044086243b55", "comment": "Malware payload (Mirai)", "value": "ca0e4b72ce91ba3cbcbd0017cae89a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677338, "uuid": "caec8506-82be-4917-8a82-de3a11248ac0", "comment": "Malware payload (Mirai)", "value": "2b4a698eee42e8017bedcc51cc812802ba3567ef856e62e45bd9df2b25433cb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677338, "uuid": "20c5da89-bea0-408e-bdd6-4a53a0a28aa0", "comment": "Malware payload (Mirai)", "value": "10c29bee6257c7e09a2b839d7c3933664821ff48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677338, "uuid": "90194478-2449-4dea-b79a-8851e613134a", "comment": "Malware payload (Mirai)", "value": "2e88525f3a8f8b8d407f6a304dbac84230752e20f268059708241ecfc44bbc6ed964c3e07147bd69d9e1c9ed0ee36f65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677338, "uuid": "caea769f-7e36-40ee-a986-993a57d8458c", "value": "T1A0735B24AD3D2E22C0D4A53A52FB8325F2E6230E25B4965D7C760F9FFF2464468572B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677338, "uuid": "5e056b24-0d82-42a5-8136-ae2006266d87", "value": "1536:q+kyDSBJ6OmiDKFZ7MOYonGmcFc850wAvytU4YUgF1A/:q/RaOyiuGNFcbTvyC4HC1A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677338, "uuid": "61169f31-fbb7-4305-84d8-4ac7a0a3063d", "value": 75128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677338, "uuid": "ea8a5e6a-6d39-4f22-8b5d-dc819b79674f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677338, "uuid": "13d20975-219b-448e-88f7-6a9ae6b80634", "value": "ca0e4b72ce91ba3cbcbd0017cae89a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56322ebd-1beb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688640807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640807, "uuid": "49a4e69b-5d59-465b-ada7-464a1e351231", "comment": "Malware payload (AgentTesla)", "value": "a73facbd34703f5058796bc672e9d972", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640807, "uuid": "95cfb07d-8844-4c55-af24-6b12495c64ab", "comment": "Malware payload (AgentTesla)", "value": "2b4cf6b7907df730c69b34f85e473d4c826c3bc8d423a79b5d7cf0b2a2414b95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640807, "uuid": "13e3dceb-35d4-48fb-a8a5-786ef695fea2", "comment": "Malware payload (AgentTesla)", "value": "297d65a64c67439689f6e7a17e9e1c95a4f836ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640807, "uuid": "d9b2310d-bbd7-4b7a-a715-55ad9f2c19ea", "comment": "Malware payload (AgentTesla)", "value": "6e36814a93de160eeda18f28a1b4880fb3978960328fb86e568ed250b1551b2fc0345b2ac833827ae8a059af466d1365", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640807, "uuid": "13a54778-9811-40a7-b7e7-593cd2d84c19", "value": "T198F4126D67B3071EC4963FBC0D4182B9CAE86984B833C21B6FA7B8DDDD25B040DE1592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640807, "uuid": "e8428ec9-7be2-4518-b04e-d08e0052cebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640807, "uuid": "0a9bbb81-2c98-4408-b5b8-ed6e2580515c", "value": "12288:A5+J/M+Jhewx/NscEQ+vgXK1HsaPRmJpqoy2O4VXPGPElByZOwBiPfURJzVk+7AJ:P/thewlqB6pSmfqMVxPGPElB6j03URna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688640807, "uuid": "782aea35-4417-421d-8d52-ebbe955d4e0d", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688640807, "uuid": "c18475be-f08d-460e-b315-c6f40f021a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640807, "uuid": "5851a1b3-c460-4264-87ee-ce675d618bfd", "value": "2b4cf6b7907df730c69b34f85e473d4c826c3bc8d423a79b5d7cf0b2a2414b95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d14a5da-1c01-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688650240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650240, "uuid": "d2f3b6b0-173d-428e-b4e3-d18e6cd228b8", "comment": "Malware payload (Formbook)", "value": "078aa5481805038692edb6ade88580c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650240, "uuid": "4d3ca404-6335-4b2b-a44f-72ba831f07de", "comment": "Malware payload (Formbook)", "value": "2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650240, "uuid": "4a8cfde0-757c-484e-9e38-53f6ae230340", "comment": "Malware payload (Formbook)", "value": "19be6ac716ff8c44effedfd0f5aa5042eb106be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650240, "uuid": "008d79d4-15d0-4df2-8733-26aa815588f0", "comment": "Malware payload (Formbook)", "value": "753ff9ec10810f0e150ac892766a70c019e811c54dfc1f39f07a8e50970a4d782255ec3937a5bfcff6d4d404ff0824df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650240, "uuid": "1108288a-f001-477b-8c2f-a5f69051184b", "value": "T1B105F12C33EA8B4AC4BA7BFC4D64AA30C3E85D453033E35A0EE735EAAD767144495593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650240, "uuid": "88934990-b22a-4ca3-9b73-935cf63dbd22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650240, "uuid": "375df903-5dcd-4ab6-94c0-e58879af70d2", "value": "12288:lBEG52iNoOe42KMu/N3mWhQmwmJCMpUgcDBti27GPlfxh8/DTBjf9eSaMbaUdBt7:jEE1mOV/NOaWA2KPlfb8Jta+ndvIJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650240, "uuid": "a8643fff-5550-47f9-9bc8-8ddbbee561bb", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650240, "uuid": "b5bb5c85-caab-4683-aa9a-a7b19880e6f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650240, "uuid": "db239acf-b926-45de-9318-7c37e4843f70", "value": "2ba0e2aa5120cd3969463699261f1ffc71763fa001212564375d578e7301523f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dff759-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688654090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654090, "uuid": "fb3ae614-3ca7-4bc6-be53-3d12359c668f", "comment": "Malware payload", "value": "be4459aef66bcbc4e1478a2974aa3d6d", "object_relation": "md5", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654090, "uuid": "23b6316b-452e-4599-bc81-107f354af1a8", "comment": "Malware payload", "value": "2c0cc8b60e502e9a2a82a1a6acdfa340ff43608dd6fdad32db9ce99b383513e3", "object_relation": "sha256", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654090, "uuid": "245cd88e-9eeb-40eb-a2ea-dcd24bcc5f24", "comment": "Malware payload", "value": "eb061510eae45ebb9ce5f52df5e35b3a573152c4", "object_relation": "sha1", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654090, "uuid": "8fd67d9c-11e5-4221-8db8-baba627ffd0f", "comment": "Malware payload", "value": "9b4c4423b5c087c8d4f0cb877f521e6d7eb0e95b627e30620dd736bb5953b7f0676e76083cac35512301e721a75bc568", "object_relation": "sha3-384", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654090, "uuid": "77049574-f989-4b61-91d9-40784d55eab7", "value": "T132E5334E5944B7884315D23ACCBB04CE17ACDBFEB1269D1623CF7B2947C286A856CDC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654090, "uuid": "2fa0971b-3950-459b-a5d8-49de78725196", "value": "49152:S3Dpdl1iSHW8OPImWLTGfz3UJAgSU3rBOeXfB0BLmrbYeEWVeW9Pc5PtEQIl1wsa:S17HWpySfz3UN31OeXJ0gbYevdc5VHIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654090, "uuid": "1e4fb6c7-99c4-4a68-8d43-9dc4d195e3e8", "value": 3020511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654090, "uuid": "8160ea24-b16a-467f-9741-98778ebde6c5", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654090, "uuid": "87f440c5-52d9-4c4b-b5ec-6c2243dacd3d", "value": "Evolion.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cd9f85-1c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688656650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656650, "uuid": "87e9e3cb-ad75-47f2-934f-e8fadc1e2f88", "comment": "Malware payload", "value": "e8a745b14c507db8c8edfad107fcaf77", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656650, "uuid": "8ae7dc90-cde1-4d78-9caa-69f7c45fe440", "comment": "Malware payload", "value": "2c321b1416fb7226bffd1633a2a053ef3921fef9a1de5c49b71ef9c7b0914b00", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656650, "uuid": "cd28e491-3579-491a-ab80-017404b9f14e", "comment": "Malware payload", "value": "0a2a853251fe28333761cc6f9c4518807354dd27", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656650, "uuid": "d4cde947-a990-4669-b6b1-dd14475d9f3c", "comment": "Malware payload", "value": "ba521f41b5c5928c81e1ba033e35e671c8d0b65786b84b1446eb92c68c2cb30207c76a35194b5bbc87ad1a4d29f48904", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656650, "uuid": "5198d794-9576-45d5-bfb0-692b0570456d", "value": "T1B6D6AE26B5A50524D287C0304ADF87E26B31F9364136BADF22B5E3352F62C52DB8D35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656650, "uuid": "6e3efa6d-9bb0-4168-88fa-520773470195", "value": "98304:nfRNDr3gol7a3Zl4w7oU5ZTMHk4SLxlBcBn0ZQq2D707meoGMPU5KnPa1b2Bnlhw:63Zl40M/0Y0yeXMPU50aEnl37TgXFUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688656650, "uuid": "f0814997-a08c-473d-9eb9-384f0b0e0c3d", "value": 13809264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688656650, "uuid": "4d8daadb-abd8-43e5-a804-c487a696466b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656650, "uuid": "eb9cc8eb-bf83-4eaf-a89f-87ba421e015b", "value": "WildWorld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aae79f-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624163, "uuid": "9944a058-9249-4633-88b1-d6d46d64c464", "comment": "Malware payload (AgentTesla)", "value": "66570101d7cfebc561c339e86fab904d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624163, "uuid": "5ffb8ec1-616f-4ad1-8e8a-02906e5fe8cc", "comment": "Malware payload (AgentTesla)", "value": "2c8f27475f53878362379d08fb44cbd5266404838841f855c0a8702fc3cdb854", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624163, "uuid": "d721686a-8a4b-4a5e-adf6-b02a16d21a52", "comment": "Malware payload (AgentTesla)", "value": "7f9d146356522783273fdfa954a14b022a2c1c62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624163, "uuid": "cef12c2a-02c6-483b-afd2-3492c34bb3ef", "comment": "Malware payload (AgentTesla)", "value": "2ca92e791e61aa3a486c35a699c0c9bb6c8f06fdcd1710863393d44770736b53dd678e7ea033e81273dee0967e8afdb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624163, "uuid": "433c9b9a-5367-4785-bf2d-30599aaf58b6", "value": "T195451201F584E85BD84693786882949B025DFC25E79DD8431A9BBF4F04B4EB08EB37DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624163, "uuid": "84858978-ce86-43f5-af89-87193ed66f60", "value": "24576:eBlzWw6sIzvo0xfsjcUos+xKYw6sXzao0xfsjcUos+xKO632YjHqJPh6wYlO:4N6sI3xfsjdos+xKT6sX6xfsjdos+xK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624163, "uuid": "46d9feda-e3cd-4910-8b68-a94223331e7e", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624163, "uuid": "75334831-687d-456e-8bab-27f4beec0511", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624163, "uuid": "4c992af0-c3ec-4245-98a1-06c8fa9cc934", "value": "Proforma Invoice-H230014-RIC-VM 1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68330053-1c1e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688662741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662741, "uuid": "00180ef5-cd64-47c8-a518-85d34cc2c6bd", "comment": "Malware payload (RedLineStealer)", "value": "3d94d2b7300d3eec03547f1253b9412c", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw: EvolionGame", "colour": "#9DB4CA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662741, "uuid": "54924b0e-de38-4897-8dfd-d1d324cb7d38", "comment": "Malware payload (RedLineStealer)", "value": "2c93a590c816763dc82e3180e205377639e66723659363140432b1093aa5d533", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw: EvolionGame", "colour": "#9DB4CA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662741, "uuid": "a6ab0e95-8f56-4f8f-b7b3-6b494a4973fe", "comment": "Malware payload (RedLineStealer)", "value": "761e16255f1225d3b5c6b027b5d3ae02113291c1", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw: EvolionGame", "colour": "#9DB4CA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662741, "uuid": "a43900fa-f1d5-4a6e-9bf6-c2cf0382836f", "comment": "Malware payload (RedLineStealer)", "value": "48fae21d04fe94e258000155551e7dbcc55e430ddd314852314048b8d5f8f93d8023d582d499eebf0ac0bee695afb919", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw: EvolionGame", "colour": "#9DB4CA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662741, "uuid": "2ed1e95c-cf1c-442b-b75f-fe23ef61774d", "value": "T16FD6330D3B8091248736456B8800D347AB3AB183AD4E235DF4AC5AB1EBDD79855F93EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662741, "uuid": "8ba87ed1-9778-4379-8fbd-e905dbe99c4a", "value": "196608:DDd20VZYHsxms5JsUQYuYbsiupF4UxkZArcM9HWSBjBG8Wa4iVBCkIHLIwf4:DZvVR9JvQZYbs7FOZAlHvQyzIHLXf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688662741, "uuid": "a6ae253e-1b22-4eac-9b51-1fcfb26d1261", "value": 12976110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688662741, "uuid": "37a8af12-f4a0-4180-a225-27a19ba7bdb6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662741, "uuid": "302c5f75-9eea-45aa-8219-a9d7814b1e33", "value": "Evolion.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6753fa-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623723, "uuid": "df31a694-098b-49ad-b0ce-3b8676d1c537", "comment": "Malware payload (RedLineStealer)", "value": "ba4e0722aa6282154f4416abd45cfbc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623723, "uuid": "84e9b36c-af6e-4c5f-9d74-7dc4237a3cfd", "comment": "Malware payload (RedLineStealer)", "value": "2d08062ca0791e32672d4f34475b3087e1bd4ef6202734ddc16a5f52c64018e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623723, "uuid": "749f066f-5193-4a25-9bb5-8d4127df9ab4", "comment": "Malware payload (RedLineStealer)", "value": "59045149196140447b324358d9eed76726d684fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623723, "uuid": "7467031d-c2f5-418b-a80c-840d1d6ee51b", "comment": "Malware payload (RedLineStealer)", "value": "517349193770d51740c4f06bd9766173c0b60f7a4b76db1275d854c69a207b4e1d1f52cc9c554fa5285335d99b03869f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623723, "uuid": "5ec7181f-245f-4d43-941f-186dc2b2bf15", "value": "T13C560102291C0C5FA17139245FDD945379AD67A91B170C8232D2EDEFEBACD84FA85B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623723, "uuid": "d831c30b-59f7-49e5-9d04-d51b91fc7b7f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623723, "uuid": "0fa0d95f-0f97-4db2-b5f7-dcd83b9b1369", "value": "49152:ooRLwnku4JWewz9Apm610Kwc/02PjejSS/yMWXpCOG+6IGorMYPN9BjG9Fr1E17Z:p5JWLAYW6aN79PNMQjhJUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623723, "uuid": "29d41d6c-14da-411f-9b85-a23491e93d71", "value": 6014280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623723, "uuid": "43bc52d2-e932-481f-afe7-2e2ed7a6c21c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623723, "uuid": "0ecefff2-b94b-48d9-9218-6d83e2e03641", "value": "ba4e0722aa6282154f4416abd45cfbc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4953fa-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645865, "uuid": "d7538841-ea08-4b83-8ee3-c225c4ab44f5", "comment": "Malware payload (Mirai)", "value": "2deffcff79870f1558c87d48eb958364", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645865, "uuid": "2f9ab579-3e3f-4762-9450-2ddcca7cc02c", "comment": "Malware payload (Mirai)", "value": "2d627a71f05ffa9ad4b43b487ccb6d291e9729fd09c5d12596a01bf64d201299", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645865, "uuid": "47b20289-f716-4b55-a8da-ab7b1e837d2d", "comment": "Malware payload (Mirai)", "value": "9120614aa0417dfa62645d634ed26d5291b917b5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645865, "uuid": "3aef90e0-54b6-41dc-bf1d-4edb5b0045f2", "comment": "Malware payload (Mirai)", "value": "02c2841d1e37e39affb051bed679422564b24ab7f082784bacea7c63012d78ed9d565dcfd85151bc6c632d6ecb560dfb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645865, "uuid": "d0ed34d3-8c26-4898-a008-b15b51ed87f1", "value": "T14CF2E1FBD1E3C87CD8139F3668C506C1FEE8A85A6126875D08D1B139D5A7F083E213A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645865, "uuid": "b6ab2270-505d-463f-96dd-3d29bfa6e0cc", "value": "768:PdXCmnrfrwhKoE7HAegoB1vnJe5CUJuT0FLzwSv9sPC7:VS2rTjokMoB1vnJcJugJTFuC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645865, "uuid": "496d4997-da11-4341-a210-7d6fe4f2acda", "value": 37404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645865, "uuid": "1bf65b73-5efb-4d46-94a1-34b6247822d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645865, "uuid": "70dde451-339d-4b21-a684-e7d965235d2d", "value": "2deffcff79870f1558c87d48eb958364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0fd374-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623338, "uuid": "b884eff3-1996-4f2a-b775-9107f64bd026", "comment": "Malware payload (Amadey)", "value": "8ce3aafb0eb7d2a676a9792fcb680334", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623338, "uuid": "d0422fcb-d9b4-46ef-8520-60f418543619", "comment": "Malware payload (Amadey)", "value": "2d88cc8f14d392e0f07eb70c8346e1887b0bae385591ad08e42948cba79e6b77", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623338, "uuid": "4e97ab85-8dcc-4cb8-8e61-9d748dd7592a", "comment": "Malware payload (Amadey)", "value": "93aba4f4ae4f5a1c3cae718145c1c48f2a9a0307", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623338, "uuid": "75639dcf-acb5-4018-b75a-bead27e69af4", "comment": "Malware payload (Amadey)", "value": "278ef4016555d463cc65bbb1c03f8d3889146ba80b4872b137b8f6427f539188b8046dbdfae10f7724716e7e7b833dc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623338, "uuid": "d5e90c6f-da74-4185-8066-a2744deeccc7", "value": "T19B560152280C4C5FA1B638240FDD55A379AAA7B857130D9232D2EDEFEBACD84F64171C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623338, "uuid": "582d10a1-8e4b-4664-b7ea-b02aecde0c42", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623338, "uuid": "3bd4eb95-d8ef-41f0-89bc-9fbffcf93ed9", "value": "49152:1YgnKJZWGe6IzlkEpISA7jitP2BOhrGRnJuwMiFcmRxQHiiTKKKseI6ANZWqRK9g:/KCGJILISroqTb4Zt6leWWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623338, "uuid": "a31e766a-95e0-4b0d-af6f-4d5044301333", "value": 6006600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623338, "uuid": "7621d4bc-0b08-45d2-9c79-fc80518c75ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623338, "uuid": "c65e62ba-da3d-4753-bce5-cbbd51305283", "value": "8ce3aafb0eb7d2a676a9792fcb680334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bb7c18-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622358, "uuid": "e07c0e51-ba8c-4022-baa4-b9fce7b47bde", "comment": "Malware payload (RedLineStealer)", "value": "0d0ca67278825ea5848e73420d19470c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622358, "uuid": "6499a53a-182b-4256-a7ed-af8aebf4202d", "comment": "Malware payload (RedLineStealer)", "value": "2e5bc55c905c19135013b700f978bb973c899b1c3978c4e68db2c94534fd5aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622358, "uuid": "f9aabfc0-36e5-4ab0-a95b-3d7d7a03764a", "comment": "Malware payload (RedLineStealer)", "value": "0e7eccbec998b7ac18346358856e185493de6c09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622358, "uuid": "241b269c-e216-4a79-89f6-7e23d4a1cc3d", "comment": "Malware payload (RedLineStealer)", "value": "5266ed5d0692955516262754ad152393a224f70137e2fef0a375a6114d5873d0e96e47f6de3e3861fc17e71e39974576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622358, "uuid": "d1794fa8-0879-4a96-bede-8b3c98cf38d7", "value": "T1E955BD05A09D1D5CC572E7B2BADC23523EAC8874291D713952E21DEF95F9C0E72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622358, "uuid": "0c68a54e-97ec-451f-845a-a0681abcab69", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622358, "uuid": "db8ba677-c95b-4868-b649-d82e78c05716", "value": "24576:6GSFKRmxaSBggiyQSpXQJnuJvH4IEPxxZmASG4:6nF8IggiypGWvFAZmAS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622358, "uuid": "05e875fc-1d40-48be-ade1-9c64ba52e511", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622358, "uuid": "2fd20ca0-aa9f-4f61-8cf1-08227a75632f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622358, "uuid": "f290191c-336e-466a-a77d-cb93f2ddb54c", "value": "0d0ca67278825ea5848e73420d19470c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2bb9b0-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688647315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647315, "uuid": "fcce164d-f13f-4189-baf0-7f48fd3e7628", "comment": "Malware payload (AgentTesla)", "value": "7f575b1ab7b644022226749caf8a6ee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647315, "uuid": "4c32a536-393b-4b92-91e6-feb8419b9b82", "comment": "Malware payload (AgentTesla)", "value": "2f1847af906cc4a6aeaccde939a7159fba4c09613b03395ace1cb6999e2648e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647315, "uuid": "a9a9d5df-9d05-4d80-81ab-6ddf4cb2db33", "comment": "Malware payload (AgentTesla)", "value": "f1c2b5bc36389a51cc5cc5aa954ecee5f7ba58e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647315, "uuid": "51201f02-5bbe-4fa1-b30b-16dbab3abadd", "comment": "Malware payload (AgentTesla)", "value": "6730e2d61ecd0d7eb594379929d775b6d2b2ddd28019705543834317b20f3c6dc00221d9671842e9a1a21a6aaccd6ef7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647315, "uuid": "12e05b9a-22fc-4c8c-8949-c69bd1ec5e75", "value": "T1D41523EC3E7AC1018BDD4EB1B3E91AB4CDA0645E54E06FFA85970894E8F3E279CD2154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647315, "uuid": "7f26c1f4-0376-4cbe-b4df-cefc21c6f052", "value": "12288:EML7nvXmvS+Lr9Wo3EypyKYsn4MQh9RE2HF97yKHJ9opNkuivs1hGgJIeLHV:ZmvSm8o3g69QxjeKpANkuf3JI8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647315, "uuid": "b7d04591-385d-4385-a6fa-8b5a48f635fe", "value": 899124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647315, "uuid": "09715200-4888-4e83-aa75-850657c855a1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647315, "uuid": "5f70ee4d-d7cc-4f92-9ef5-dc25fbb51c6b", "value": "Proforma Factura_67228.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59126835-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "98deb997-e201-456b-91e6-ef1e049f3a8c", "comment": "Malware payload (RedLineStealer)", "value": "070f1109b31aba63d43abed7696fca55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "ec9968cf-0495-4c48-8d27-4930d6034c24", "comment": "Malware payload (RedLineStealer)", "value": "2f45efff9ed2e51020855ac029f7d946da660f15e4a03ed5937c46a58a516b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "37a849b7-23c8-4311-9aa4-4ea120485069", "comment": "Malware payload (RedLineStealer)", "value": "e89ffa0bb24396800d0dec338ee1cc3538a67ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "57271c9f-ac68-4daf-ad32-e481aea06a9a", "comment": "Malware payload (RedLineStealer)", "value": "ab4adb49852e2ee80e011d5e394a288d6de77dea4533f23413c59caf05188e15a855401abb1915018f42b4677fcd66fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "4cbefdf8-cdb5-4b17-b8b7-73dbe831a700", "value": "T1DC55AD05A09D1D5CC671E3B2BADC23523DBC8474291DA13992E21DEF99F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "0884aabe-7dce-4f42-94f0-ae474c5a1e8d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "d4db118d-6d3b-46f3-a9be-273414a22d1d", "value": "24576:ZUmLXJOAVnSCe1pWcFm9KPz33qLtkUSxBk+NVQ6:ZVNf/e1pWgm9KPz3aLeUOvNVQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622343, "uuid": "02351fb5-bb66-4623-9340-0ead555be801", "value": 1343820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622343, "uuid": "283acc2e-161d-4580-a984-77450ae8ee31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "a1e9dd13-d38f-4fc5-91c4-edc01056c9a8", "value": "070f1109b31aba63d43abed7696fca55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0264ee85-1bea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688640237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640237, "uuid": "f2047a20-f538-4f70-852b-1f1e28e60c32", "comment": "Malware payload (Amadey)", "value": "de4abc6c6f10098c9459fd68c1d20316", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640237, "uuid": "0860a96e-8a04-4146-9d2c-80c3ff667788", "comment": "Malware payload (Amadey)", "value": "301290fc32de3cec8e49df0101b198a12b9cdfa898d88ccafccb5b9bfab996cd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640237, "uuid": "752feea9-bfec-4ebb-9141-9ed27de4b5b1", "comment": "Malware payload (Amadey)", "value": "cdc01c65bf3c2190b344bdb791f00d636f7d4a9a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640237, "uuid": "9e2f3ed1-9b8b-4142-bc28-6ba4757b4603", "comment": "Malware payload (Amadey)", "value": "3e7d32ff78b2d180fc68759aed1b605bfec075b4e95c418757b0ab730bbf7f45af2a28696314e8e68eae9093e2a1d8a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640237, "uuid": "11390bbb-14b9-46c0-a3b6-e3b9a3cb0ada", "value": "T1DD060111954C9E6FE03A347573DC4857F96C9874DB190D8222D22DEFC88DE83F2A698D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640237, "uuid": "8bd108fc-c2dc-4e80-93b5-1dc5fcf2814d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640237, "uuid": "114c00ca-06ed-4f3e-bd5f-a02ae133e5bd", "value": "49152:tVphzdp7fL0FMCmLLe/fxjdlOWZ4dOHjTPYZZTjAoLmGZro04MvRv7V6i4957KjW:jfsCxZZTjpOp5kiMlKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688640237, "uuid": "6c505b3c-b981-49dc-8129-5496a614a786", "value": 3759432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688640237, "uuid": "4e2bf1ac-5be8-4570-9d38-fbbc52843310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640237, "uuid": "cfd730d9-892a-42a0-9847-228f44c4d57d", "value": "de4abc6c6f10098c9459fd68c1d20316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f463c9d7-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623463, "uuid": "fb73206d-a198-4b38-880d-84340c795b15", "comment": "Malware payload (Amadey)", "value": "933711b7044e60024b2d8f5dbbc7e039", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623463, "uuid": "63e2374b-8400-4511-8eed-67968a73615b", "comment": "Malware payload (Amadey)", "value": "30da276b5769a192335df3864274fb11d7be6bf40fadeec88e88c0444d2a8964", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623463, "uuid": "ad65a7ac-51b2-4878-b9f5-297f843694d8", "comment": "Malware payload (Amadey)", "value": "ab42abe1b0f62ed3a1c1bf433b4710d23bc35a84", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623463, "uuid": "6673ed48-f70a-4ea2-8fe8-3cea900d5aff", "comment": "Malware payload (Amadey)", "value": "a37bc9174f68fdc7710d96ca3a91541377d33b7dfca059abf8cebdf73eedc7410e6bb26967c473e88b30a27d95be15a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623463, "uuid": "f0cd0c8a-e250-4c69-93d3-78fb8d6ae8ca", "value": "T157560012291C0D5FA57239211FDD555339A913B84B130C9232D6EEEFEBADD84FA81B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623463, "uuid": "66750fa3-7b55-4b35-bf64-91b87ec9446c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623463, "uuid": "83c5dc49-5d9d-4a4e-874c-9f6b95f1694e", "value": "49152:pKiuJ2386Pwtrwhlv7THC/TkWMIXg7X6d5YjruiFHNgMjr+F4fm2u3dQl5soZZYu:pePwjTHCMIQmdaJNds725BWAt2nDgt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623463, "uuid": "b931eb43-a6ef-43c7-b1b0-9f98c1dc608d", "value": 5995848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623463, "uuid": "52644d5e-ef18-41c3-86aa-8d500e70b4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623463, "uuid": "a9e8aa7c-197a-4264-943d-40f20bd79c8d", "value": "933711b7044e60024b2d8f5dbbc7e039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76d92d4-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623790, "uuid": "87683473-4ae7-4ff1-8323-05ca476932ef", "comment": "Malware payload (RedLineStealer)", "value": "bcdd02133f60f0f518651b1bddb783ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623790, "uuid": "0022a3a7-ff42-4a64-bba5-0486fa93cbac", "comment": "Malware payload (RedLineStealer)", "value": "3105f8fa05d4170d1d7cf2a9b61cfa6b4fcf541af13abbc0e984c97bfb6e99dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623790, "uuid": "32971fc4-3504-472d-9e68-da81588a473f", "comment": "Malware payload (RedLineStealer)", "value": "8c8906db848f4d97d62df2060ca3362eb9b9c3ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623790, "uuid": "ad6d7dbe-9645-4180-9449-e200674c2342", "comment": "Malware payload (RedLineStealer)", "value": "1c89c993d58f0d340ba267de3995c90709cdbe74a765815a03451d6ceaea72ae34cfa184c25859978dbeef9936b20e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623790, "uuid": "b2c557b8-adc1-4f4e-b041-0fd39da5aee8", "value": "T133060101214C9E6FE43A397A77DC4857F92C9474DB080D4621D62DEFC89DE83F6AA98C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623790, "uuid": "49ce3fa5-2fcd-4c2c-8293-f7d26054634f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623790, "uuid": "6679a042-ec6c-4668-9235-a53bcdf15f6c", "value": "49152:YfqFL7gq9JIHW8ezhhC/KuD1ZKtmKJMHqK2dJiDK6kdXS4HrUhki7g1TrIYkA61d:2qFF8hDvhKgqbO1gH0KedV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623790, "uuid": "d0bba108-56d2-4b3a-882f-6ee08d6a4158", "value": 3763528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623790, "uuid": "8e8bd6a6-b84d-49a6-a651-d3994746357f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623790, "uuid": "c0152ef6-1955-4be5-be1e-106472338736", "value": "bcdd02133f60f0f518651b1bddb783ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637eb4ff-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627085, "uuid": "8a65ab7a-6eed-4e5b-a485-2cce66ee77d4", "comment": "Malware payload (AgentTesla)", "value": "72bfc955dc592d99f19e86b2398640a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627085, "uuid": "cdbf6538-3e47-4ff6-ad39-08d5ed2560f3", "comment": "Malware payload (AgentTesla)", "value": "31dbf93c8a434385e5870f989115e64a4099c097437e3dae218a430e37aaf70b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627085, "uuid": "b445b28d-04da-4da6-b335-f4d5e8904c0c", "comment": "Malware payload (AgentTesla)", "value": "24ed17f53c6481a59722e82466a82a33f9ef3111", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627085, "uuid": "590b6953-baea-4c58-a9d8-d9c176e8ec04", "comment": "Malware payload (AgentTesla)", "value": "24cc471d774083f3c58e561412658dbca77153ee0a22ddb52b01ee3817ac66270a5a4ed2a5cf1bfb2dc2750f17199715", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627085, "uuid": "edbfef39-41be-45e0-ae39-a444721fc01c", "value": "T166C423012553F0AC9EC2C6FE8DA9B3DFDB4616CF049879D8E67FB961532E03A1025E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627085, "uuid": "fcc6b4c4-e8d9-4ae2-a9a8-8498324df210", "value": "12288:RL0j7HCP03V9NT4j5ClY9JgY4TQKoMQTuniFp2vDNOAZ/nic3R:xgTltT4j579Jg1QKoMqsib4OAz3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627085, "uuid": "1d0b3ead-9c4c-420a-9df5-8801ab69f569", "value": 548115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627085, "uuid": "57cf7271-6899-4093-8029-957823d45b57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627085, "uuid": "8bffd40b-2e36-4b7a-9612-2bbdf085dda8", "value": "NEW P O FOR JULY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bba646-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624374, "uuid": "ee369c9c-04ae-4216-990a-21e9194bf1c0", "comment": "Malware payload (Amadey)", "value": "107888af68bd0367d8c753311d45d5ab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624374, "uuid": "10059bd7-1bbc-49f5-92eb-c173f3cbe60a", "comment": "Malware payload (Amadey)", "value": "3225f13989503ee56d17eb2d2507036ca3b523ef8e800f66571ce9c290315725", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624374, "uuid": "8f6f6eae-d4bb-4cfc-bee7-a33bce94a584", "comment": "Malware payload (Amadey)", "value": "f0a7270ec19ebb03671ead7ce421c16b969b2e4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624374, "uuid": "22ddbf69-ed78-4506-91a2-a74642c6811a", "comment": "Malware payload (Amadey)", "value": "a5dfb01006a898315b3597921f064553351d86d0e657adc39bbe2608174d20fab3a71c5af6f457eb0b271e809bee4473", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624374, "uuid": "f9f67c9c-b716-4e14-b7da-176c146176fa", "value": "T19C160129106D4E9FC43134B02BDD1993F9ADA474AB1F0E4122C6EDEFD8ADD80F69199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624374, "uuid": "f56ceb45-8b5c-47a2-b09d-a7c797b78fdb", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624374, "uuid": "cd8f216f-bf05-4fe2-9e48-6f4dbd23a84e", "value": "49152:/ZXMFNnW971HxilM5DUTF5Q49ToyOtcRPoM3MQldM529RyO8mJgfrvJvbdR/kN1Z:/q8Ojoc2gXMSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624374, "uuid": "4c270de1-40cb-47c9-bbcd-d0021c4ffe04", "value": 4075336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624374, "uuid": "026ce07c-8081-440e-9546-61f26e6e1411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624374, "uuid": "e8544c77-c45c-4de4-b1bf-1d84c67edbad", "value": "3225f13989503ee56d17eb2d2507036ca3b523ef8e800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673c8977-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627091, "uuid": "353ed8f6-5c3f-42b8-a4ea-1587b5b32642", "comment": "Malware payload (AgentTesla)", "value": "b95b0d90330afca84f3627a148e5b312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627091, "uuid": "48926432-d7a0-4bff-9f73-01f7f702e240", "comment": "Malware payload (AgentTesla)", "value": "32abb7f0c67327f53e15d72bdcfe4697cfd27da618a0d81a00a81491372a8392", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627091, "uuid": "8086b39f-46da-4945-a907-8cb0f11c88ef", "comment": "Malware payload (AgentTesla)", "value": "6ce630763a995a99b2206b15c1fdf94574e43184", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627091, "uuid": "664169b1-5b30-41af-aa0b-41409bfb5941", "comment": "Malware payload (AgentTesla)", "value": "43061aab9684c53a16598a4f2d0d5c1a1217d76e3511a5b74fc5934799e6db82fff6b26920b025b8974cf95906d9de34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627091, "uuid": "6034cce8-5e7d-44e4-af50-57e79a08f1c1", "value": "T1DAD4AE9C325075DEC857CC76DEA82C64EA6074BB570BD203A02725ED9E0DA9BCF146F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627091, "uuid": "605e20e6-c4f1-42d8-baae-1bc1e4f60d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627091, "uuid": "a58ee6f5-fa7b-45f5-babb-a637fce0d0ce", "value": "12288:srd39ZJ4jX6rfG9ZgY49KSG4mTuziFSWhuZO9NGf64zSWEVKdxa90/:srdXJ4jXAu9ZgjKSG4Umiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627091, "uuid": "40ccd79b-8974-4f2c-ad25-6d1c1873d098", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627091, "uuid": "22b7a6d2-aa9e-492f-804e-ba2d4491025f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627091, "uuid": "b5a6bfea-f353-45df-ad28-b8a348247a16", "value": "NEW P O FOR JULY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15482f68-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645852, "uuid": "d734be7a-596c-4a44-9492-fdbe1a175fa4", "comment": "Malware payload (Mirai)", "value": "d1029fe8234b92d0c8d583f3d6910d30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645852, "uuid": "fb2b7b0c-4adf-42b5-b350-292821c73b71", "comment": "Malware payload (Mirai)", "value": "32c3290946fe4e9b9484b23f911d444545f5bffd9b23bad3462be7893d7aa4d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645852, "uuid": "d64a8000-e989-4d2b-9f9e-f2112a03641e", "comment": "Malware payload (Mirai)", "value": "81bddbae2e03d432e28d1559a91f4f8dda50b739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645852, "uuid": "7db46b45-673f-40c9-8e3a-dfb964862ca7", "comment": "Malware payload (Mirai)", "value": "fefd3dced9e47dd6dbe7e2fe709a4345a78a1f72e6dd01bca873d859d52e48a1d5744a7560f722a48869af77e02506d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645852, "uuid": "826c03bc-263d-431a-bf6a-628071844607", "value": "T1B053017A75ED805095864638957F0C1B92183C20EADF70E22E1205FEBFE1D974CAB9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645852, "uuid": "e3464ba9-05de-48ca-926b-ed1a049dcbc7", "value": "1536:LErHTfcn4OepQV1VdA05G1yKXEF0A1ryvnJyn/H:LyHTfjzk1vjG1yIg0JJmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645852, "uuid": "35ca8e4d-ffcd-4ae5-8ec6-341fd6a0d1ed", "value": 63220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645852, "uuid": "80042938-341c-4faf-8d6b-e89c8f8e67d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645852, "uuid": "0ab392ab-b1d5-4fc4-bc62-8bf3fee14f74", "value": "d1029fe8234b92d0c8d583f3d6910d30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bf3aee-1c1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661843, "uuid": "97422cfb-2241-4867-85e0-3ca8c3fbba19", "comment": "Malware payload", "value": "4ced2b4ef63a58949af9eca2610dbe8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661843, "uuid": "498745f7-2860-42e7-b019-0e156ced17e7", "comment": "Malware payload", "value": "331939973009df0e810580a27d2495483d6ac76c9e91fef1288e283f40f7509e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661843, "uuid": "acd2ffd7-c940-4aff-8500-f3d6e7a34d6b", "comment": "Malware payload", "value": "5dec7710b8468892e7889e8ab8cf96ceab421970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661843, "uuid": "67693140-104a-4125-bb9b-19b61e47753c", "comment": "Malware payload", "value": "8176eaddf7425b2111ed5d2bc52240d1dcd211c09975207235a48c43e9b007cafd8ae8c0182251de527f6e977e48d44d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661843, "uuid": "115f684b-6fb8-4ea0-939d-98c4dcf41725", "value": "T140641280A9F0D417D467A6302A76BBF05BE06C71E8626F1F27803F153D37BC95D2AA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661843, "uuid": "f44be041-eb3c-4557-aea8-6c02691d9206", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661843, "uuid": "18387c6f-cb01-460a-ad05-c0ee3779947a", "value": "6144:3GC7W7BUGjHebHuMQVDSuiH0KLppHtn35jpBlasLGeZiXK:ta7bre9hVpNnvfeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661843, "uuid": "ce6481a9-f1d5-4612-90fd-bfedfe37ab5e", "value": 336527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661843, "uuid": "c4fbad43-5c03-4530-af54-6982d362e603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661843, "uuid": "4103fcd5-6aee-4aa6-a5d0-650609602084", "value": "Tender For operating table and lights 07.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75321254-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661475, "uuid": "0c3f08c4-812d-4bf3-aa42-82181d256395", "comment": "Malware payload", "value": "ca1102b7563f812b2257e0a450a3a626", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661475, "uuid": "6c661428-511e-4b26-938d-73a20ac24558", "comment": "Malware payload", "value": "333500c34788c2ff6fc2a8b7dee71d085da2649540037f0cf4e42e89e1c0ad5c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661475, "uuid": "ee226b01-e7e1-45a9-8ea8-b0f2ba8fc35b", "comment": "Malware payload", "value": "78b8c54f7c967fe410d28abd491a667fd3284f44", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661475, "uuid": "65a9a4b0-3310-4d14-bf6f-20a3f164086e", "comment": "Malware payload", "value": "ea5b97cfab1e6e6b312d18e065b6d9983381bec95ce4be6560c1bcd085ffee3ac3014e7a88bb5eb524bc877180ed5980", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661475, "uuid": "206b7eed-9748-40a1-880f-ac32edca9a9c", "value": "T15C451201F684E86BD84693786882949B025DFC25D79DD8431A9BBF4F04B4DB08EB37DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661475, "uuid": "b6b712f3-2b81-4e61-bebe-4db0acceb1e0", "value": "24576:5BlzWw6sIzvo0xfsjcUos+xKYw6sXzpo0xfsjcUos+xKy32YjHqJPhaTwgx:BN6sI3xfsjdos+xKT6sXJxfsjdos+xK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661475, "uuid": "2f8945f6-9cbb-4a75-b702-1bd466759377", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661475, "uuid": "fa495e4e-c348-4a72-a2c3-914c1f097ca5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661475, "uuid": "151648ae-c481-4eaf-96c9-605f44eb582d", "value": "PAYMENT CONFIRMATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aac2b7e-1be8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688639633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639633, "uuid": "bdc6e4dd-db27-46f4-9d77-06b5f2d6bb39", "comment": "Malware payload (RedLineStealer)", "value": "5bedb28e97d31017ade2d00eac9c3fee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639633, "uuid": "60edafdc-7739-4fd4-9561-ed01db750631", "comment": "Malware payload (RedLineStealer)", "value": "3358fd5c0574e88a30a6b194f13550ee51570f5047068268467d1ea43d05e269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639633, "uuid": "79ab70dd-8463-474c-b65f-f32a3abf6d98", "comment": "Malware payload (RedLineStealer)", "value": "9163a9865fff40e78c7e284bae270ecfd0566c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639633, "uuid": "cf96df64-6b42-4733-a7ed-c8157b533b81", "comment": "Malware payload (RedLineStealer)", "value": "f214d4e05475e1ff691c00ddcd0cd5a40c6f64890055a452b2b1f6b15c894125f8f48e205ce617a040b663cd36f21126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639633, "uuid": "5b031d32-6fe6-45c8-8280-2464efa8ac76", "value": "T160160119205D4EAFC471357527DC2993F9ADA871A71F0E0222C2EDEFD89DC80F6A099D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639633, "uuid": "a52409e5-9f4f-4768-9089-62e486009fee", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639633, "uuid": "6f6d862c-98bd-4df3-91fc-b9645e85b104", "value": "49152:GjtVj/RmVUi6tdSh/MWYGDwW23KOjEtQgUCNMwNS8SradgrAEWa+OYOR/mj225gm:GnEIIPKEQgUhVH+OEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639633, "uuid": "3a185f2c-1d99-44c2-9464-e99ea8ea134e", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639633, "uuid": "c9687e2d-e4ed-46ca-9b70-d69646833bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639633, "uuid": "ad2d5649-c3fc-4d01-8617-1bb0659d32dc", "value": "5bedb28e97d31017ade2d00eac9c3fee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9bd192-1c0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688654667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654667, "uuid": "f137c6ed-9da9-4b10-8495-f30bad5d4481", "comment": "Malware payload (Amadey)", "value": "97879b890789fa8422f19494f1c5e958", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654667, "uuid": "e1a8f0e9-2289-4ddc-b59e-d6061700086b", "comment": "Malware payload (Amadey)", "value": "33662ccfd49875969acc861c5ac1e5da4e96e4cc86a5efe69d4a1586a6dc3d3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654667, "uuid": "9226e50d-4045-4534-8912-ca172438b867", "comment": "Malware payload (Amadey)", "value": "08097c84855fa32d138dab46868757e0756cfd36", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654667, "uuid": "bb1daf8e-016f-47c7-a148-f514484816b8", "comment": "Malware payload (Amadey)", "value": "d9bb3107b7685d2edb4bf0137d5c86719754463d7ebde42629bb00bdda8ef7285e02e37c76718d233d883526ab96d146", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654667, "uuid": "7e5c735b-74f8-466f-a4b6-82b0876b0117", "value": "T189B4013339609967E04AD930AAB615D1FBBCE3A53B77819B712DE03A3B431D0D738259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654667, "uuid": "64b1b3f2-18eb-4ff4-a3c8-fdcd86ba088d", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654667, "uuid": "a58e3886-94ae-4f53-8a7e-006e9c0b4681", "value": "6144:Y1HixK1pxfvkCAFbmaklCdnQgM8Jcrix7Bx9YTcVnfAszzX9DJo0pHZBQLaPRmvo:YMxsfv/aRdnQgkOx7RkcJJv1ZBdZFRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654667, "uuid": "8993cd3a-440f-4ced-8bea-704f477aebeb", "value": 513352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654667, "uuid": "614e49c0-2b9e-447b-8499-f63cd90555c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654667, "uuid": "90634888-3724-43a3-9005-491e4f6d488b", "value": "97879b890789fa8422f19494f1c5e958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746e01c9-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688622819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622819, "uuid": "095b5316-1679-4259-a1bc-c208612aadc4", "comment": "Malware payload", "value": "dda2add593e6c481803d0848d4e08cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622819, "uuid": "b3979ca3-8def-4612-8ae5-522ba88eb2ef", "comment": "Malware payload", "value": "336e11dee32414effbc338351edfb90c432c36d08437ba3bf431d8a400445615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622819, "uuid": "a3063cf0-4a0c-415c-936b-62bd2222e2b6", "comment": "Malware payload", "value": "b77a70eb842056bbad548159ad8aaf7f73a6fe39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622819, "uuid": "1753dc41-b7e1-47aa-a63e-06b919e8055f", "comment": "Malware payload", "value": "575e8170d2009656b171da9e313db747c7436bb92d3d609bac59bae94547c72474c9dc00f9fa8d978270388d10605c1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622819, "uuid": "98323bdf-f5c3-479e-b415-805a6abf7795", "value": "T109A3B90A7E11DFBBF25DC23047F78631579437A62BE18645F15CEA481E6038E246FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622819, "uuid": "9e3de3c0-7332-4600-a6aa-99fac82eec47", "value": "1536:MuWalzlSuOWpQIwEezJozq/3vt29dvl1KVeE2WUGEuF5eGnDclt:MfaEIwE2ZUdHKVeE23GEgZclt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622819, "uuid": "62f42e32-e98b-4282-b822-d59f9bd018e1", "value": 101952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622819, "uuid": "fb10f4bd-f751-4fd4-beff-55fc278ac181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622819, "uuid": "a72d6f2e-9926-46f9-bc11-ab0b4d8869e8", "value": "dda2add593e6c481803d0848d4e08cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e868220f-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688638046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638046, "uuid": "2154f757-8ef4-4f55-b42b-8bcb983160aa", "comment": "Malware payload (njrat)", "value": "c6673f7c75e8a7952c02f1f9b3d3e068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638046, "uuid": "19de075d-ca54-42b5-9680-a8137b4db2bf", "comment": "Malware payload (njrat)", "value": "33ba17eaf475594d10381d8cd48f3062e7eb4d1658f57c67f2b3c0f6a2b2c3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638046, "uuid": "13c3b62c-d5b1-434d-8fc5-429de09db9c3", "comment": "Malware payload (njrat)", "value": "42d3f5052e4f0f8d0865f27649f30e0c0bbf46b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638046, "uuid": "4561fb9b-f437-460e-9e59-a27f2059db16", "comment": "Malware payload (njrat)", "value": "693f15a195943379dcb4b95e97356325a7410b03790a3d64713ce0c5840bb0cee17ff195a71b0214ab91ff1010b15b22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638046, "uuid": "08ac9a5d-7780-4a0f-a40a-199f0a1b9367", "value": "T10CC2285D3BA08172C6EF6BB406B2DB2102B2E1074A27EB5F4CD844FA5B773C14D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638046, "uuid": "b6028b51-1aa1-4d58-a033-30b21132c5a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638046, "uuid": "691b484f-9dbb-481d-a2f7-19f3dd490818", "value": "384:ELdupmWkjCDrBgefHzCYe/eBY2OzRLTm3yilqr6YFbutFvGD:SYhkjCH5T5e/csXIFvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638046, "uuid": "e6f1d468-e677-45c9-8cf4-ccf57b894197", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638046, "uuid": "e6dfe0ff-bffe-486a-a6dd-6f9cabe49efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638046, "uuid": "b821ff84-8311-4946-9796-4a79da23654a", "value": "bOem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf36e5b9-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623400, "uuid": "0ceb2f50-381c-4031-8101-3468a33a713d", "comment": "Malware payload (RedLineStealer)", "value": "97ee2d781edd8f7f0962c4e0971e22f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623400, "uuid": "e497073d-5b31-441a-9712-66f475ed1c43", "comment": "Malware payload (RedLineStealer)", "value": "340b6e3ddd092332bc5ccf534cbed6908cd5d50b6fd5dced96d3bc1f153ecbb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623400, "uuid": "8872d000-35bd-4014-916a-d1f010d011a6", "comment": "Malware payload (RedLineStealer)", "value": "76101d9fb77f2a982536f0f3cf861ef9cb5d7162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623400, "uuid": "99e41001-4871-495e-befe-3e7b61ec1e01", "comment": "Malware payload (RedLineStealer)", "value": "6c4ce8d20ec8fd53f9c78860b4f4a719ccab4f56906950f9e11cac8367e0cda64a93c4178b7578b3e028e3ba5b006d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623400, "uuid": "d1f484e0-77a0-4cd7-a782-53b73fa7da9c", "value": "T1FA160119612E5E9FC57534B127CC1553F9ACA8B4670F0E1122C2EDEFD8ADC81FAA099C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623400, "uuid": "11b788ee-1310-4752-a994-5c5d1b52b854", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623400, "uuid": "5884c294-5e2d-4ca9-895b-15ea6c20e279", "value": "49152:lwvqFij7iSFBuP+gemoVTXgorHYHdaHgIcZwxUoqSL9ZvdP/PXpIMPcaHOYU/Pm3:4wzsVb5pAEvxxpJpIXaLU/Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623400, "uuid": "5dc979c7-de4a-487c-b3b7-90e074140229", "value": 4067144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623400, "uuid": "ba4fd680-fcbf-40e0-a720-a79a02b4702d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623400, "uuid": "baa5abd5-3e03-4ed3-af59-98a4b24c2ed0", "value": "97ee2d781edd8f7f0962c4e0971e22f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b499caab-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677043, "uuid": "236579e3-b7b0-4bd9-8522-68ef69e40e6a", "comment": "Malware payload (Mirai)", "value": "823bb83d524ebe71af3ddbc32078ac8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677043, "uuid": "a04c90d3-de9b-4b72-a742-be3629aad4fe", "comment": "Malware payload (Mirai)", "value": "345a88d6861419b5fe649a050a050c953ff2416efb4637fe6f976a161b9cc8bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677043, "uuid": "e7172783-c39e-4d4c-a9ec-7550793eb588", "comment": "Malware payload (Mirai)", "value": "799a4f5a08ee1d550b266c440d1dfe23f6b3046b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677043, "uuid": "7c9ad157-1e1e-4f5e-81a4-20fc6847f904", "comment": "Malware payload (Mirai)", "value": "d752d20a4ea17eae220a7c4f01359be6bc2d6ae28781cf6dc6d7624ba379c732e9cd9874cf0a37b290e0022a96205b36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677043, "uuid": "f081b256-4a12-4c98-979b-51421ca30f80", "value": "T10DE2E077D6159C32DAF05576AD6A04423B7E8EFCE826B13B05D444F4E2A2DC0A3FD581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677043, "uuid": "9f76de1d-f12b-418f-a201-1d6ba8b327bd", "value": "768:LyQekt9HtmiLU23r3Gi0LesyJToiLxqo7mzaST7+V9q3UEL5R:LyxkJmiLfL45ij5S7Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677043, "uuid": "0f160fb6-5d67-407f-827e-425fee334d8d", "value": 33396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677043, "uuid": "556d1835-ec8c-4e05-9ff4-ec6a20801fc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677043, "uuid": "cc88bb94-420b-43ef-abe3-fcba7955442d", "value": "823bb83d524ebe71af3ddbc32078ac8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b16416b-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638131, "uuid": "cd801dd0-9f34-4ed4-ad8f-65458e5f2ebc", "comment": "Malware payload (RedLineStealer)", "value": "cefaa735aae340a94c5f09003c98e963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638131, "uuid": "03428456-0141-4f94-b0bc-169fbf9ffa6f", "comment": "Malware payload (RedLineStealer)", "value": "3497d6b076a8303e68cbe401a3411409619909055dec0bb827de9d099cef4454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638131, "uuid": "85fe07f5-effd-474c-8dfc-4500a1c88eb7", "comment": "Malware payload (RedLineStealer)", "value": "8e9259ec2f254bd4d8c6acb1b7aabfdd325d272d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638131, "uuid": "1d65be9b-5fd5-4757-a52b-148552924375", "comment": "Malware payload (RedLineStealer)", "value": "461ac80bde2befcbb9e106c87e9e434b21f531ee84404bcfffbbeecb2f22eca272fefc8933e783e6898a97947c31592c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638131, "uuid": "be04024f-0488-4b6a-a8fa-38ff6c46fb22", "value": "T17516010A216D5EAFD471357027CC0593F9AC9875671F0E1222C2ECEFE9ACD81F6919AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638131, "uuid": "b2fe967b-95bb-4fbe-8a61-982a18ddd39d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638131, "uuid": "016744de-1d68-452f-aa5a-3b7198717f55", "value": "49152:ax0wvc98qLsx9TL8XFFaPGJt57wcOgR+WV3vDaj5N/Dcvd66q21hjLdGJ2IDAERD:YlL8vacMcbc+I6RsJ2cN8v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638131, "uuid": "85d89665-3dbf-40dc-992c-d0a7b4dae543", "value": 4068168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638131, "uuid": "e950a8d4-930c-4bdb-96d6-dcac34aaa783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638131, "uuid": "d7e2f1e6-f5bf-4727-914f-ebd5eb73ac2f", "value": "cefaa735aae340a94c5f09003c98e963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fa64bc-1c01-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688650463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650463, "uuid": "90d2f94c-434f-4591-942c-30623856d910", "comment": "Malware payload (Amadey)", "value": "ef31b91fcce6b275293acc509286852c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650463, "uuid": "c379f6f4-1393-48ec-a034-ea3be2cf88bc", "comment": "Malware payload (Amadey)", "value": "34f122f1f2078367b52f59c04bdce076617445442f95c62b96ec104e8ee733df", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650463, "uuid": "c323f784-9235-4327-89bf-97fac818e961", "comment": "Malware payload (Amadey)", "value": "e2752fb575b58b677b0c3c8958a9c7f8a1fa5eb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650463, "uuid": "84dd569d-6ba8-4e57-8f43-babfbd0eb720", "comment": "Malware payload (Amadey)", "value": "e2fbfc2617cd9948f93b3ba38390a18b5904a75772c81545bcd6d6e0c6c66458b7fae28cc4b5e6760e30648eac6c95cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650463, "uuid": "220766e7-885d-4580-938f-98775de8e49a", "value": "T1D7F412333D50D4A3E849DA3195B705D0FB79E3A53E71859BB1ADE0766F072E0C72822A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650463, "uuid": "2f41f0bf-63da-47be-8f14-fe12970ba372", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650463, "uuid": "fcc5514f-0c67-4d5b-8c65-1bf370375afe", "value": "24576:P3UNv482giAAWa04h+BVshssUMG467Vwecg:P3wJkp90e+BSszMmdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650463, "uuid": "ae483804-8d23-4b0f-bc84-fa4a32955b8c", "value": 791880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650463, "uuid": "786a9430-4e35-45b0-acf4-06d9c46923a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650463, "uuid": "c9738234-ed92-473e-b7c1-3b74e046e613", "value": "ef31b91fcce6b275293acc509286852c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1313929-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638409, "uuid": "b3e665c8-d521-4988-9efb-b0caf803a5f0", "comment": "Malware payload (RedLineStealer)", "value": "ff05bca44428cd0bf819c2b5df215ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638409, "uuid": "3461bcf5-65cd-4d12-b253-7206541938d4", "comment": "Malware payload (RedLineStealer)", "value": "350d8dfe6c3fefd49fee6783cdc682918032a4dd4731e2215c0ecb5e94cbc973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638409, "uuid": "86f8abda-0586-4641-9623-888886176833", "comment": "Malware payload (RedLineStealer)", "value": "fc1cedceb49e6433fcc93be5ceadd38ccd9f51ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638409, "uuid": "c565c2be-b08f-404b-a010-619bb3f3a6fe", "comment": "Malware payload (RedLineStealer)", "value": "ceedfd322160b0abf62a245aef73edc760f3f1e40bff45f023dc432b3d35819938562a05cc4c9939aa15d17bf4ac5be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638409, "uuid": "d3061ebe-4cbf-4482-8563-23b9dc52423f", "value": "T1CA060111609C5E5FD4363A3573DC4967F82D94B0DB091D8922D62CEFC99DE83FAAA08C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638409, "uuid": "0adc8600-14d8-41d2-80af-37d583f036b3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638409, "uuid": "0c6c4beb-1c70-451e-92c5-27540c1ef517", "value": "49152:2UdtTe/3mX5V0YGQ5FDCQcWU7LA6g/ZWCHJusXZv9+IZ5mZ8oDfKO8GcgtPqxFA2:lcW8utpvPythtP3OD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638409, "uuid": "1a988176-3533-492a-a8d3-f43085e8b415", "value": 3777352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638409, "uuid": "74d54a5c-21d9-4c50-9e50-815c002349db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638409, "uuid": "bed93f8f-58ea-47b0-b81e-9b12067623c5", "value": "ff05bca44428cd0bf819c2b5df215ac9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c34b0f-1bf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688645309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645309, "uuid": "ec5df3e6-b37e-4d52-a220-73dc8de180be", "comment": "Malware payload (Formbook)", "value": "54b7cb79a5c0a90a317e2be1be7f372a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645309, "uuid": "16f691d5-d1c5-4c0e-b83a-19aaab0c6791", "comment": "Malware payload (Formbook)", "value": "35484e592f7bc73de3abad386c578a86fa31efc009073bbf2722e13532a8b57b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645309, "uuid": "b09cc7a9-8657-4d11-be5d-650389d6089a", "comment": "Malware payload (Formbook)", "value": "d94df5c6d19fba7a413560231acf8fd4f90d9607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645309, "uuid": "0715d8c9-d514-4603-b0d5-73f5cbd2965c", "comment": "Malware payload (Formbook)", "value": "71f2e017e74a8035de89804b2a564a3ebc3b665a1b8120dfdb3ba0d5d629bd7339ded3c139f200881de5dfd087db1a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645309, "uuid": "ef4d9871-9761-485b-9eb2-eb95028af16e", "value": "T12415122576D0C1B2C8BA153004E6C7B90E7A79224B65C5C7BAEC13B7AF513D2A73A1CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645309, "uuid": "f45b3eb4-569d-455d-b811-a35e4b4fa261", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645309, "uuid": "02a00cd1-d663-4436-a463-abcfe2e23ad2", "value": "24576:bk70TrcoK+YKbyxakxlHCddOe6FojVdFomw+JadSk:bkQTAoKLCvyH8ce11/w+JadSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645309, "uuid": "ff42b093-af78-40bb-95bf-18830e18eac9", "value": 930368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645309, "uuid": "f26a71d5-6675-442e-a1ae-3fa93fae0a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645309, "uuid": "324f2f96-afb6-4b94-8ecb-43421e021bc3", "value": "35484e592f7bc73de3abad386c578a86fa31efc009073bbf2722e13532a8b57b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ec0659-1c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688662201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662201, "uuid": "20bef740-2c82-43c5-a683-973ab0628d39", "comment": "Malware payload", "value": "9578d1343929b122db11a5a79f9ddcdb", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662201, "uuid": "b5819aea-bf2d-4871-8df6-5b0853093b3f", "comment": "Malware payload", "value": "359a42f042d2782241a6a1a185841c58fe06c2f091327a374587a3c42e547004", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662201, "uuid": "0a937542-8710-4e9e-a29c-4632f02c0d98", "comment": "Malware payload", "value": "cbdb219c60872138cb5ad71ca23aed50385efc06", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662201, "uuid": "42eeb91a-42e9-4c2e-96e4-bd77c705f5ea", "comment": "Malware payload", "value": "a05d5fd24137fb0b7e038f89a07c3296a0a07967cb49517ff03bc884f50ddb3b9ac0db977b152b58d45369b4c547b01b", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662201, "uuid": "fd1c2b4d-46cf-429f-b575-beb1f9bbc314", "value": "T1A9A4AE9A675A9D03C47516FA90F2D27643617EAE2111D34F28F8BC23BB797932C4E087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662201, "uuid": "a6c731e7-197f-4489-9c5c-d9286be84048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662201, "uuid": "c8487c6a-e738-4fcc-858c-1d3e463a635e", "value": "3072:D/sfkalFC6Noe1LsVpVS6iasV5D1LEj5uDNWlgd5a/FmVhz55MZuflg:7AHFtoXVpVS6bod5GFmVhz7Nflg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688662201, "uuid": "6c3946db-53c5-4ff5-a728-13cb168aa8d8", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688662201, "uuid": "9ba90d11-356e-494b-9be8-fd3d039757b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662201, "uuid": "4f968c6f-4435-42ff-90f1-88fdb7864960", "value": "Evolion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ffca71-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688622372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622372, "uuid": "bb56a816-d9ab-43d1-b149-701cda63d01c", "comment": "Malware payload (Stealc)", "value": "8843611bfb4961c59bfd389d2f344b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622372, "uuid": "e8657bbc-ea80-4400-94c7-4072adf42cc5", "comment": "Malware payload (Stealc)", "value": "35e91a913d37803e43aeb9b3b275bce89a752df65a18f726cd661282e4bdbbf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622372, "uuid": "7de8b374-3a3c-4ffe-a29d-f0b6d53362e8", "comment": "Malware payload (Stealc)", "value": "8e4fdb5acb005311f188bbfdeb31c89efa3587b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622372, "uuid": "c041dc70-79fa-4ed1-ad5e-252d21e8c1aa", "comment": "Malware payload (Stealc)", "value": "70dcba42097e8b1ad530a89e8286bef6d6ae3588ba7c2d2cd233dda67b855da12895f0a9bfd34cf0a6bd3b0a450f6eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622372, "uuid": "6043587b-c4fe-4cda-b6a7-3cfd4899d0f0", "value": "T1C7348E12F290ECA0D5264931CDAEC6E8372DF951CF596B5732A86F1F18712B2E273358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622372, "uuid": "3404ec75-0a98-4e5c-836b-c2db192ceb85", "value": "7b189a1ea318a56844e63d62f67d17ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622372, "uuid": "c0aabdae-7cc1-48ba-a863-60f4363e72c8", "value": "3072:r8qHL0yDZsyUoKB862jyLruQn4Ni2JU9Ok6l5WRNnhSb30uATf/:IqHLrayq83iDnoJ06DWRDSb3oT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622372, "uuid": "7902b275-3e40-4386-9c31-c72867297ed1", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622372, "uuid": "08a23b79-0c9f-406c-8e47-675f5f7b4007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622372, "uuid": "fd01448f-2c4f-46f1-abcc-fbd1b167c30a", "value": "8843611bfb4961c59bfd389d2f344b65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc797d1d-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623852, "uuid": "089156da-e792-4621-a8bb-bd9f4dfefe6c", "comment": "Malware payload (Amadey)", "value": "d44cd298e39e654dcdac7d0862751d42", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623852, "uuid": "00f04673-e036-4f6e-a552-4ac3e5015185", "comment": "Malware payload (Amadey)", "value": "3638ac28f639d8332da1cf97b08687de64bf7285644b59e3a363e1919fa5b54c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623852, "uuid": "eac01a7e-96bc-47da-9f26-2fa5b85126d9", "comment": "Malware payload (Amadey)", "value": "4ce3cd5cc5e79a008205a920aea0ab33dc2cf5ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623852, "uuid": "01ce5990-c0b8-450b-827e-f85abd134fbd", "comment": "Malware payload (Amadey)", "value": "04da21b0db3bb4f24f6e176f7ba5cecf2afc2c3e9f6a0ca7cb7f5508068bc7fec09af5ec9d1c2bd9da48d9c9e07cc0c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623852, "uuid": "b2cfd1b8-6e76-40e7-a7a9-d2addc71ca8a", "value": "T1D6560152290C5C1F907278241FDC549369ADA3BA1B170E9235D2EDEFEBADC80F650B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623852, "uuid": "178b0bd6-ae51-4357-a8cd-0c6f6ad8c914", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623852, "uuid": "5948343b-1af0-4056-8ae6-298babb7c1da", "value": "49152:yrZu7d9mtnhBOI78W36d2BaBkQXIk2HJtPAyJVvKQW/G3ZWhvgKHKkwfFf3MQRxj:yr07d9ZI7xVEB1XfW2B1UdloA7i4KLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623852, "uuid": "adffc010-bd48-4345-9fe6-06f6730826c9", "value": 6038856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623852, "uuid": "2d681a07-8874-439f-8a18-d3d225da4c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623852, "uuid": "0b6e61a2-4673-4fdd-b7c0-0007e30d1a8e", "value": "d44cd298e39e654dcdac7d0862751d42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe81494-1c0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688654970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654970, "uuid": "e24c1c07-e916-4e65-8c7e-6ff9b4fe84fd", "comment": "Malware payload (RedLineStealer)", "value": "80eb6ca91477f2c277b3de2dd31f4d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654970, "uuid": "8b939894-bc89-4fc4-83d9-218ac5322f97", "comment": "Malware payload (RedLineStealer)", "value": "36780561d24a988e483c275e40a4a4e4ede4e8bba85417c7dcbae5554e5117a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654970, "uuid": "20f15f02-17db-468a-ad39-0ca9c72f1edd", "comment": "Malware payload (RedLineStealer)", "value": "07b59016cf7cd558dc92acaea55972c8afc69627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654970, "uuid": "2a8c505f-3119-4a66-82e2-78970b8cf1ec", "comment": "Malware payload (RedLineStealer)", "value": "239758848d5a93174703663365334fe2d1338ef3b12bb4b2136d91f0e413450d2a5899cbedeca8e00408459c496288a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654970, "uuid": "088a0a2a-d877-44e6-96a6-b4c8fae5bcf6", "value": "T10BB401333870A917F48AD97196B655C0FF6DE3E53B75908BB66CE03A2B432D0D324629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654970, "uuid": "27c1b59d-98af-48fd-b818-f272bd115340", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654970, "uuid": "016c7657-f839-4399-aeb3-c7b08a69cbc4", "value": "6144:swqBq2npxfvQCAFbmaklCdnQgMF/de07d++S5bRDYyAidR8mECt+V2DDDym5h:shqmfvLaRdnQgWo1Yq0CtbHy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654970, "uuid": "408c4c16-24b7-4fde-bbf0-7386a5682bcc", "value": 513352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654970, "uuid": "11d925d5-8d6b-4fc9-9e5c-b0d04610375f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654970, "uuid": "c6366633-e7c5-4b4b-ada4-b0719ed029bd", "value": "36780561d24a988e483c275e40a4a4e4ede4e8bba8541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1890c82d-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688644139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644139, "uuid": "e3795010-8dc5-459b-a279-d6825b925cc8", "comment": "Malware payload (Amadey)", "value": "999919f5b45cc6d7479b295da8771f3f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644139, "uuid": "e6ffac3a-9eec-436e-9e08-5db50e6cb5b2", "comment": "Malware payload (Amadey)", "value": "36be6e4178bd219622e7c47a5267261a087ed1c9d9fe6339508f9d7fb9eef730", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644139, "uuid": "97943847-183e-41cb-a7c0-bc60dc01646d", "comment": "Malware payload (Amadey)", "value": "f3dc28be39527f62c1fd23ccde541a244105d58a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644139, "uuid": "bb8443ec-2510-4afd-911e-3335d898780c", "comment": "Malware payload (Amadey)", "value": "d4ad52fa67dd77d4aca740d42a5f327797e4d8060d5fe71f10fa408df65e76181d7b404108c918c17acb80792fedb87d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644139, "uuid": "d9760ded-3cfb-4b70-9f44-2fdf7ecf41b6", "value": "T134160119202D8E6FD47535B127EC1593F9ADA470671F0E0622C2EDEFD8ACC81F69189D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644139, "uuid": "53085cf6-d42f-42fe-8482-c5cc86e4b403", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644139, "uuid": "3e027eff-3117-4c02-a29c-744e2adb1b8f", "value": "49152:l+IHuzazcTy7kd7PMB/70bx46n8Jr6jNIU8Q8uH28ipGrqLs7TporIU3KcBGkpMc:EYqJWg8/47okc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644139, "uuid": "8b212b6d-661e-41a8-a717-8bdac73f2a65", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644139, "uuid": "6207e5d9-e882-4911-84bf-139ffb1005b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644139, "uuid": "ef47b4bf-be4f-4938-8182-4fd95d84645a", "value": "999919f5b45cc6d7479b295da8771f3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534da6a8-1c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664854, "uuid": "3731e8d5-898a-4b13-9456-4097fc52ad97", "comment": "Malware payload", "value": "213c55303391143390a2a61c6a169932", "object_relation": "md5", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664854, "uuid": "d46b9ee5-6229-4722-a37d-7abe10167820", "comment": "Malware payload", "value": "36daf6de128b4d0e20e5aee53e4d8b57fbc6beb5f25caf4e91fe0843cc651b17", "object_relation": "sha256", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664854, "uuid": "2debfd0c-d807-4771-a8c6-f245f7db0bd6", "comment": "Malware payload", "value": "87f7d9ed38c738fcb64e8e634da70a00f0646539", "object_relation": "sha1", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664854, "uuid": "bc4b5548-2442-4b04-a98a-eef08ff1442b", "comment": "Malware payload", "value": "a2638fa767443e2713a5fb7c7c83b5d9e657aaccc738b02b37b07f929a84ce42fb3b4837c91f16b1fb4cbeb30d7ef039", "object_relation": "sha3-384", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664854, "uuid": "c9c61ab9-3921-4753-947c-2fc0fdf8b92b", "value": "T14C14E06173888659DE2E8B3AB45310A07335EDFBE752C70F24887279FA3A7C2505D987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664854, "uuid": "4f922bdd-72ae-490b-9bf4-5ea9c1cdc327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664854, "uuid": "98bfaf45-f826-4f72-bc76-214744ac028e", "value": "6144:KEq4fSgIMGtJ8Fdkyf/LZ4n1BkSgbj+M6o1:KElagSJ8HkyfF2ud3+MX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664854, "uuid": "6a8d55a4-8627-453b-b67c-33b55af63378", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664854, "uuid": "3d7785c0-a983-4b39-9de7-6730e8a8f522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664854, "uuid": "0e4d4c01-7506-4080-be7c-dbb664f9057d", "value": "gakljeqwkfqw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543c4da8-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1688622765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622765, "uuid": "a9c14401-9c0a-4b5b-a5df-1ecac767d191", "comment": "Malware payload (RecordBreaker)", "value": "4695f98bf6e8c0908c0b6af77ec31a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622765, "uuid": "005e52aa-d4e2-4b2b-9151-116c0acaaa74", "comment": "Malware payload (RecordBreaker)", "value": "36dc266ad1ea8df01393368710ee6c6fd21629e833252cf0f3f63dffd908c805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622765, "uuid": "3819a8fe-8bc9-43f3-80b9-5abaf05ed0b1", "comment": "Malware payload (RecordBreaker)", "value": "41b05253a583238d6c583a97eb6d45e92607f53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622765, "uuid": "f9d57dae-44d1-4249-a8d7-66d4a834b80c", "comment": "Malware payload (RecordBreaker)", "value": "0b507783c9a54776aec37182c2acf2e23a0d8af3d7e6fb1b3e163454a45e523d4f1de14c465274af480d8e6d133e4a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622765, "uuid": "18d26060-a09a-4b6c-9b09-180fcd766933", "value": "T1D2065907B64B85E5D85A1B36C16A783C83B0FCDB66D3F619264E23140F47B666B09E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622765, "uuid": "a9b9855c-78db-48e4-a2e2-a858b5232dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622765, "uuid": "dfe0be9b-9c06-44d3-b20c-5f87ad3b902e", "value": "24576:Pam/O3RT2048qUkeSLdnC/sGB9D/YBl7B3Yom6pd+e6idu6sN6FCBfcW877++aIS:PaZ3Rb4UScABl7B3YH6pd+e6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622765, "uuid": "9f8b8118-5b55-459f-a07c-5ea2c2ff4869", "value": 3657216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622765, "uuid": "f5c56c9c-3a5c-4f34-a80f-4cab20cdf327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622765, "uuid": "c0da9b9a-9fe8-40b9-9f2c-9f077e2aa00b", "value": "4695f98bf6e8c0908c0b6af77ec31a6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039b5023-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688636373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636373, "uuid": "87c83c08-652c-4562-ae16-2a6de0520b88", "comment": "Malware payload", "value": "791b0f888036c561c259a0df9bab9302", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636373, "uuid": "62359c17-9ef1-4ed2-8ba8-e94353026fc9", "comment": "Malware payload", "value": "3790a1c1b4c4c46d88f2d350befa0745a0d09b78fe41b79118e7af89814db6aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636373, "uuid": "801558bb-b610-4cfd-8448-f37df5e63643", "comment": "Malware payload", "value": "137f461e1a51f3876cee1c2ddc10acde825e91b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636373, "uuid": "07d4f56b-7d9d-460c-89a2-79466dc65056", "comment": "Malware payload", "value": "3c4903a4fc7ac34074495b3e3f71b74619aff40655ebe652d8796542a5a0b36b7ba5d3dc4b41710d215e1be518286f4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636373, "uuid": "ef0d967a-06b9-4d55-95ca-661b5cedce37", "value": "T110A623223187C427C96D06B924BDDB2F426A7E36473614DB72EC7F6B18F19C12332A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636373, "uuid": "5f7cb248-189a-41dc-8929-8ff1ddeb6078", "value": "ea8283948b60a7840218363fe03ba320", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636373, "uuid": "33fa1f6c-51ca-4db2-82c2-028b5bfdd493", "value": "196608:VJbD8ATjbLwGsg1RYBJjNfsZo8vUNiFqzcZXAtB4XESmQW3pSz1C+gVG2V3pZlQ:LUkbUGs4KyoYwc1AtB4UkW0z1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636373, "uuid": "be35afbb-5f86-4311-9cd1-32fbbf178de7", "value": 10358272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636373, "uuid": "07bac7c6-5234-41f2-b160-8480329b7d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636373, "uuid": "daad99a6-0deb-4ba1-a89d-c098615428fb", "value": "SecuriteInfo.com.Win32.BankerX-gen.6072.31648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4269845b-1bc8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688625741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625741, "uuid": "27e17f26-65ee-46d6-8ab3-529bce1a257a", "comment": "Malware payload (Formbook)", "value": "492aadf83dc7f018a4328b5d6aed4123", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625741, "uuid": "987a17a5-aa6b-44b1-87c0-9292bce2ab3a", "comment": "Malware payload (Formbook)", "value": "37eea48ab368f67c8303e409efdd35a9f8075eed7b3ef130738b74f2af3ec0c1", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625741, "uuid": "54ee95bd-a357-486a-980c-1bb3a0851dfb", "comment": "Malware payload (Formbook)", "value": "c1d199c5e7ea26e16b7812bb1cf4c44a1cddb84c", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625741, "uuid": "61ec5942-cb3c-4647-8225-64346e517c5c", "comment": "Malware payload (Formbook)", "value": "50353119c3b37921d1966381c09c3d9554a625fb5848b76dda608a8fcf917b2d82a0f3a58b681a574682a026f01271ef", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625741, "uuid": "bfe544f2-86b1-45c3-8461-7e3e2d117554", "value": "T1C7E2835AE79B02758F9112B5271E0BC99B6DB13EB35150B1386C833433E9C3A4676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625741, "uuid": "ead2daa7-79d5-4356-a181-12b6550bcbef", "value": "768:2Fx0XaIsnPRIa4fwJMNQaDhHlUrowRmuQSWz:2f0Xvx3EMueeQZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625741, "uuid": "c119d513-f9f5-426a-a5e8-2730dfbeaa51", "value": 31954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625741, "uuid": "02266f9e-4d62-4cb1-a592-acc56a86ad96", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625741, "uuid": "bc8c538d-be42-425c-9447-cd7ebd487556", "value": "492aadf83dc7f018a4328b5d6aed4123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bf438a-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623604, "uuid": "854ac162-b716-4e43-a6f2-c5d217585196", "comment": "Malware payload (RedLineStealer)", "value": "90c79d9d90a2c226ddd4d6ec46ac0874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623604, "uuid": "aa9943f4-1741-492b-b7a5-4b76d213b068", "comment": "Malware payload (RedLineStealer)", "value": "381bcd71d18e07db63a4863d8f94583f80329714a015dfa0bdc14777acfa44f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623604, "uuid": "e3acae18-cce5-4a0f-baf6-b8df32515a0b", "comment": "Malware payload (RedLineStealer)", "value": "d81f731c00a987a99c03ddd819ffd3d7b9463a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623604, "uuid": "ebf9f946-719a-4354-a613-11b864ff8c7c", "comment": "Malware payload (RedLineStealer)", "value": "e05697b12a2c2856af36c45366a0c8f05c11a059376dbc708ef8a8412e620abb1fcad00922d52b9ea3700072e7df42b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623604, "uuid": "c0bdc5c9-43f5-44b3-b5fa-70eab1cf952f", "value": "T118160119606E9E5FC57434B167DC0A93F9ACA870271F0E5122C2EDEFD89CD81F6A189C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623604, "uuid": "d9d2d8f5-4e3f-4fa1-a838-eaf17f1bee88", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623604, "uuid": "81fe05ce-418b-4614-900a-9e5a6d62c6aa", "value": "49152:WfAWLWF9LgLHVqOjXxhVrWiNPv/GYu9FQcKYAlOnL5qVGWvqUyUaluEMAlm3jVkc:WlhrBRiFhOI8+10Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623604, "uuid": "27d30bc8-4554-475a-a10c-953038aeb9b1", "value": 4064072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623604, "uuid": "c4efdfd8-1588-4ee3-bea6-9ded86670e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623604, "uuid": "0b109538-9cfd-42f9-8424-69a3cffda024", "value": "90c79d9d90a2c226ddd4d6ec46ac0874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be5b90e-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688623126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623126, "uuid": "657ddd80-4246-4dc0-8f34-5f53d60d17ac", "comment": "Malware payload (Mirai)", "value": "b6b0782f905d601ba32da695318f2b74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623126, "uuid": "363fd247-a8ea-46ad-b53b-cdb6260f1ba6", "comment": "Malware payload (Mirai)", "value": "39155a54542f5a09ab34f336a181f7a98cc019339818aeddb0690c658c8f20e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623126, "uuid": "478c7179-3eec-4af6-895a-b94ebe415d0f", "comment": "Malware payload (Mirai)", "value": "36634a0673f3bd69185d7520692e929a79da07cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623126, "uuid": "63936fa3-b32e-41c9-aeba-c39b31a8183a", "comment": "Malware payload (Mirai)", "value": "36af3f699bfdf94900eb4e713e6586fdf8d10389a214497b488c38571dc31d359f4434fe676f645316ccac82d535ea7f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623126, "uuid": "6e1bbad8-7c93-486a-afdf-8ff843e946ce", "value": "T118733B45BD819A13CAD513BBFB6E01CD371223A8D2DE3217DE21AF11338696F0E67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623126, "uuid": "91a18222-a741-4bfb-a634-cf862653d5b0", "value": "1536:1lPa9Vrr9dZPul5dNhtBulufYkxAyBB1+AOAjRSgVhvmd:1lPuRZP2Ul4xJBKAt1z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623126, "uuid": "47d26345-76c8-4544-a322-80cfd6e834cb", "value": 75068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623126, "uuid": "2e5aca5c-308b-4987-8ce4-e3b1d2855197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623126, "uuid": "4c1fcc9b-9071-42ba-8341-ca99cee9b5b7", "value": "arm-20230706-0558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5867b2-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624335, "uuid": "3eed0f70-26ea-455a-8b3b-246a07deba15", "comment": "Malware payload (RedLineStealer)", "value": "ea193f406ff6346f351400a739310f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624335, "uuid": "81248c7d-a9b6-4af1-9bff-1b444fafd36f", "comment": "Malware payload (RedLineStealer)", "value": "395b5340ccfc8e5821c0d1084e088964fcdb038a97151f2bd6d1ff281e9b4ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624335, "uuid": "b8081b71-7eef-4386-8920-760ea76a66dd", "comment": "Malware payload (RedLineStealer)", "value": "7a3690c89bd528fb115e524f69051c523627dc33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624335, "uuid": "31aba791-91d2-42a4-bfd9-1d24ccc92476", "comment": "Malware payload (RedLineStealer)", "value": "b276f6d51965f0df894e78fc8b0c1fdfca0b2b27ccb222f3c2b45de336f886f10bb79cacb4cfdfa391b28e4c28f58ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624335, "uuid": "b0920b00-47ca-42fe-a9b3-84fbe1cd5cb6", "value": "T12E560025291C4C5FA53238651FDD545368AD53B90B230D8632C6EEEFEBADD80FA8172C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624335, "uuid": "453f02ae-a9ed-4d71-bba1-aef8cb9f650c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624335, "uuid": "e25b27f5-4247-4cb3-94f8-bbd69a81c5c8", "value": "49152:dy69RtKWxPh9jTWzhHdxX6MU4wOiqn/GfXAqXxC6H+8viJx+7BfB7c3+9Dhtv9vC:dDYWxJ9XWzRW4DGTLNvikLKoxBTHiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624335, "uuid": "c8c1d349-f16f-4801-a0fc-86d0870cbe8f", "value": 6035272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624335, "uuid": "d6e3934d-fca9-4be0-b42d-85fa5798f8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624335, "uuid": "453dbb21-75a6-4861-8aad-832aa50e1891", "value": "ea193f406ff6346f351400a739310f35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f59277-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623868, "uuid": "9b893450-3331-4e50-8d1a-1a54e2c9a2b1", "comment": "Malware payload (RedLineStealer)", "value": "c7a55db1377ed620e3d4c4c0b6b90d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623868, "uuid": "33f8c117-7e0f-4376-b7ec-2fefa3be16b7", "comment": "Malware payload (RedLineStealer)", "value": "39943a7f5adbc87c332a71abfe242f8ef797a514e19bec5826c96c5ce71e8781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623868, "uuid": "5001ef50-a800-4f3a-b3c9-28323c1f2644", "comment": "Malware payload (RedLineStealer)", "value": "4958b9718e3c657ca0412dd7c83ee6c587a93310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623868, "uuid": "c26b8bb9-90b8-4c4e-8ab0-671c7b6f1bc7", "comment": "Malware payload (RedLineStealer)", "value": "6b0591fd7f31ddebad6ee305aeda07f2bb23839e0e8d79fa8db9d9cb28650fb02da68a2a9f06c7a590c1aa0daf0f5a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623868, "uuid": "b9457247-aa0b-4a45-9ad4-bcfe839e3deb", "value": "T1D4560152285C4C0FA07234201FDC4463A9AD63792B274D9635C6EDEFEBADD84F691B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623868, "uuid": "0280b416-d1c7-455e-9553-48ce625f5f3c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623868, "uuid": "596b27c3-a876-422b-ade4-d513d41fee4d", "value": "98304:UO70lfyix9Ki3V7hXpd00wUnApb95IRQdl1OIgL:UO70lf9x9x3/bXwHG2dl1OI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623868, "uuid": "638dec05-2d84-4fce-a9b7-d88e378eb001", "value": 6042952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623868, "uuid": "44fff41c-da2e-4020-b026-e11ed288bc39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623868, "uuid": "c34f1108-3396-43b6-bddd-9d93c06ad849", "value": "c7a55db1377ed620e3d4c4c0b6b90d25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bd18bc-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628184, "uuid": "8126b6c5-4053-43db-bbb8-d59122e00450", "comment": "Malware payload (RedLineStealer)", "value": "cca1d3663bae1f6901385599019dfc5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628184, "uuid": "647bf77f-d845-49a8-874e-0f4f2336e609", "comment": "Malware payload (RedLineStealer)", "value": "39d194b2f09006523c19aabb4f1098e81b294a75df349b3d27a9aa34ac9985d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628184, "uuid": "3ba1edc7-5103-4308-a421-c7919d9b78f4", "comment": "Malware payload (RedLineStealer)", "value": "a235962e9b2365579b77c9048bc187ae2dd7da97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628184, "uuid": "5764161e-9e78-4ad2-94e7-472c682dae03", "comment": "Malware payload (RedLineStealer)", "value": "0dbb21f619b8a320b2b16718229e9fad592a8285d4f55fcdaefc67b1f5f157ab3a3a6ec817a9b9371e3e2090495d0060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628184, "uuid": "6fc306ce-3845-4519-b5ce-e06c4a44d058", "value": "T10C160119641D8E5FD470347527ED5993F9ACA4B82B1F0E0022C2ECEFD9ACD81F2A599C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628184, "uuid": "7995bcee-0fb4-476e-9935-ffec0e493951", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628184, "uuid": "ca8326ad-395d-4ac2-9527-dcdbbbdd683a", "value": "49152:7tHGB0NUeoZgHKcPuinu0b8HB5RX07Vsqk0yUdI4+6ZrvD7S0SOa3LsRK0kbpuvN:HDDeKsq+GRrq0SpXwwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628184, "uuid": "ff61a6bb-f124-4ac2-9e1c-d8e91dd64014", "value": 4081992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628184, "uuid": "207d0e76-579f-426b-ab1b-b708fc4d4b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628184, "uuid": "1a4da45e-c1ab-40fb-b5bd-4221fff587a3", "value": "cca1d3663bae1f6901385599019dfc5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099d5640-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645832, "uuid": "4a987675-ec94-4832-aaff-954639f5936c", "comment": "Malware payload (Mirai)", "value": "67dddaa9a0ee7ed1215bd5300ed9d651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645832, "uuid": "1749ea25-2ca9-438b-b72e-5dc5d5d8eae9", "comment": "Malware payload (Mirai)", "value": "39ff50d77cef6d53918096ce4181eed0503083167928e0f24b3e0be5b2fc6e90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645832, "uuid": "c658e196-f28b-4c8c-8ca3-539d966413c3", "comment": "Malware payload (Mirai)", "value": "ea17a311c7dda10d9a808a175b238d3948cd423f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645832, "uuid": "e42a0094-9e9a-41f5-8d1d-816825219443", "comment": "Malware payload (Mirai)", "value": "8ffc346667c2389b6c448081afcfedc04384687f3ac494b1fef899ba7f6cc40571f14c343faac19d3f1caa71d8c81c01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645832, "uuid": "612284ea-70b1-43ef-ac94-226224989b9e", "value": "T198F2F262654FF432CC403C3D9A1FD84DDBAE679D80E935A10841A47CEE921927A6F1E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645832, "uuid": "022109f7-8305-4e27-baaf-280fb4863419", "value": "768:K8AfPa0bejYLOGfF2yvL+6sTRjuIa5QKGSiFoDGggi3U1:K8XEejQOMYEwTbauSiFoxgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645832, "uuid": "6d1c03a8-9112-460d-b850-f166c0415318", "value": 34572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645832, "uuid": "be67bd5f-a691-46eb-9252-305a0c0ba634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645832, "uuid": "5626bf35-ef85-4c06-a26b-743d31418c7d", "value": "67dddaa9a0ee7ed1215bd5300ed9d651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb5807f-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624282, "uuid": "54e48790-7d52-477d-8c2f-5f3d2097faa9", "comment": "Malware payload (Amadey)", "value": "da686868e1e7a147ffe50ec986fc004f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624282, "uuid": "c45830a2-55b7-40a7-b4d3-56e50d2ea1bb", "comment": "Malware payload (Amadey)", "value": "3a22e6391f675dda336ffecdb4ed1933d4de05e3ae9d3616de57e6125620b547", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624282, "uuid": "c49c7843-19c5-4b98-a064-2dac3013a399", "comment": "Malware payload (Amadey)", "value": "8f996376ca8c9e2b7757590a68e2dc433ec0ad9c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624282, "uuid": "6efb241e-cc36-45d6-bc38-2cd158b6ea95", "comment": "Malware payload (Amadey)", "value": "37885b080bee7e2171a4009befaf86301e8cff2feb80a51557ef5e3cf7dd915869fad51cca930fdf80f1df9a52dde881", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624282, "uuid": "fe795545-d541-4fe6-b9f2-b4522a84b83c", "value": "T1C6160109516DAE6FD57434B127EC0953FAACA4B5670F0E1122C2ECEFD89CD80F6949AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624282, "uuid": "5247f654-d903-4075-b4a7-d5995b4f28b1", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624282, "uuid": "f2b8f6f0-6be5-4a1a-8243-c75b33b9c4b9", "value": "49152:i6+LaT1Oa4YU7yK+bun4iXdxh5mhkbSr9PSJary6Qit6wnnUwQgtgER/mvd/bfBg:iGk7ybu4iJdeS8tJtc6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624282, "uuid": "f2f8b41b-8e90-4054-bc39-53c77ea439f4", "value": 4064072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624282, "uuid": "41cedfbb-5e00-4b0f-b49e-04766b07c65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624282, "uuid": "54fd19ef-e393-4185-8a32-38f80ad871b2", "value": "da686868e1e7a147ffe50ec986fc004f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37208638-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610260, "uuid": "b5eb60e1-a197-4c42-8b06-898dd4de7b58", "comment": "Malware payload (Gafgyt)", "value": "2c3da1369d32d9e65191059f1ac9b6af", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610260, "uuid": "8641aed8-68ef-49a6-9387-ead710d193aa", "comment": "Malware payload (Gafgyt)", "value": "3a4e0e2af38b8713b31b2cbfcc1bba922c98ad9e25558ea270cde4654f607288", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610260, "uuid": "9bc08b35-a7d8-4f2f-9a35-312c579cd36a", "comment": "Malware payload (Gafgyt)", "value": "dac5e5697858c197b90a6692a9065c6a18003563", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610260, "uuid": "17e3ca5a-4109-4dd5-8212-e7ccd6940e15", "comment": "Malware payload (Gafgyt)", "value": "d490702ee7b6b1802020db4b5e5e2a46362f2c922a06edfad1d2879a327b2ffb929b1d300bed99d46b923c080b5abbfa", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610260, "uuid": "91c6bbb4-9132-4915-a782-2c649888ece7", "value": "T175F2B703AF914FA7D86FDE7746FB0B45208EA41626A227263538E87C734B0CE18E3564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610260, "uuid": "a9c0c5fe-3f73-449f-a8e6-b2954a0877e2", "value": "384:k5QexgQ25lOcirAiKVZj+1mbFD1SfeOeYFePqhFKXiWEtb5qzjDjURNGCN7Styp0:tt5/VgfeOeYFeysXifp5qfEJSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610260, "uuid": "fc439f33-0922-4082-aded-6a444150240d", "value": 37609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610260, "uuid": "3c6ba14d-aac9-4687-9b96-63a536b48d7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610260, "uuid": "217c4c20-35d9-4cca-99b4-513be1c1a99d", "value": "condi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8325c91-1bdb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688634180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634180, "uuid": "df9d18d6-7e1a-41ba-a538-f439140b3ee7", "comment": "Malware payload (GuLoader)", "value": "e5da81cdcb2428ff4c616211c90d367c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634180, "uuid": "0b47506a-6e5b-412f-b376-b5ac090d07ba", "comment": "Malware payload (GuLoader)", "value": "3b022dfcdae2f00de3376f5f701f7f258623dde149b695b0afd6e4afbae90ceb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634180, "uuid": "455ad0c4-3b58-4a49-9230-a29898cc9103", "comment": "Malware payload (GuLoader)", "value": "d7a27b8cca27193b24307a7e225b31d6548c88d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634180, "uuid": "a5e5752b-34d6-4433-b647-f615a243d89d", "comment": "Malware payload (GuLoader)", "value": "758250b1ee6641ab917ba902a9784006ce3ac2eb2a5bdf9baa341599ff18728c3594a373105339ca654be5838a7a5eeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634180, "uuid": "8555efaf-0478-4273-8344-bdf78a55bdc0", "value": "T1A6D4E0F2BC84A8D8D4D3C5331D62B45D65EBAC384A5524DBFA81372E94338D66CB3A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634180, "uuid": "2ce385df-adbc-4178-982d-62f7dfa44e88", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634180, "uuid": "d2c37c84-2d8e-4396-ac59-a472e29893d1", "value": "12288:DnzAPyAmgYqXfkqcHKu+enPnU46MK4yurvWWOj8e:Mm1qshKJQP36QyDWOjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688634180, "uuid": "02bc0d81-fabc-4600-83e4-6a8db6aeed9c", "value": 634024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688634180, "uuid": "80a29115-2d30-4f1d-ad49-ed8d7d9b85b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634180, "uuid": "0017fe10-ac00-4f42-8537-5cf31630d34c", "value": "e5da81cdcb2428ff4c616211c90d367c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d10b58-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643136, "uuid": "e06109c2-d254-4cb0-9e74-95292cb6830b", "comment": "Malware payload (AgentTesla)", "value": "611dfc1c5be24f40fac35b6492a239c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643136, "uuid": "ad7282e6-82eb-4bb0-a34a-c2c38ae8ac89", "comment": "Malware payload (AgentTesla)", "value": "3b0760dbe7dc9ac6a2cf5971ddde67c51e57bc973995cf641de226409b537817", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643136, "uuid": "25dd5d78-80d3-4198-816c-7006e48acfa5", "comment": "Malware payload (AgentTesla)", "value": "23122a776057802b2c507f6663221844231f08f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643136, "uuid": "a788b06a-1819-4676-8e7e-a2e406a48cd2", "comment": "Malware payload (AgentTesla)", "value": "60ad5ffe51732a90be9efe367b7ff03b9ffc97fffafa806149a17d79b66bd894d2b93138f40ec8bc918ac0dc47e30baa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643136, "uuid": "b1d79b8a-3542-42f6-938d-ae91aefe7647", "value": "T1C91512A907E2444EF66B2FB85C934AF4D1E46ED93867C64BAFC3BD0CFC75A086940191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643136, "uuid": "7560b06b-f482-40cb-81e1-201380392df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643136, "uuid": "6982f1a7-4332-4afc-8958-fb54474d50ae", "value": "24576:JO+xL9Rk9ny1KLBxTrhNCiYPn4/k2ILKMvO:JO+bk9yeCpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643136, "uuid": "49459432-3d00-4243-85e7-e7698441bc60", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643136, "uuid": "d7deda68-4c24-48b5-af9d-c32f2e24019f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643136, "uuid": "0144d58f-8cd1-4fff-b624-31e5280099be", "value": "3b0760dbe7dc9ac6a2cf5971ddde67c51e57bc973995cf641de226409b537817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc05c59d-1bc6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688625113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625113, "uuid": "30c281b4-b515-4bc4-a435-b230d5948c9a", "comment": "Malware payload", "value": "ed2649f6a1c587a227b0b5ff5bc6398f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625113, "uuid": "a362f6cd-5dd4-4d26-82e0-505da825ab4f", "comment": "Malware payload", "value": "3b1189567057a0e152078944645eb5ccd1b2448c18cbd65daffbc714d51f1956", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625113, "uuid": "f479f9cb-8917-4b6a-a531-f4420c06a6f0", "comment": "Malware payload", "value": "d47f93ad8bd2a100446c5610be848c36f06c5f4a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625113, "uuid": "219c2a17-b35d-41d2-8859-345a207c7d1c", "comment": "Malware payload", "value": "3f755c33a0a67adb0b9956a301928c11abdc0c4ca8cea39164047f1fb517ad26bbc414f25ab42cc5c25abbc702c64d90", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625113, "uuid": "83e0a5ad-f5ea-49a7-b217-0ff6022ea9bd", "value": "T1F3D2F15BF2C02F67A2B0272C053D67CF3B6025A548AAF11E88FC03D9F63964505F625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625113, "uuid": "61222ce7-192d-42f9-a63c-4bc23102e3a7", "value": "768:v6kom0OCvpOvdnuyFLjgzXC5D6kU4NP1+LQc/1JoICY:v6kNzCvc1n7MgOkU01+x/ngY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625113, "uuid": "99750e9d-1280-4397-a6a9-45f37e1427f0", "value": 29621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625113, "uuid": "1a49f913-9d54-42cc-b983-db3150492ea8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625113, "uuid": "4649188b-91bb-41b6-b5cb-50dd7bf8fbb9", "value": "c1acb32f6ceb772a525ec3e41ea0b5feab31f7a1f51922f98f637f0dee71b6f7.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db4d956-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645839, "uuid": "665330be-6661-4aaf-b3c6-01dc518f21c4", "comment": "Malware payload (Mirai)", "value": "72d35f3bf0c5ce04dafeb25944a592c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645839, "uuid": "83aead5c-c4fb-433a-8aab-42bcbdbaa1ad", "comment": "Malware payload (Mirai)", "value": "3b5f4bfdd783f4143d3188c66a26f6dc50b559052a5b892559c7261ab6e3474a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645839, "uuid": "b711e18d-e02e-4fd5-87aa-1f0dbf3c8ef6", "comment": "Malware payload (Mirai)", "value": "08d2a9bb9ce94cfb0c91525ba8aec189439d7abd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645839, "uuid": "ef526f0c-91d9-4cfb-8f72-48ca2d6da6cb", "comment": "Malware payload (Mirai)", "value": "ce1184a7bf6c2330b0ff14a9833601b76033533695f5c9ec238e2ef212507d58e5ab122d584d41d3e977de086df53992", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645839, "uuid": "5c07a2e0-5e7f-458e-b5be-fbe1dfb765cf", "value": "T18603E05AD8685DAEDC6D1C7E16763A604EC86082B2CB1F4D03450DCCE7A5B2BBC5D4D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645839, "uuid": "06069ad3-abb4-4236-aba7-64c928ecf96e", "value": "768:HtiNiNdNpdT7/HFDJ4aAO6io5Udw6AQYDM7jfLESYWOQgZlwFWMz:MNiNdNH7P4aAO6ioKdmQY4IPWOQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645839, "uuid": "424e890f-8f6b-4d95-8833-862bdded103c", "value": 38504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645839, "uuid": "8aa0aad7-bd92-47f3-9a15-dd5846e815b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645839, "uuid": "7cdb990f-28c2-4eec-ad5f-f8101cb70a47", "value": "72d35f3bf0c5ce04dafeb25944a592c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0615b83d-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638095, "uuid": "fea3ab9c-28a3-4f54-88ed-12326ee19c6a", "comment": "Malware payload (Amadey)", "value": "76314a4274100a6af6c20167a0883e88", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638095, "uuid": "71441c0a-44e8-49a8-af29-bedcd69921b6", "comment": "Malware payload (Amadey)", "value": "3b868a829ad8fd119cf874b85ecfade086058bf2ab536d397a07c13dcc1143a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638095, "uuid": "4b6b8edc-5484-4246-9311-94cbd65f7d02", "comment": "Malware payload (Amadey)", "value": "07d8b7b2d5d21011ef96a4d1b86f99341d3ee2e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638095, "uuid": "1ead7034-250d-41c1-840a-715110bf1c3c", "comment": "Malware payload (Amadey)", "value": "a9e8f994f2edc08185d49ba9ec3c0569dda3493772cb85f0c0bbe121b0ac21a8d841a24a9f2a02bd76dd95d6d110d22d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638095, "uuid": "6801aa78-eead-42f7-b792-6d8ded12ee03", "value": "T126060142609C8EAFE53A3A3537DC8453F86D9474DB090D8121D62CEFC89DE83F6A659C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638095, "uuid": "282fa29f-655e-45ab-b8dd-70f1d6aae292", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638095, "uuid": "4d6e990a-5167-4f9a-8648-aedd7322929c", "value": "49152:OlyNR+y7VAsjr8NJ/C+OgCH/hjYEcx8FIzNVuTtuuWwF7aKueIa3xjmFfmsk60+5:ZmC5YEMYO2p6wVatLFS+t3PiOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638095, "uuid": "74c1612a-7619-45ed-8f48-84ec21696a04", "value": 3773768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638095, "uuid": "952f5969-18e3-4da5-b1b6-251e1bb6cc91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638095, "uuid": "7f8611dc-aa7e-420a-b215-06aa252a8d81", "value": "76314a4274100a6af6c20167a0883e88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b855f9-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627332, "uuid": "2476d5cf-68c4-4695-8973-93286ee9c6b9", "comment": "Malware payload (AgentTesla)", "value": "4eb9dc240fcf0478a8e66da197a20119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627332, "uuid": "bc093ece-6bfd-4b14-8b3a-38a0247e83c0", "comment": "Malware payload (AgentTesla)", "value": "3bbd21f5a022a0133c020321783cc10a295795b97f799773dea00b295b51a510", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627332, "uuid": "a0cc9368-6bc7-4691-9892-434e4a1e9314", "comment": "Malware payload (AgentTesla)", "value": "144e863a091bfda3c47b255e7679c64ab49f3712", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627332, "uuid": "a6486859-60a9-4db8-aa5e-f4c60e806ede", "comment": "Malware payload (AgentTesla)", "value": "6122956c03cac7218c0535ba506399205c54217347ba291e7da535a1c9e9fa535f664003d51b63c68338da49941e9acc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627332, "uuid": "efb16a3a-8e03-4baf-b100-0e44870d0a30", "value": "T17655E0262A9CAB73D4E8677981027D6817FCDC922066DB873DF932E805F7B834E71254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627332, "uuid": "4d025859-2860-4cfd-a32d-cbe05042e2f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627332, "uuid": "4b837a0f-4605-4ee9-baad-78e681d81c74", "value": "12288:sbt12i2c9b20yCX4q4aPbrJYJNmuf4vcfKKGqCNLYLX7oe7gOwpKoNv:YPTU4kscl7W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627332, "uuid": "5569ef1e-b479-4232-889c-6111f442b632", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627332, "uuid": "381241fc-6bd1-4543-ab92-d1663fd1af41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627332, "uuid": "c8a8468a-f61d-4e51-a6ab-a4d3d41a7274", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c9e43-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688624160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624160, "uuid": "9cce71d9-cb86-47d6-9cd1-e9c3826ad237", "comment": "Malware payload (Formbook)", "value": "20630c0707f4913e69098a048ff472eb", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624160, "uuid": "c60085d1-4520-4d6a-88dc-30faea4ef2f4", "comment": "Malware payload (Formbook)", "value": "3c3a24cdf448656b954283085caf6d82854c3c5d9a9162f9da347330a1cc38e9", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624160, "uuid": "e9125aea-bc41-4422-abe5-69622b3fcd36", "comment": "Malware payload (Formbook)", "value": "8c0ea02a91c27efe4f3516e73fd4f4c4953f6ced", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624160, "uuid": "e44ca4dc-5946-4989-b613-ad1f5d45dec2", "comment": "Malware payload (Formbook)", "value": "561ea7cee5ff37bdb5a4fb09c8db2e9dad9a18cb56b0fedf9dae2e6a22cb30c6a4e560e6bbdfa4fc7d893de7576b11a2", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624160, "uuid": "66ed3417-fe03-44b6-837c-5d8bd19d2917", "value": "T17DB20A6BF79603BC4F9602902A1E1FD9EB29A53D73A19452387C93342385C6643776FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624160, "uuid": "9a081c02-e346-432b-94af-5dc998548cef", "value": "384:JQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZfuaj6BEY35qVvF1+1UO2grSq4:nFx0XaIsnPRIa4fwJMQawsSUO2grziV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624160, "uuid": "e3d32bda-050c-4200-808c-a968db773b5b", "value": 25435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624160, "uuid": "e12e015b-995a-4866-824f-03eaed5747e3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624160, "uuid": "7c543504-2a5a-4ee5-9b5c-2238c646e103", "value": "20630c0707f4913e69098a048ff472eb.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a309d0-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688648505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648505, "uuid": "c9f85974-6f93-4cb4-b019-34117fc70037", "comment": "Malware payload (Mirai)", "value": "7ac3df863b47518a805a729290cd6b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648505, "uuid": "8a008187-deb8-4ba2-a7f0-8b6295cad84a", "comment": "Malware payload (Mirai)", "value": "3c8b4c6cf548fc0ca3561a69e550c38c8f93294688d6e19e3635e34d27cce297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648505, "uuid": "4efcf793-8454-46e2-91ae-64ca23a8abac", "comment": "Malware payload (Mirai)", "value": "436c6e78fdc27557e0d711b112af9f7230842502", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648505, "uuid": "14ebafef-d7c3-4525-b415-b848e785394a", "comment": "Malware payload (Mirai)", "value": "d0a0636e49b3546aeb7b426ad67253336ce99748ebc4ae4ef651f4b53ed6e999c2fe9cc34f43c3759ff9400da19a894d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648505, "uuid": "3f992947-09fa-4d0a-aa01-01ab564ec0f6", "value": "T1D583834AAF615FBBE8AFEC3749E91B45248D611721A87F79B930D814F20F24F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648505, "uuid": "4adbba83-c08f-405f-aec0-f0256af94efd", "value": "1536:K0XSygcxCwLZ3JPzTTyT+ex/QZIt0uR8:5XSyggs/QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648505, "uuid": "d3b24754-fc95-4906-b5cc-43488400fad7", "value": 84120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648505, "uuid": "93bf6886-3c61-4975-b3de-58205d55bbb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648505, "uuid": "3f83289d-0f40-4243-a1f6-27cf2b48bf13", "value": "7ac3df863b47518a805a729290cd6b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd5319b-1bf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688645356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645356, "uuid": "19cafc3f-6285-44c1-8e2e-4da553ada9d4", "comment": "Malware payload (RedLineStealer)", "value": "196ff99dc0a25beda3859b8b201918c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645356, "uuid": "3df64c64-4076-4c6e-b683-c6e51dcb9c60", "comment": "Malware payload (RedLineStealer)", "value": "3c9571bbf5b56a0591d28ed15f685fc514f7a7a97b7999764498370d3755b82a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645356, "uuid": "fbfe51cb-735c-4be0-91ca-273b2c16670e", "comment": "Malware payload (RedLineStealer)", "value": "7e0ec1876f80438086529cfe6f389894776cf9b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645356, "uuid": "86c357f9-b479-474e-a414-0b45ba64ef69", "comment": "Malware payload (RedLineStealer)", "value": "edd0483e206c36be0210247d2619525192146d2b62048ff529b6af3ef47781b55a456980cc6866a56de942affd74d861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645356, "uuid": "c5fa2fb3-850d-458d-b85b-bc415efdf086", "value": "T15DC633123FC07556E6207FB819B26D9544BAB4936E89E3DB8015F3B63123EB1A4F8F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645356, "uuid": "6a0d1cb7-c03b-4d98-8d88-5b4af1928ffa", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645356, "uuid": "05a526c3-4204-4f77-b408-030648032122", "value": "196608:PhAeLuHYBAI7hlffCagFrMCOz6glx3X1z3U9Lb661ZCYG9+bqiUxdHc33dpb6Ffu:Z9u4hVgcz6gfXZ3U2ACh9+eiqd8Hb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645356, "uuid": "cf956eac-96c1-4683-8ed1-7cd67daceaec", "value": 12058112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645356, "uuid": "9d894762-4174-4240-b8af-b0ca55baf58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645356, "uuid": "518dfe33-f08b-43e0-b9fe-8e61fab68e0f", "value": "196ff99dc0a25beda3859b8b201918c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac6e0ea-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638103, "uuid": "f55c1716-c872-4587-83cb-71f9d8b5f75a", "comment": "Malware payload (RedLineStealer)", "value": "c672062fd199752b31befc6807125977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638103, "uuid": "11fd6c20-14f3-434f-89d8-292ac218af60", "comment": "Malware payload (RedLineStealer)", "value": "3cc507257a118d0b86143bb135abbb5454ee2bd185654c1feaa6aeaf31cf3735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638103, "uuid": "1694ec14-1b2a-4d5c-a05e-cd32621a8bd2", "comment": "Malware payload (RedLineStealer)", "value": "eaa851570b22bf8801da7fb6aafb9bfcad8dcef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638103, "uuid": "f8f8909a-5f45-4825-873a-b97a71e75022", "comment": "Malware payload (RedLineStealer)", "value": "bc53736395a12510bb2ab1aa5c438cf68742a865c49db6b60f10fe3f935ca24075f853386cb4abf0bbae852d586a015b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638103, "uuid": "a199b8a7-64a8-4122-bb85-357f89598ab9", "value": "T14355BD05A09D1D5CC672E7B2BADC23523DBC8474291DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638103, "uuid": "4946a986-b5de-4f7d-9e56-ebdb9fe50a88", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638103, "uuid": "debe080d-14ea-46b5-b850-45edcb8b00c1", "value": "24576:5Li2dGfYU5xpaCozrddBehxOFEYjIj2l9VuH:5Ug1CujB6AEYHPVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638103, "uuid": "87aa9274-772a-470c-854e-e8fd454b2054", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638103, "uuid": "b3567b53-967e-43ed-8a43-5b8e6a822b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638103, "uuid": "30efef7c-b4f2-4d9b-a560-40785e165652", "value": "c672062fd199752b31befc6807125977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbc36ed-1bb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688617247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617247, "uuid": "334d211b-f634-4859-b932-e0bd53a7d845", "comment": "Malware payload (AgentTesla)", "value": "59926b69f6b1dce035ba256215430c52", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617247, "uuid": "f1c056b3-3bbc-4c1a-9e21-ba52b373e6dd", "comment": "Malware payload (AgentTesla)", "value": "3ce57b497e528ac34a6921d7b91a4fe2211f066a751836206706f8c792ebb367", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617247, "uuid": "5a316850-74e8-40b6-aee7-dfcd18fb0ea0", "comment": "Malware payload (AgentTesla)", "value": "470bf50ea96ad1aec5d44ba3c019825729e9e784", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617247, "uuid": "35f52df5-6b58-4ce3-884d-ccb2888afbf5", "comment": "Malware payload (AgentTesla)", "value": "f000562d2cb85a03a6663216c95284c421522e6340181a3f934b43edfd88ee2accceb10ad7f647b1532ea27593083044", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617247, "uuid": "02552a49-6b42-415c-b366-4ea5781ec5aa", "value": "T1E0D29266E79B02748F8502B1271F0AC9A76DB13EB3609571386C933433E9C7A46766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617247, "uuid": "b39e2dae-975c-4a99-86e7-3d8b2f27582f", "value": "768:mFx0XaIsnPRIa4fwJM7+m4xVnPrOxhJLL8s5kP2r4xr4TBk:mf0Xvx3EM7+mKKxhJ/GP2rY4Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688617247, "uuid": "7bac83f2-20b5-44d2-9956-9b961ffda0a0", "value": 31013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688617247, "uuid": "deb9256b-44a0-4825-85e2-de469046c09b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617247, "uuid": "63287091-4ee8-4032-82e9-44de2a52c5e6", "value": "59926b69f6b1dce035ba256215430c52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8236d51d-1bfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688647753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647753, "uuid": "cfc353a2-1c5e-458f-a50e-0e80a008f8b8", "comment": "Malware payload (RedLineStealer)", "value": "62782b88838fdb16b08d888fbdfec38b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647753, "uuid": "7aacecf8-15be-47be-953d-787286e10c01", "comment": "Malware payload (RedLineStealer)", "value": "3d9ff047118451feee7311190c00d05d95209c6b1e707ce18abe065017b845b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647753, "uuid": "72d49538-970c-43e0-b063-604cdaa31126", "comment": "Malware payload (RedLineStealer)", "value": "19f42109504b988b7b54ea250fbd15a7cdf8e396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647753, "uuid": "3b6bb4ba-09e7-4973-90ea-f33ecfe17d91", "comment": "Malware payload (RedLineStealer)", "value": "6afcc430c0afbaed608ff69cb4f0018bd5b80f0af4dbb1e64bd76c621dfa79981e48df221b4e5a7544de81a515f0b863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647753, "uuid": "a8646eae-27ac-4242-9b50-016d37c63c49", "value": "T1CA160118605E4EAFD87036B527DC1953F9ACA479671F0E4222C2EDEFC99CC81F69099C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647753, "uuid": "4aed1442-f0cf-43b4-8dd4-6584976e9e9c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647753, "uuid": "8f3abba1-e481-4950-ae6d-52436cb4edf6", "value": "49152:YxkwD+qt7f9jZ07w2xayyBAoQc1mPBJ9d2VPhd56QapRCxPOFvcjnvsH7uyyU6tI:ipo7KcBJQPFaixg0R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647753, "uuid": "ebfc3376-178c-4bb7-8634-e8fa45d5bd38", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647753, "uuid": "c3fd9aca-a010-4579-8050-c8d3e5306809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647753, "uuid": "3fca310f-127d-4d44-8ba7-eb1918966ace", "value": "62782b88838fdb16b08d888fbdfec38b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22718822-1bf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688645015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645015, "uuid": "7a362f76-427e-4ce4-a386-f6523cf0e6ee", "comment": "Malware payload (Loki)", "value": "258fe71314faf1bde6f44798936f9f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645015, "uuid": "f02eceb5-189f-49d1-a0f0-93c855f2d4db", "comment": "Malware payload (Loki)", "value": "3ddae440455ee0723b4035fd75927db44a82f22056c2657fadc125bff94172ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645015, "uuid": "553ccc40-316e-4e84-bfa8-a94452775861", "comment": "Malware payload (Loki)", "value": "be7b89bb02cdb429ca884fbb4dbe8ac140cdcdb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645015, "uuid": "9acdea30-fb17-4f2b-a70c-5e6486368037", "comment": "Malware payload (Loki)", "value": "9df1f3c500b950ad6e076078e4234bb91f0c2e42f133fe8b26f62c96002bd9acd09a69aec08921060967f9c55ad78998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645015, "uuid": "d42dcd2e-c55f-42e9-89db-fbd601c8e995", "value": "T1EFE401A96AB3892FCC863FBD0C212BB9D1FC5A857077D6674F63FD9C9C009484C816A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645015, "uuid": "6211e3ba-cc92-4317-8b22-62f608b7fb42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645015, "uuid": "209d9db8-2c73-4e32-89ea-60c1b87ecb02", "value": "12288:CzPWR28Le0cY+Yg9fb96A/uDpqcFt9qTJryqS3KFsB5dGp1nG4:CT+xL9Rk9EchcFt9qVzKB58p1G4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645015, "uuid": "a091e602-376d-4f15-80a5-096fe6d06bf9", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645015, "uuid": "d5cfe7c3-cbb2-4d40-8ad1-f3e397ec5385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645015, "uuid": "76ec6514-fe53-4a7c-ba71-32d899f03249", "value": "3ddae440455ee0723b4035fd75927db44a82f22056c2657fadc125bff94172ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205e2a88-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688623107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623107, "uuid": "dcad915b-0663-47bd-8fbb-7cc2273d65f3", "comment": "Malware payload (Mirai)", "value": "fd0fcf6f8034bf97819780f3181b34f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623107, "uuid": "b8d308ae-09e2-461e-a521-2aefe9bcadca", "comment": "Malware payload (Mirai)", "value": "3e0f428f4fcf32d545b69647619d1b3fb3e8074258054e05996bb63719f3554f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623107, "uuid": "06af40ba-8b48-4981-ac7f-c99e1896da62", "comment": "Malware payload (Mirai)", "value": "61d4e3c50f301998608a225c4aebf47206592527", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623107, "uuid": "ad69c61f-eefd-41b4-9eb5-bd3d2216fef4", "comment": "Malware payload (Mirai)", "value": "ce93d2ebf9607a99362a5005877e13e147282ef0d6fd2f32e5323b334fab1fb7cc8c1a7e14a9fe63fb389e4d0aef93f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623107, "uuid": "039ba75d-f557-44ed-9de1-931233cae4e8", "value": "T147E35C46EB818A13C0D61776B6DF42493323A764D3DB73069918AFF43F867AE0E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623107, "uuid": "bd1fcead-4a6e-4057-a185-3e26f166618c", "value": "3072:AzrqSOrzx4JDAaGhYE2eekNJztUPa0XWjb6M/9WYX:AzDOvx4FAaGhYE2eecJSpXWjmM/9WYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623107, "uuid": "d5692266-fe40-489a-93b1-05796ebe2f23", "value": 155093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623107, "uuid": "c4d048fb-5239-458d-9589-bb5cba4723bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623107, "uuid": "e18d9dac-feff-4571-8f26-de4ba8a09a52", "value": "arm7-20230706-0558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a36a8c-1bae-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688614826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614826, "uuid": "73dc5988-713a-40d2-84c8-8b91e11a8283", "comment": "Malware payload (Formbook)", "value": "9f8eff882779e811a29af193653c956a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614826, "uuid": "ab6e2474-11f4-42c1-b07c-bf116a29fbbc", "comment": "Malware payload (Formbook)", "value": "3e3d28e29973c0ac3c9b69d509a8b862ecdd19d9e0599b4c6a63a39efc0dd130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614826, "uuid": "276adfd3-457c-4e7b-950f-f5e8c3ddeb6b", "comment": "Malware payload (Formbook)", "value": "f4eb890ef9ee8ce34d22c67eaf1dc42a24dcb93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614826, "uuid": "efd8f833-744b-47f8-9a02-3e1b1ea29c8f", "comment": "Malware payload (Formbook)", "value": "bf16c30ad8c3e1aa2d16057b24ed7404e91df4b1734d122dd8643ba0f1fd3626d6059936773436ec69c18ea7965defbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614826, "uuid": "e30985da-48d5-4ad0-ab23-014a6646711e", "value": "T1B074239DA5F498F3F9E70B706F6D0B852BA85112A4D85B8A13900D3FF2051827ECF766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614826, "uuid": "04f349bf-c4fc-4196-9e2c-838eeb4b75e4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614826, "uuid": "d7bc44f4-a71e-4ac5-9344-f41a9281b732", "value": "6144:PYa6NMWXNpWaDdzf7XGXjMR/HzBUIG6rireYXVAn8J2HdCkfc/uZrf6m0:PY3MiuaBzf7XGXjMttUIG6W7k8Dk0WRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688614826, "uuid": "a69f45ca-480b-43c9-99f6-a3c5c3d8cfa1", "value": 370309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688614826, "uuid": "0a080b63-8ecf-4a44-87f9-6f6f5a62a135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614826, "uuid": "9fdd2e04-d478-49ff-a655-49bca2778f2f", "value": "SecuriteInfo.com.Variant.Babar.205838.28399.13702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88fe87d-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688644515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644515, "uuid": "77af5cab-bc89-487b-9a0b-1d43b9731b23", "comment": "Malware payload (AgentTesla)", "value": "e79bd41fdbcafa89d5a88baa6fb022ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644515, "uuid": "02a056c1-4064-434b-85e9-27eb3b6f2be8", "comment": "Malware payload (AgentTesla)", "value": "3e4ece1631713f959b5949c5f639c18777ccdbf2728b0083e57be6908636c9fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644515, "uuid": "5c1f1c5c-f037-4e57-a4fb-0d99eff0a55b", "comment": "Malware payload (AgentTesla)", "value": "3bb26129c21650a05b23822c65364744189acdc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644515, "uuid": "43b38691-9140-4d43-ad80-5a81349aa6d7", "comment": "Malware payload (AgentTesla)", "value": "f5949be7d3be4a76196e92cf7473fdb9b4e259b503207074da3daa8996f3c0ed77592bc3d0857686337b8f5246193eaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644515, "uuid": "d3bcd563-2e6e-4f74-9e71-4d01865ae559", "value": "T1B4F412BE17BB886FC85B3FBC5C612AB6E5E859453067C9475FA3FC98AC44A084C811D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644515, "uuid": "c16ca03e-d30b-46a2-9767-14865fbd16c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644515, "uuid": "944ace2a-e5bc-4a66-a824-aa6d3761724e", "value": "12288:KJPWR28Le0cY+Yg9fb9zUS8c6tQm9WShyeYyDhmLdeUhC2mOvT6:Kt+xL9Rk9pUDWSseYAhmLdxw2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644515, "uuid": "2d45becc-610d-4c55-a3e6-52bbe55adbca", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644515, "uuid": "4fbe293b-e8b3-413b-8bb9-6411d32f9e25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644515, "uuid": "f5fcff1c-8594-41f2-ab3d-6ddfcc756b63", "value": "3e4ece1631713f959b5949c5f639c18777ccdbf2728b0083e57be6908636c9fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88402eb-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688637187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637187, "uuid": "8d7378ca-e909-4ab7-943a-9e398685f348", "comment": "Malware payload", "value": "3ef854350c0b5134cd6f069f8e75f13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637187, "uuid": "8ffdad91-eff8-4cd1-8a4e-667b2a39a1a6", "comment": "Malware payload", "value": "3f121e2351400e101ff9a3c3fc7ade62a6e3658256124bf2409a7fba4c3c60fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637187, "uuid": "7918700d-e3ec-4b09-80bd-0ad5fc8d4084", "comment": "Malware payload", "value": "05ca72477112c3555419fc8f51839f676be15942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637187, "uuid": "621324d9-7e8c-4ed3-a16e-4171bb27ac57", "comment": "Malware payload", "value": "9a5297c819f5d48fa03d73511fb3fb150ab0b68231a7925ab33ff96c9854b50f2e5a76aa035e083149f952bce55f40a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637187, "uuid": "970d7492-1251-4296-a3d5-aba181d8758b", "value": "T1E944094173FC866EE3FF4E37B43021554777BAB7B53AC28E09A054AE2A927468D10B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637187, "uuid": "405a0449-74a3-49f0-81cd-29c615dbb23b", "value": "3072:g2/ael8E+MAXFfYtHLAivdxiOo8ghHFbnZAaSmkff6Hi7HEV5B/j0S84MZZYydoG:g2/aSAXFwAivLinxFSRff06E96rp/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637187, "uuid": "29287a42-7cb6-4b0e-85d6-b86435509459", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637187, "uuid": "25be2bd5-7abc-4643-a525-0c7f91108b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637187, "uuid": "341b20b5-5dac-46e2-b1ff-79c9cda00b6b", "value": "3f121e2351400e101ff9a3c3fc7ade62a6e3658256124bf2409a7fba4c3c60fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1da7b9-1c00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649814, "uuid": "d64a513c-cb0d-4c59-8b12-f5107e49f886", "comment": "Malware payload (AgentTesla)", "value": "acfc91916c54407294dccbd2d0fd76f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649814, "uuid": "3d95f72c-e582-44b6-988c-3477ef099623", "comment": "Malware payload (AgentTesla)", "value": "3f97346e23af7179f95f09cdbc5c1835f70d2a4970eaa71f0dee6caa8dfda64b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649814, "uuid": "f908f86f-0733-4646-9802-e279a2a3ec9a", "comment": "Malware payload (AgentTesla)", "value": "4d85ca386659384cf4cf028fe7d1a85d386b5bb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649814, "uuid": "5754ab96-8fa6-427d-80fa-7a12c4636807", "comment": "Malware payload (AgentTesla)", "value": "7e4736484d66fc56d3482f566b1a932b468e88b6128778f2d41294d1bed353bdf7dd94a9f3a9010f141e2b50479ef141", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649814, "uuid": "259c9657-97ee-48d2-841c-aca341eb6983", "value": "T10A0512091BFB421ECC1A3FBD0D600171D3EE9666753BD7079F6BA898AF23B154690683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649814, "uuid": "b40bbf7c-6b1d-49be-a3f0-9c7ff118a7f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649814, "uuid": "87460d5a-bf40-4c8e-a0d1-a04fee6e1422", "value": "24576:90biRoSErVxIE5Sy7hYrCr+33D3XqvGiNfz:9y4oRrjIwSy7h0b33D3X8lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649814, "uuid": "f442c192-7862-4d59-add1-9e6f70b82e85", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649814, "uuid": "fa9db0e1-a38a-4811-81b2-d97fd1fe446d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649814, "uuid": "1870e736-adbf-4ca3-8de9-d6887c9ba982", "value": "3f97346e23af7179f95f09cdbc5c1835f70d2a4970eaa71f0dee6caa8dfda64b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167e1c75-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624379, "uuid": "cac91345-2a5c-4648-be70-e7e871c76202", "comment": "Malware payload (RedLineStealer)", "value": "9483f18929f51459db3813d1ca5192e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624379, "uuid": "2c65028b-1d0a-4032-ac46-512f09ead824", "comment": "Malware payload (RedLineStealer)", "value": "3fb69b36dd353bd25aa1d2d76617d4bbc9db1db574777f248997d07dc53bfbdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624379, "uuid": "3ac011c6-b250-48c6-8a6c-e2c8f06be788", "comment": "Malware payload (RedLineStealer)", "value": "9d88a3c739235873ba2732f871c842410ca9583f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624379, "uuid": "5ed6ba5a-4987-493c-8e99-f61aeca94fc5", "comment": "Malware payload (RedLineStealer)", "value": "e7ab7098209d52159cf8cf127fb0abd5d8118f5d76e7fbb9c1b50eba233a3c092da323635c9eb79e6d2a0f239e838784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624379, "uuid": "8d760839-57d2-4399-8853-a0af90c7d193", "value": "T13A060101644C9E6FE43A367533DC4427F92D9470EB091D8522E62CEFC99DE83FAA658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624379, "uuid": "1bc9abbf-c22a-46b5-bd57-f0e6c49d66fb", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624379, "uuid": "569345bb-cd18-427a-854d-ec4ef4fb081f", "value": "49152:CfDI0fuc0mzKqVmjotaWh2rEFoCAVtfVaC/gXAdW2VMPsFBWGRnDHRQKhk+edqQa:iMNVZValA0I15GLnxty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624379, "uuid": "c424162e-a303-4cb9-88b1-9e7f35aa0f5a", "value": 3777864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624379, "uuid": "75cbe6ca-0377-49ec-bc52-8a1001be9856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624379, "uuid": "d2f921ee-737c-452d-846a-09a52069fdea", "value": "3fb69b36dd353bd25aa1d2d76617d4bbc9db1db574777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6450c86c-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622362, "uuid": "5fb60669-58c0-49a7-88bc-075670a1913b", "comment": "Malware payload (RedLineStealer)", "value": "26be28e2a2ff907bd30ef59d1dd8735c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622362, "uuid": "7fa5f909-dba3-4632-be9e-f34935c3c6fd", "comment": "Malware payload (RedLineStealer)", "value": "3ff71fbe29d48bf76529964ce15da87d60a2d4a4245f70fcb4c1e23d274547f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622362, "uuid": "f48a4b78-cc98-4644-91f6-5d16e4014737", "comment": "Malware payload (RedLineStealer)", "value": "88a479114c436eef8cd180b65f449b93d33e2ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622362, "uuid": "c28fce35-3b47-4b96-80e2-6ede8c0b5387", "comment": "Malware payload (RedLineStealer)", "value": "13b3edf02198f01bcc10f84b4f88c47386f653ac6abc1d49f6546ef5cce56443a7160b4c1d7eab40ff1e3726931892e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622362, "uuid": "04ab3053-6813-4061-817b-53cd6652559e", "value": "T19E160119216E9EAFC471347227DC0593FAAC54B4671F0E1122C2EDEFD8ADC81F6918AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622362, "uuid": "cc5ba446-2e42-4478-b026-b02eed66fa8e", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622362, "uuid": "98156094-67d5-43c0-acc7-2802c2a73ebc", "value": "49152:Pz1wDkuz0e5aU0hliKQ4KDoduzLJt7348hfSgrq5XdYCh2lkCqmlVZqu1oHO4zvr:+Aiz7JZd+5XdAlg81R2px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622362, "uuid": "87915658-9a0a-49f4-8530-03064ddd7a4e", "value": 4067144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622362, "uuid": "eefdc4c0-0ebf-44d1-8437-61c1db9c3b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622362, "uuid": "f8e86e2e-31e9-4167-8446-854f8b09fa46", "value": "26be28e2a2ff907bd30ef59d1dd8735c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9ce410-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1688647339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647339, "uuid": "577779f8-8d28-483e-a74f-eaf355b73c44", "comment": "Malware payload (ModiLoader)", "value": "b0abfe7db3bed0187aa6f9da8694c2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647339, "uuid": "4e9c599c-e835-4b51-a89a-ecbaf973a8ff", "comment": "Malware payload (ModiLoader)", "value": "4053220e58d30e514ab543a64e3854e7c411bfa084c000172cdfe6d3e8f65875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647339, "uuid": "0cbda51d-c00a-41b0-bd9b-885d8dd27b19", "comment": "Malware payload (ModiLoader)", "value": "9989011f9905c7f10eb5860e408aab7bc9f66dd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647339, "uuid": "e57daa41-aab6-482a-bf6b-893ecaf6ca47", "comment": "Malware payload (ModiLoader)", "value": "7e82ff3e1f6252f6de52d3a14200625ab271b235b8248acb9ad0038462263c9a5e878cbfc9704d204a7c8016a7093329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647339, "uuid": "7243cad8-714c-4173-80fb-eeb23314c6bb", "value": "T145F4AFD16EA09673D1336A389C17D3988829BE30296C585A27FDDD5C9F39FC1381E287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647339, "uuid": "a46ab778-33af-47ec-ab1f-7e78d659d301", "value": "773ef4dec25043142e4c0b01d6341cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647339, "uuid": "74260f04-8525-4f43-833c-73fbd6fe84b5", "value": "12288:3GR+Vd0ckynvLwdJgNsycuL573BhZWPNFWrsEL09pmHtJNNW/8kGPQ:3GAVk4Mwom77WGrs9StJNSGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647339, "uuid": "0fc45703-56ee-4b23-80f1-a914cf3016c5", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647339, "uuid": "71d7e89c-6fbd-4d9c-95d6-8c07be7cec43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647339, "uuid": "fa033c9a-ccb2-4912-9ca4-a3d30885dbab", "value": "Ltyjuzrvkvmijn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02025ec-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624180, "uuid": "753a8ad9-adf2-48f5-b55f-5803de97b66d", "comment": "Malware payload (RedLineStealer)", "value": "bf4e4b9d7f76f04fba9323a3a76fe28a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624180, "uuid": "5bd7935a-de5a-4100-b370-fa626488d254", "comment": "Malware payload (RedLineStealer)", "value": "40ec4a54a2c3ed0f5fe9c9bc8997a46555eb302c642abe9e9941f591feacc869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624180, "uuid": "790b3a7e-a8b9-4e1b-97c6-2237bc1bba9e", "comment": "Malware payload (RedLineStealer)", "value": "d293ba891f250ac114373603e17145f8b209c698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624180, "uuid": "aa368332-02a7-4311-97f3-e5830db73eba", "comment": "Malware payload (RedLineStealer)", "value": "e6aaea3e08b80d904942ec470caba6c63f9944c1c650cfbf28b0b2f538e7d61257b4d4ff0c450fc776647627173cceed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624180, "uuid": "bc9d7cd6-787c-4f41-b8cc-3872edde5d93", "value": "T13C560152281C2C4FA07678201FCD145379A957796B274D8231D2EEEFEBADD80F685B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624180, "uuid": "164a355e-a134-494a-bb16-8c7812484a26", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624180, "uuid": "b32d229c-f140-4b5f-a34f-47ef2e11b98a", "value": "49152:9CogVxDteNYl3/1gDxmi7ucSYCZsWZBtJ1EAaMOHEXd6KYROV446LxmUyEdBa+B+:9CpVxsYl39yCOWZBWgZ5893T/KvR6Sz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624180, "uuid": "59ca98c3-36c4-4412-8ba6-93626eefad1a", "value": 6049608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624180, "uuid": "afec988f-8c40-4cef-af31-f3754e2e25e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624180, "uuid": "e1fa2012-380a-4ca9-a678-e757cfc4f26e", "value": "bf4e4b9d7f76f04fba9323a3a76fe28a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a01ece-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677051, "uuid": "c97d3e9b-f235-4f4a-a284-af13132c0bcd", "comment": "Malware payload (Mirai)", "value": "df663a27618b0f828fe459256e9942c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677051, "uuid": "c589b6c1-80cd-4fe6-a67c-016f547f82e3", "comment": "Malware payload (Mirai)", "value": "40f8829f9b6236f48e11f45e26416974f28ca4ba7b401243ace24c743dcbd3be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677051, "uuid": "6ef923b2-61d8-4949-9678-89efb0d9008a", "comment": "Malware payload (Mirai)", "value": "35750d9f80cdb731049e5723e3f12dc32325a87e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677051, "uuid": "588543fa-9971-4fc3-a670-2d0b1e5cf9b4", "comment": "Malware payload (Mirai)", "value": "8385a2ce19e0514f460e1f597ad87923de3ce3a359d186fa0f82a30f7b64d4bc88f26e9b644d20018f41fa9ca290aa67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677051, "uuid": "d7128887-59b6-4212-a87a-5ead7f37117b", "value": "T136D2E151F7AF81E6C99BF97BFE5F007720159D2C3A06A24C6182C14EB6671DC2A374C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677051, "uuid": "9133e85e-161b-4998-8358-2d82ca27e566", "value": "768:l6f+EtgVlhkN1tApk8uYbCUppHvHs2hVfNk/EM1p:lQtgXhkNLYk0CyPJh7k/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677051, "uuid": "f06d53cd-97a7-4bdb-97a9-b948fcbaa357", "value": 29780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677051, "uuid": "99146bc2-60aa-4f36-bb3d-23803f04357a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677051, "uuid": "c525f5fc-36ad-4181-8336-c7289fe5a17a", "value": "df663a27618b0f828fe459256e9942c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf342109-1c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663746, "uuid": "344f3d2b-f4ba-4ac3-869c-f4499de4c3b5", "comment": "Malware payload", "value": "04af92ffdf13bc3b98ac14a5c6f752fc", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663746, "uuid": "b66a8bd6-a6cc-4465-9148-680cd998ac72", "comment": "Malware payload", "value": "416ffbf541ec396c711f1553576931c65af849b67158250030f5b94827b3da83", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663746, "uuid": "944b689a-d812-466a-a5fb-5c835b32c429", "comment": "Malware payload", "value": "24a7dc1c59636ebdb588cdb02d9cb3edb599e395", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663746, "uuid": "3eb81149-7aff-46a5-be0f-8abea754e431", "comment": "Malware payload", "value": "0fccb4251620e6bdc6b4dd59e0e2919d68e6ee926ebc1104b3f6633ae3511e5d4d97cf7888fb0f9ddf7abfe182b02705", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663746, "uuid": "18062378-240f-499f-87b5-2cfa7bb91d85", "value": "T158C4AE5173068E53C2BA0AF580F1D27507627E5A519AE30B08E96CF7BBB83D76D5E083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663746, "uuid": "429de679-cb57-4763-b142-5c2d3d91d754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663746, "uuid": "705b5ffd-3b37-4ba3-b10a-e286ed017329", "value": "6144:qOIBBrOiOkLJeHIIBRHr+PG0ZZ39MUl63bgxlsKrgq/e9bCmflY:qOe9OiO2I7SPGEtMf387HgHOmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663746, "uuid": "ce1758f4-bb45-4562-b5b1-6d2f66aa0b1a", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663746, "uuid": "07c4a289-5d5b-45c8-b02b-436ab9ecc3bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663746, "uuid": "6277dc6d-d9f6-4285-9138-a3921b3734fa", "value": "Evolion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f31eea-1c30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688670599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688670599, "uuid": "9c6f45d9-96b3-4592-bac6-b1fe8d452f80", "comment": "Malware payload (Loki)", "value": "02702bec6d76bf792b0ce39f6fab58e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688670599, "uuid": "c5e5aa8c-055b-4c08-a393-8c8644d957e1", "comment": "Malware payload (Loki)", "value": "419cca9bccd0fa8919d3e2edcd18df08fbb066b6a3b21302e471d31c04cc0d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688670599, "uuid": "c211ea7f-22c3-4176-9818-61b16316e499", "comment": "Malware payload (Loki)", "value": "8fb0abef62d7d9ae8bc78b26a6f7070d4952e1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688670599, "uuid": "ea6fe17f-b56c-410c-b701-9f3f15a8b720", "comment": "Malware payload (Loki)", "value": "39349ece4ba8ca29e98d205f6ac231c27e00e7cf5950ea6e8601cd66f34abe688fca1ba43e8745313119dea9b2434e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688670599, "uuid": "47e3b040-1e6a-464f-8eff-838f1bf96149", "value": "T167E41210BAD2C1B7D4B7113884E2CA751A267075276A92E7B7ED1BBB2F113D093362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688670599, "uuid": "d863024f-b837-4c5c-8421-ce73fa1ed3ed", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688670599, "uuid": "c67cd514-2fa5-45bb-ba43-cd99b3dc66be", "value": "12288:Oh1Lk70TnvjczcV0qoiCajgHXpES26ox0XDk7N7KTsuiexQK5VF1kgH:Ck70TrczcV0qk4iXpeRYg7x3ugK5VXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688670599, "uuid": "6696df49-ec55-4bfc-aba8-2d0f164307a5", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688670599, "uuid": "9c2bd11d-ec5a-4d7b-bd62-dcf7be16c292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688670599, "uuid": "61fc7a0e-c02d-4ad1-9d72-340c84c8623a", "value": "looorlki.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4901ef8-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628188, "uuid": "fb32686a-a096-4212-a6e9-f9ca11391510", "comment": "Malware payload (RedLineStealer)", "value": "dcf53447d444136fd191921823a69523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628188, "uuid": "e3ce4a5e-d430-4ce3-a725-ede5561b3c8e", "comment": "Malware payload (RedLineStealer)", "value": "41d89ba271a9a5ce9c1b984c284d55416aae1c42743087cbf6c12864f6f7dc15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628188, "uuid": "a4b00f21-3082-4777-b0ab-a0415f9a669e", "comment": "Malware payload (RedLineStealer)", "value": "6c1b6e2eb8e6a31e02d828835a0694d252b81c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628188, "uuid": "a4607852-4276-47d1-8bd8-40b7b407526e", "comment": "Malware payload (RedLineStealer)", "value": "1d56dc47ec2034778e56ba0593aad731a2a33f9afadc3cbec21f31afd93fe04adaf878934846665740f9aef7b4019670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628188, "uuid": "dde080fe-971a-461f-aac6-64a7c1333055", "value": "T19155AD05A09D1D5CC572E3B2BADC23523DBC85742A1DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628188, "uuid": "eb550b1e-8777-4520-9c7a-df30caa8dc88", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628188, "uuid": "1b1d9097-0f04-4627-a022-7fd1f99d2786", "value": "24576:g9JccaNqPsIClzVJCFcMALT3GxXclLL9XWCycUa:gHGqxClmcMA/GxXcd9WlcUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628188, "uuid": "897969da-7c4c-4bb9-b97d-46409b3360af", "value": 1344331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628188, "uuid": "4cad0d6c-b735-4a16-b0ac-756ece4d7f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628188, "uuid": "27f6281f-6d2c-4654-9e57-969ce37232e3", "value": "dcf53447d444136fd191921823a69523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e12ce64-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624177, "uuid": "3f0f5272-25f5-49cd-88e1-614b16005d53", "comment": "Malware payload (RedLineStealer)", "value": "ca1f98024db6b0a3a80c4f88bad01c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624177, "uuid": "fdb62917-75fc-427b-9541-9d3d48cde410", "comment": "Malware payload (RedLineStealer)", "value": "41ddb82349252b4a4edc0c6caf39873fede575cd5f8141798ffc467bd70ddd26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624177, "uuid": "1066430e-a290-48f9-9d36-d13f9596ea67", "comment": "Malware payload (RedLineStealer)", "value": "1d644df10be340357030b9d9b0f1b25123f1594a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624177, "uuid": "ee649d9a-b597-402e-b801-7f7b24fe41d3", "comment": "Malware payload (RedLineStealer)", "value": "1bb8d30b3e51a2371d08cc0c613b5213a5dfcecfe4beda22dca7c09c807d20dcd43e6ecfc6100f93b2c71f403d985471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624177, "uuid": "82713f77-0a75-479a-b191-0cc3b2dd9389", "value": "T13B560141290D4C5FA17239241FCD555379A957BA0B0B0D8232C2EEEFEBADD84F68672C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624177, "uuid": "98c467c7-fa23-4d94-a024-3a4ac02c9391", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624177, "uuid": "4a5bb604-5f3b-4ed3-a8b4-9369d61ffe8c", "value": "49152:AHhDHI0eVdjTBjkWkCBgqm93GejCj5mZGK4yfsIdFIedEvSRqOiwbV5JZUS5G0UA:AHhDoRZoW8qqHtWd9GnjADBWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624177, "uuid": "9f20e54f-db4a-4071-98b6-b007a267819b", "value": 6017864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624177, "uuid": "e4b21690-0f13-4c18-a428-401b0a6e44fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624177, "uuid": "f7e1840a-87da-43fd-bada-2fd2364beb65", "value": "ca1f98024db6b0a3a80c4f88bad01c1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b55fced-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622750, "uuid": "e3f7b3e7-c1b4-4308-94bd-e644a1622306", "comment": "Malware payload (Amadey)", "value": "4aff2e9cfc5c885b03c99d78562c33c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622750, "uuid": "d4abc0dc-728a-491b-b9f7-6ec21bd896c8", "comment": "Malware payload (Amadey)", "value": "427b4f453d28bd9f8868081178f1559ac83117e222694a7e101b5995a9e1131f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622750, "uuid": "061124b4-d266-4fa2-9be6-deadc89e3bb0", "comment": "Malware payload (Amadey)", "value": "26b0d48956ae6abb262e44842c985303a5345f00", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622750, "uuid": "e0a3b389-2579-41ef-bb9d-d6bc391e0b38", "comment": "Malware payload (Amadey)", "value": "293370843e75fa5863390e2cc03842ad5999853c21a9f9ba068d28d30d243d514a44888e6f59f5bb5195858c1aae4e19", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622750, "uuid": "6cc086e4-8516-4f6f-adf9-c1b7406ba681", "value": "T15C560112290C4D9F91B634251FCD54636AAD57791B031D9232C2EEEFEBACD80FA41B6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622750, "uuid": "1e46760c-64bc-4042-bfde-079709354d22", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622750, "uuid": "7b35195a-447b-425f-98c3-3ef8547293be", "value": "98304:hDdJLy3g2vEFHBEEwTptyJK5/XaPb3Qfz1:hDdJLL2vE9Wrpz5/0b3QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622750, "uuid": "7f59b0c3-18f3-417a-92cf-c42462d9c600", "value": 6003016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622750, "uuid": "1204f2aa-3c6e-4be3-9e15-7a0c77c4575f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622750, "uuid": "4e68bdbc-49d5-4325-8116-b1dbcee71d0e", "value": "4aff2e9cfc5c885b03c99d78562c33c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb165d9d-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688628172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628172, "uuid": "1249d909-398b-422f-9855-1f9f3be2773f", "comment": "Malware payload (Amadey)", "value": "05dff05087aeeb24a43e3ea8296d7340", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628172, "uuid": "cbcb36f9-384e-4a2d-9b7f-caa05c291117", "comment": "Malware payload (Amadey)", "value": "42e30b236a798a936fc89199f7a31ecf1527355bad6e249919f59581673620b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628172, "uuid": "01e5daa4-22dd-4f35-91b2-dfef34c89f2a", "comment": "Malware payload (Amadey)", "value": "f2e988650ec78311d5894f1912effd18e00356a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628172, "uuid": "35fb0149-abe2-4792-8431-bc1c9679d8d2", "comment": "Malware payload (Amadey)", "value": "59d80b5e4ed5018e8ca47899d8fe68bd1434233015d502a38848d2dcb7443c8fec6b20dd7bcde7086ebe9ee854415c71", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628172, "uuid": "c3125938-3d28-4e4d-8b4f-f38f206ce5ee", "value": "T12816011A541D8D9FC57138722BDC1593F9AC68712B1F4E4162C2EDEFD9ACE80F291A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628172, "uuid": "4d9a590a-27f9-4ef3-af0a-617f9c6a972b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628172, "uuid": "dd6c4b1f-a3ca-4e45-88a1-34a3db28b6fe", "value": "49152:9WLRY+pWokz8rX+4s8wIVINdCsgMm3V59Q82NppF13NN+AmJ0QI7t8igIPbHG12a:GXhsF43VmFvMAgmkIPbHQTbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628172, "uuid": "a740efbf-70c9-4767-8e53-0be030305c36", "value": 4081992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628172, "uuid": "d6a97025-94d3-4cc3-be0c-4d23b6eaaa17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628172, "uuid": "1d785d3e-44a4-4c1d-a936-69111314aac6", "value": "05dff05087aeeb24a43e3ea8296d7340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352ea6f2-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610257, "uuid": "6861b5ef-10c1-4501-998d-0961e7347e19", "comment": "Malware payload (Gafgyt)", "value": "a03439fb8c21a6ef46d4fa05432e30b3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610257, "uuid": "8d7fd1b6-cd79-4aff-9815-d1ee07b059da", "comment": "Malware payload (Gafgyt)", "value": "433a659fe4354c4e4a6a6d4edbb86841e289dd2b89934ad23ebd14a94736d11e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610257, "uuid": "347365a8-95f0-422a-b967-c8b0fe871e09", "comment": "Malware payload (Gafgyt)", "value": "d766bb40db5ac88b747d52a76a92a72669050752", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610257, "uuid": "0f7bcefe-320f-42e7-bdf5-0be44d77a781", "comment": "Malware payload (Gafgyt)", "value": "3e4f6ee6e51c2f9c7686a2818e7d4746aaf8f26b6d45f3022fb93a53922a6e964fc26f0a99fc4193e3fd2cabc4d84e8e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610257, "uuid": "d0970db3-e086-4c33-a7ca-b748f31df67a", "value": "T194E23B4EFD419F05D4E0627EFE6E524D33331B64E3EA7202AE10AB252B89D5E0F76851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610257, "uuid": "0551459e-b600-4f81-9e12-79de2f4297dc", "value": "768:W1n/814gCoYFStMJpveFz4yie79IWL3dihy+VWkImseS:W1n5gCoYFEkpWp4yie79IWTdih5ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610257, "uuid": "264e79d9-f8af-46b4-b92e-87f3fa686036", "value": 32384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610257, "uuid": "ede1f213-2646-468e-a306-aa63b9d5daaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610257, "uuid": "5af99ea7-1220-407d-8349-251c344d9249", "value": "condi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f127e7f-1bf2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643801, "uuid": "a11bc871-4659-4715-a6f4-4334b21d0365", "comment": "Malware payload (AgentTesla)", "value": "53015f47c7df61a485717458b1522f95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643801, "uuid": "e1e0651f-def2-4533-95b0-3576930afed7", "comment": "Malware payload (AgentTesla)", "value": "4414de6c77116fc0cfe575340768bac4af2829cafb1e0d0934739e9c5ea66c6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643801, "uuid": "57628bda-ea73-4072-88b3-8ef206954c01", "comment": "Malware payload (AgentTesla)", "value": "7570ae2809003c3623bb99abfbe81d1a80369d6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643801, "uuid": "0d939e81-010f-4249-88a7-4e75fd8637f4", "comment": "Malware payload (AgentTesla)", "value": "f50922d251b75ddee76f2cfa7070a3ffb02d201c905e8487854b39cdb33e5fea4fddefc6fdad0994ae35adecc15bf8c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643801, "uuid": "59f7a1fd-4066-4ac4-8eb5-9b7c747ebb94", "value": "T11C05111D06BB821EC9563B7D0C640272C7FA9A91B53BD7075FABB9D8EF537190880683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643801, "uuid": "e4220262-11e4-426b-9914-d3e766ac62f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643801, "uuid": "2c5ca7cb-bdba-4784-a2e3-90c8a6a6bcce", "value": "12288:tNSECB8fTkRVdiRobaFErwRgxIE5sSOsWfZesm+vDArxcK12wuH2nvK2CmU6j/U/:Tp0biRoSErVxIE5VOsWfZeD8rMKqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643801, "uuid": "9f18df8c-9193-4bcf-a313-3c8902404e85", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643801, "uuid": "02bbf517-f82d-42d9-9608-e14b887aac37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643801, "uuid": "93ca680a-18d9-480c-aa37-9de9e0382b7d", "value": "4414de6c77116fc0cfe575340768bac4af2829cafb1e0d0934739e9c5ea66c6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be2985a-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688623959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623959, "uuid": "19581914-d33c-4fd4-9e08-db8d97793638", "comment": "Malware payload (njrat)", "value": "26c3af87a8c5f52b8905d4eb4e17886e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623959, "uuid": "3d5fb738-e30e-431d-8aa5-e541a4dbc5aa", "comment": "Malware payload (njrat)", "value": "4468a1bb02acc91e58002be4b2cfea38bafe4f4d418f8f094b55d3e5c6ccc7da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623959, "uuid": "b89eef51-5160-454c-aed0-d274f3bc555f", "comment": "Malware payload (njrat)", "value": "dc4f16886f1bd23cbc5745a40aacb3d5a157ece3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623959, "uuid": "64ce00b3-2957-4b69-a603-dd48dd7181df", "comment": "Malware payload (njrat)", "value": "b824289840c5e31bc054e125f1e37beb28ee0c6db13cf1038f278814294808a4adefb833d263092602acf757b27230f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623959, "uuid": "f79caf05-9320-49c1-af57-d2abd6bef051", "value": "T1C273A388FB948098CFAF673A08F3CCA32277BCFA1DB1D58D59DCB579272318146A0561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623959, "uuid": "25089206-3cdc-46ce-87ba-50b917de0751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623959, "uuid": "aa6394f5-fb40-4122-a0bc-cd002e6f9b78", "value": "768:ugB+R1NkrppqFiYrM+rMRa8NupjFtxtKHNQ8tPFPH5JPr1:JB+R1CNpqUj+gRJNOZtKXtPFPZJPr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623959, "uuid": "eccfd575-768a-40e0-9139-262393924246", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623959, "uuid": "23255e74-df01-40db-9553-1d88c56fc363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623959, "uuid": "0c7c9d1a-7b34-414c-b1f2-199f41d1fa4f", "value": "4468a1bb02acc91e58002be4b2cfea38bafe4f4d418f8f094b55d3e5c6ccc7da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15ce240-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623431, "uuid": "c48a4c06-285e-4dd1-8d32-67e868ad7b09", "comment": "Malware payload (Amadey)", "value": "917a4ce64f4e53f17722687d4c4969fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623431, "uuid": "09921ecc-a96e-4d44-8fa6-b538586e5577", "comment": "Malware payload (Amadey)", "value": "446cd398df03afc45fdb71a6f67055f24b17b41f172e1ffe2b57832bd0056d8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623431, "uuid": "30fe8e77-c037-40a1-b95c-d9b47639293c", "comment": "Malware payload (Amadey)", "value": "eaa3a25a2528ec53bd6090948348f91b46d293fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623431, "uuid": "036956fb-fa35-499d-8488-664e0a43ad16", "comment": "Malware payload (Amadey)", "value": "69387ac29d4c1daebf5c1d98ba47c1b7f7f0021d216040033bad2161a83a4f29f1c9a9c37743cc1683799b166b8c6f38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623431, "uuid": "abbeb834-69be-4c3c-8b04-a80a22636343", "value": "T1E7060111219C4E6FD4363A7537CC8567F86C6874DB191E8522D22CEFC89DE83FAA618C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623431, "uuid": "5dd0bc4f-0104-4832-b9b2-6a5031866dfa", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623431, "uuid": "763d9d85-460b-4555-ae3d-44e5c691e8c8", "value": "49152:BDI0fuc0izKSVmjotaWh2rEFoCAVtfVadp03TJ0O4ibvbO9q3O0w31zi/BGEfbxV:tMNVZVadsSMKqenzCm13qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623431, "uuid": "f71da74b-00ce-48fb-a401-d07b40f69a25", "value": 3777864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623431, "uuid": "0ffd946b-5096-49c7-a795-b9aefaf902d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623431, "uuid": "bde784f8-0fb6-4ba8-982d-d85b35f69a4b", "value": "917a4ce64f4e53f17722687d4c4969fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc2c431-1bd4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688631183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631183, "uuid": "6d079741-b13d-43ad-a86e-eb3d9e656725", "comment": "Malware payload", "value": "7c5e10ccc13b607de6ad81e1e2db18bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631183, "uuid": "7d0445f6-1073-4332-b7c5-308c06687f5b", "comment": "Malware payload", "value": "4522e296888a6c0181e8bd43750c7ad1c1a0353aab6f82e6f4cea7a45615fa57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631183, "uuid": "c5be0d0e-ee3c-46f2-bb15-85493c308828", "comment": "Malware payload", "value": "d8ce0463d9850890f0a152285aa1aefafb44fbac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631183, "uuid": "852bb567-45e1-49b8-b764-651c34722a92", "comment": "Malware payload", "value": "f3f49058eef0c94c4b834eefeb4d7fc591170a760d451727e4b1e9614f917f1890fff8e96d404ec88d1444865c877468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631183, "uuid": "a6f71252-fd1f-4638-af75-c68d5022e939", "value": "T1CD622C47FA0174B2DB55AEB044AED779D73778128CE28E3BFE60EB8C7536640A811147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631183, "uuid": "3e25238a-a76e-471f-ab62-47380d313df0", "value": "e10321eb8fd69d109c3970dad41955fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631183, "uuid": "7aa9f5c2-9e05-4359-94f1-d2ccdc7b10e9", "value": "192:y1BgBRfg4m42M07FXx6bLTJXQDOaNTYmGx4k3hURh/xf002o5KV3:y19MOXx62DfNVe/hOZMVoMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631183, "uuid": "b8d7de8f-8dfe-4044-973c-3ecf6f4e8d95", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631183, "uuid": "05f52b8d-4104-49df-995b-7d1974379883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631183, "uuid": "6f85afc0-359f-4188-8edf-f05b93534f76", "value": "shell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1779f1-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688652660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652660, "uuid": "4da6048a-4e63-4ef4-aec9-46e9535d952a", "comment": "Malware payload (Formbook)", "value": "2e6b674f0db7d54c31d7da9f1f756e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652660, "uuid": "3a324882-ba8b-4ed8-943c-129b6265ed81", "comment": "Malware payload (Formbook)", "value": "455479a2d31bd901fdff62e67ec93e40f80e5956384e93e5030132d4a490501f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652660, "uuid": "43767570-9643-40ba-b066-efbc0bfbcb7e", "comment": "Malware payload (Formbook)", "value": "57a3e01d0eb034273de30a2d13533dee7e13d166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652660, "uuid": "eb888506-349e-447c-86eb-22edea986aa8", "comment": "Malware payload (Formbook)", "value": "cbfe5649807c9ea118ff26a53c32313f32c87e08ad63984af220753f684644cb39ed6d2b342577b5f4711d373b3c690e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652660, "uuid": "1a2e017f-dee6-4143-9eaa-244fa8bee745", "value": "T1A40502102694CB1BC07F07F689501231877A2366F477D71A4DC275EA2E92BD352AEF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652660, "uuid": "117890bb-5a81-48e7-8076-dfb31d71eb9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652660, "uuid": "fe458fa5-0d06-48ce-93fd-a7b0cdc492e6", "value": "12288:HNb8a2iNx5LbzIu9+r9qNoLhrqwocirMAcEOWnv/aVL4HDo+Jcq30rjJI0RGIs7q:ea1j5LA9A6OJJgAHOgiiDoyQRhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652660, "uuid": "49e994f1-2cb6-4d55-9871-5685fab095cd", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652660, "uuid": "c680ca6f-d112-4d62-9239-1e705350eb46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652660, "uuid": "13b21eb5-d5b1-4a87-a1cb-43075b3f6d95", "value": "455479a2d31bd901fdff62e67ec93e40f80e5956384e93e5030132d4a490501f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fee49ba-1c00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649843, "uuid": "93506263-6201-4b95-90d8-1dde17fc5f56", "comment": "Malware payload (AgentTesla)", "value": "b70d6ab8037292e6a507f1583176bbf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649843, "uuid": "5ae2819f-b7c4-406a-811e-214a7814ca77", "comment": "Malware payload (AgentTesla)", "value": "45c87614da1d77c97f2b3faedf5b8577e305468ff8f7f04088afcc84ccdf67af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649843, "uuid": "08989110-4934-4b98-af07-6425ff638b42", "comment": "Malware payload (AgentTesla)", "value": "f57be6c4dde726d8e599919397b95116f7f0b2a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649843, "uuid": "21f9b20b-7c3b-4d7f-9dbd-1596593f5957", "comment": "Malware payload (AgentTesla)", "value": "374ecc6e196b29be03fe6df7aa077d16ce3a854bf1ee075f0ed09c0524e1961eb402016c915a0f591e0f7b1e2c223b01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649843, "uuid": "88870723-fd2b-40e0-9a56-e0f8262172d4", "value": "T12E15F1A922D680DEDCC22B389F1537BCF1AC4C417552CD8B5E927A8C9DB6B4808B53DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649843, "uuid": "eb30b9f9-65dc-4a5c-8e5e-349e4bf7c92c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649843, "uuid": "f4a4d754-88e1-4da2-ae89-e2b3433cd020", "value": "12288:M1PWR28Le0cY+Yg9fb9mJhJ5MmiXHefANtwt5Gs139j601SoBupZZsv:Mh+xL9Rk9E/wm8JNtwfGsLsBt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649843, "uuid": "64669362-9e59-4d9f-8666-70aaec484abf", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649843, "uuid": "f15a3154-4d46-4f17-9db9-0500d3f90be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649843, "uuid": "39899136-a9c6-4dbe-a2f7-bfc556dccb31", "value": "45c87614da1d77c97f2b3faedf5b8577e305468ff8f7f04088afcc84ccdf67af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e05acb-1be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1688636107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636107, "uuid": "0b0d1a09-bea7-4222-9cb1-5e026266fcac", "comment": "Malware payload (StormKitty)", "value": "9ad0efae7e1129c431abe4c4e350e909", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636107, "uuid": "e6695cd6-c68a-419b-b190-3722b352fe37", "comment": "Malware payload (StormKitty)", "value": "46f55b943f779bea929ccef23b67894e4ac1317e99b4d3a0839b9d95f1d7e912", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636107, "uuid": "e9337128-ef19-4fe8-8e30-9e610358f9b9", "comment": "Malware payload (StormKitty)", "value": "ab51cae19dba0c096eb16fc377a27e010b36d1bc", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636107, "uuid": "e262f814-6b1a-4ab9-90ee-2751d27f7359", "comment": "Malware payload (StormKitty)", "value": "07f06ca52d63480aeb2990d931584381d908c1070f5f2fd72c222d346151b8009ca16155a944cf28aca622956e52b904", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636107, "uuid": "985dbf15-c30c-467f-b2df-784daeaaa1c8", "value": "T124B433A34333B9A27BB87ED3D3FA2D37679F85F466844218041A13C26FA758CF252156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636107, "uuid": "692fe812-b6ec-4f97-8277-907ad66eab3b", "value": "12288:I91iI2b2wB9x4nNZzUThBn32Q4i7WGhemt7sVWzC812:UL2B2NWNRmti55t4AzC8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636107, "uuid": "fd89d6ee-ee3f-437c-8924-acf996c76198", "value": 519382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636107, "uuid": "62fae8c7-f0db-4aad-84ef-b65d63024062", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636107, "uuid": "8fc61c0f-89c0-41c2-bbd9-bbea81d80601", "value": "PO-2023EX268.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048e842f-1c44-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688678895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678895, "uuid": "87d5ae18-34f8-4d98-9587-0390abede1e3", "comment": "Malware payload", "value": "e1ab7e9de0652813a3d1c4500a72c561", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678895, "uuid": "ed151bf7-12c2-4f63-8e64-90c78eb96158", "comment": "Malware payload", "value": "46fd7fec12ae431d9f9aca1293c06d8d10bb82fc921f44a7f40921ba63bcb7b4", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678895, "uuid": "5b58f3d3-19df-48be-8356-b4717ce8427e", "comment": "Malware payload", "value": "a5fd98050674055d2e5588f3a088f2ad467333a5", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678895, "uuid": "854a0ed5-9dfe-4896-9aa9-ea0d593123e7", "comment": "Malware payload", "value": "e8f2624889b846435c14316803b78ccbd460081cc2f97192c8e3da7e5ee244dfced8b72facb59e3cad5a8f8f18e1c0dd", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678895, "uuid": "d0938dac-eb72-49c1-8cd5-2ae7263d5580", "value": "T179426EDBB8200823E0F142B334257434EFBE852E0BDADEC98DF62E519BC79132517165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678895, "uuid": "1de57cc0-2574-43f7-b9cd-427a9d5c5b76", "value": "02ea6193bc4d1a72912388cc9f90424b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678895, "uuid": "0623aeef-f0dc-40bf-b0d9-92e3c7c80087", "value": "192:HMDLTxWDf/pd3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678895, "uuid": "f0053db6-dde4-4140-8ffe-58cccc74659e", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678895, "uuid": "1d6b7451-a84a-4059-8c03-bc93f46efca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678895, "uuid": "eb148f2a-2a96-485f-b9ab-3aa7669539ad", "value": "nice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6eefcb-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624174, "uuid": "348fd0ba-ea2f-40c9-9123-060f2f8b95b3", "comment": "Malware payload (AgentTesla)", "value": "8240ac402de015516cc0ac72b075fe10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624174, "uuid": "04ddd46b-9da7-4434-8184-ac3e00d7f939", "comment": "Malware payload (AgentTesla)", "value": "476d26810e91e137d1e3325bd66e6432ac6f9941b179cce9297bbcad2c823851", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624174, "uuid": "0a1c8d1f-537e-48c3-83a5-62b2ea0907ee", "comment": "Malware payload (AgentTesla)", "value": "5840469aee41db6480a5ba2dfa481a325f9bd50f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624174, "uuid": "4d747499-63ee-43b9-b99b-9c429fec6288", "comment": "Malware payload (AgentTesla)", "value": "515735b59cabf1eb44bc8be7b83019684037f97246699de92ec7fb7e4fa69bca0678b69b94304d12aeec6335afa80848", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624174, "uuid": "316053ee-aa78-4a55-8d39-afa6579fec80", "value": "T195352306F684E95BD8429378784294AB414CFC26E798D843569B7B4F04F0AB0CAB77DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624174, "uuid": "6f4550b0-6a1e-4d3e-a6c1-d59283edba37", "value": "24576:Az0w6sYz+o0xfsjcUos+xK5w6sAzKo0xfsjcUos+xKY3mYj3qJPR6wdB:AT6sYOxfsjdos+xKS6sAyxfsjdos+xKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624174, "uuid": "7b5e3aa7-ab93-49cf-8fde-dd7011f9f50b", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624174, "uuid": "4d0dee23-f90c-4f09-8bcd-9bb9248aac11", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624174, "uuid": "c37ed216-c878-4aa9-a8b1-a9c7c41f7545", "value": "SWIFT COPY.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b20e0d1-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623608, "uuid": "e08235a7-c9ca-47b2-9107-6c5b1e92ca18", "comment": "Malware payload (RedLineStealer)", "value": "790576720c622d979cf6a75103c79485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623608, "uuid": "0b8ab1d5-fa54-432e-a585-0c93fa1baf0a", "comment": "Malware payload (RedLineStealer)", "value": "47ef943186f090b593af4d18c042b3f829ca95a227e01a3ae0ddb07a5fcc9df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623608, "uuid": "a1532f6f-0976-4406-be2d-5d60478c8fc0", "comment": "Malware payload (RedLineStealer)", "value": "7410f249b6a70c4b3b7c8343f04709651a81c637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623608, "uuid": "57dc2440-0b00-40ac-a4c2-1a735c47e5ae", "comment": "Malware payload (RedLineStealer)", "value": "9c7d54b78ec5492e5d94b7966688c7d52f42ae83fbdc4864bf177a9a7390a7cdc33c67c175487037da03244bf3fd8bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623608, "uuid": "1e88fe25-edfd-4d4e-afa5-c8c5b2c27ae8", "value": "T1C255AD05A09D1D5CC671E3B2BADC23523DBC8474291DA13992E21DEF99F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623608, "uuid": "6b90ae1b-f289-4313-8cd5-749c27855f45", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623608, "uuid": "47d304ec-200c-4f1c-9820-b9ebbbd32780", "value": "24576:4OmLXJOAVnSCe1pWcFm9KPz33qLtkUSxBk+NVQuRf:43Nf/e1pWgm9KPz3aLeUOvNVQQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623608, "uuid": "8a1e3679-32da-421f-9a19-b13ef6834d5a", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623608, "uuid": "0255a223-aa7c-425f-9f6b-7bc3591b8366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623608, "uuid": "14aa273f-e6f4-4c55-937c-612381cedb83", "value": "790576720c622d979cf6a75103c79485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373c0eed-1c03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688651063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651063, "uuid": "d994bd10-25c7-4181-bf68-a489ef8f277c", "comment": "Malware payload (RedLineStealer)", "value": "26f6daac97ae374094ab418359924b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651063, "uuid": "ea2c3ea8-8ff4-433b-8b94-0ff361a4d012", "comment": "Malware payload (RedLineStealer)", "value": "481154016cbddd9db7d3d8d46437bc3f533835138169b266bffb2c1df0264edb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651063, "uuid": "3e92ae0c-fac5-4c15-8727-5f5b1f2a64f3", "comment": "Malware payload (RedLineStealer)", "value": "fd647f1ea5f1b6f6b67559e2465102dcc7977f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651063, "uuid": "fbbda07a-0cb9-423c-b16f-20e38fc74549", "comment": "Malware payload (RedLineStealer)", "value": "0a1bf626e571b44864d456d75078129c14651eac699edabfafe9e0ea186fe0272510dd8e1cbb0a7eb2392f9c80f8c6ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651063, "uuid": "88d8f6f3-1386-46d7-acc0-27afbddc1d69", "value": "T1E2B4023339609A13E05DE93296B616C0FBB9F3E53BB1819BB119D035AF472D1D73422A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651063, "uuid": "0fce9f32-9d4d-4dbf-a7f5-3cc5b3d516f3", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651063, "uuid": "a182c7df-9dbc-4454-961a-c230c375be0e", "value": "12288:HtNffv7aRdnQg0twFsEcIMEaHvNNPLC96vR/MTijTuiX0:HtNnv782g0tKjMJHvNNDhvRIaSiX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651063, "uuid": "afafb4f8-ff27-45a1-92ce-4d7548dac145", "value": 525128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651063, "uuid": "54e2561e-636f-41b5-adb8-d1f421548379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651063, "uuid": "a143340a-e575-4d3e-8307-806d75e5c91f", "value": "26f6daac97ae374094ab418359924b34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f797b9eb-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624327, "uuid": "8aad466b-e8b9-42a8-95ee-8699b2718b44", "comment": "Malware payload (RedLineStealer)", "value": "0bb62aa92126b51c3d9490fd4a91d9f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624327, "uuid": "34af5d2a-8eb0-477a-93d0-8a0458b9f2d5", "comment": "Malware payload (RedLineStealer)", "value": "48f3d19787cf97fed3581a8c6149283dded93254416ca5d87b1b50b9ba36f6cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624327, "uuid": "fe3ad9fb-3507-489a-8aa8-ec63bc2c66f6", "comment": "Malware payload (RedLineStealer)", "value": "03baf2215217c235878956265710cc9d121784c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624327, "uuid": "f6ede456-a362-431e-8c2b-c80e685a68c8", "comment": "Malware payload (RedLineStealer)", "value": "fe746c684b7743d1ee251dd825c379e8937bb7ef0fee556c61c8712f5eddfa50118a38df657fd7bdfdbfefc457bc7699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624327, "uuid": "f666a3c6-cb32-4bb4-a25c-b8eeddd9ed84", "value": "T104560116281D0C5FA0B635240FCD545379A967BA5B234D9232C2EDEFEBADD80F641B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624327, "uuid": "98655d62-fdf2-43c0-a15b-404b8487df8a", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624327, "uuid": "f42131b0-7b4e-4483-ac5b-192fdd3968dd", "value": "49152:VBK8nv0wENhuk5vqlpVvR88y1SVhhPHGkg1jIgKUelE0+WsoP7wiwOEcCX2YQUQR:XKPNhf1qlmING1mlPT8OEh0UQDrdrwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624327, "uuid": "4a8d61ad-9a08-4a74-8019-a0f648624648", "value": 6013768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624327, "uuid": "28db06b0-cf7d-47f0-aca7-bdf3957894c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624327, "uuid": "d0364fcf-c808-443a-a023-f67cfa573526", "value": "0bb62aa92126b51c3d9490fd4a91d9f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2432d9-1c2d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688669167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669167, "uuid": "fbc7e10c-899b-4c29-90f0-304ef6c237ae", "comment": "Malware payload", "value": "35a92e8fc1adfa85d7c2b6f09efa4c12", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669167, "uuid": "a81d0b26-bf11-4652-8a74-9200beea2d72", "comment": "Malware payload", "value": "498d4a722e4d8cc11a7538d74740bdb0e74617c6286564e8e937c1130a60d7e4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669167, "uuid": "6f0fde01-cdd4-4beb-bf1a-674f264766fe", "comment": "Malware payload", "value": "b1977b736f5a0153e5fe088c9edae0c356bec259", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669167, "uuid": "852a1392-e281-439a-a71c-d7d2426bfa15", "comment": "Malware payload", "value": "fc840fdec617cc4ec3976fd2c154d08b79ce434f62457484b43a06f9950a630cba3c602e7e1e5260c3bf80b555761c37", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669167, "uuid": "55d90463-acd2-43ae-bcad-0ebc963b27b5", "value": "T108F4333D12F70DFEAEBB814EBD04B160DB723410973A150B2AF48D2615ADD492EF5BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669167, "uuid": "509962ac-ddfb-42ee-a064-a883d9207a13", "value": "12288:p2sSgyOtSuLucXUZde7PMWsuysBtX6pJLmJ8PEGogXeA9A+LrZ2+jrkM7iuE881D:FhtdodexslsikuEG4Uj9rqqU/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688669167, "uuid": "6fa3548d-90c3-4b45-bc4a-6aa7282bc966", "value": 732008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688669167, "uuid": "c2489073-e22f-43de-ae83-a90e5ed80921", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669167, "uuid": "4f8c30ec-beec-436c-bf5c-042f2ea0f493", "value": "nuevo pedido...xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5aee32-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622354, "uuid": "0ffb24bc-d39d-4697-91cc-14c7808823b4", "comment": "Malware payload (RedLineStealer)", "value": "1ecf8f059f4f7768ccebdfd5531d6682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622354, "uuid": "28a29e1a-777f-4319-9b2b-d29f84cac79a", "comment": "Malware payload (RedLineStealer)", "value": "49bc63d6396e43e08f72f136318eb5295eae2236debf0548a442d40c64afb894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622354, "uuid": "8ba2ef05-013b-4209-90c3-6565189540f5", "comment": "Malware payload (RedLineStealer)", "value": "58b0a7fe6f0b501c12e62985fbfabe02fa5e2e82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622354, "uuid": "6df3023b-60ab-4021-8b30-d3f44b9fa2bc", "comment": "Malware payload (RedLineStealer)", "value": "1961ed1cb73aa2c91158ef3f270097a8904099a2929bb372e6973055b60c2102d760de0658dc64b3cc790d1ba1fa4c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622354, "uuid": "df5542cb-5a61-460d-86a0-29de6c49ffeb", "value": "T1EA16011864AD5EAFC47134B527DC1A83FDACA474A74B0E0122C2EDEFD89CD81F29199D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622354, "uuid": "1bf8b485-b4cf-4cd0-aec6-687f6806136c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622354, "uuid": "3c3de6a6-9179-4030-9311-f305963ea4f3", "value": "49152:Gh3RH5qxxPFfrRgDcxYChEkbhDev/R1zPCIOnP9ctdaf5+C91Fd5/GJ73jyCNRjW:wNaNrZIOPCWRfdQJiCNRj9h5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622354, "uuid": "6963ac8c-2b0c-4c9b-bbc1-0e52aa1cb6e8", "value": 4074824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622354, "uuid": "12f71b22-0ab5-4d90-beb9-a33c4c0ffe22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622354, "uuid": "2c581efc-c309-4ed8-a007-e31ef8e817c8", "value": "1ecf8f059f4f7768ccebdfd5531d6682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731b4621-1c10-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688656747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656747, "uuid": "1cedfa51-31e2-4586-9684-1ddd2dc23abf", "comment": "Malware payload", "value": "923d3b40142fa196a5fe68bd059d106c", "object_relation": "md5", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656747, "uuid": "e05d7816-4e2a-4f0a-ae6b-aaec41409e40", "comment": "Malware payload", "value": "4b93ec3fd49c0111e8a11ac8a0a197f5366cda19732932ce4cb84e024c648a38", "object_relation": "sha256", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656747, "uuid": "aa968bc7-31a9-4c17-8dc3-41fe122ae3ba", "comment": "Malware payload", "value": "721fc5a96e635c7e4a3efb74de9581c4b99f41a1", "object_relation": "sha1", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656747, "uuid": "1eb1a44c-e1ac-49cb-831a-d5898b2e3c81", "comment": "Malware payload", "value": "898ad72aed037d680a9daf74b6fd9904253dfc04a49329e9ca8c22ba43b81a1ed7aae71b84edcdd3a02b4cc14284639c", "object_relation": "sha3-384", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656747, "uuid": "690e9092-d4e1-43cc-bd06-49649400f088", "value": "T1CA4633EE8C55D0FE8C89133B01F368CDD46B45D88752BB21856AEA3BCD1F95A27D3824", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656747, "uuid": "3b041b7e-0f73-4a82-9d8c-008db5a4559a", "value": "98304:fo0y8mSLkhMX1ISLm6wPK4//cvl/Lrky9wctGw79Fwbg6tRtAjmg0POwN2/9ukCR:n9xkg6fy4XmwgZFwUhjmBOwNJku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688656747, "uuid": "08301562-074f-4817-a723-a88bc59b5fa4", "value": 5859772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688656747, "uuid": "4a1d37cb-4f42-4722-b392-13031e57dbf1", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656747, "uuid": "836f4dc2-0c39-4024-90fb-fdba68e25cad", "value": "GuardiansInstaller.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefa8d78-1c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "a81af313-51eb-446a-b51f-e3bc12a53186", "comment": "Malware payload (Mirai)", "value": "ff6b076a9ec33044c709336104c11cf5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "eb9c613f-be87-4af8-b7c4-9e4f6d5fd92c", "comment": "Malware payload (Mirai)", "value": "4bab45d96aa670e4039ad113134d4a078f9e6f4d5c79a13adf018fb06b1aefa1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "18a5d990-8d25-4584-a8bc-46098ea4f6ad", "comment": "Malware payload (Mirai)", "value": "f78777ac5b05407e02b87bbf85bd2c11fa8f0baa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676604, "uuid": "7b9bc213-1d89-4d57-a9b6-0d4b65bbc075", "comment": "Malware payload (Mirai)", "value": "3612a09f8f98ee8becf7c5a29329a4cbb9b3aa3094572908a250dd5c15430570a89973705577269141e4e851319f6789", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676604, "uuid": "ba72f6aa-7371-4d6f-ad87-d9ab1ff57ad4", "value": "T1073301228236BC63D2D2BCAB673E9C43252707BDB97DB471A9309FD85AD3115209E5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676604, "uuid": "d8fdeb09-d1e6-4302-a28b-0c1412ac1b89", "value": "768:rOpl0+Vd97pIQiq2Z4zOgrPUNFKrjqOi7+aDy+effF9q3UELKJS4AZHPIXCOBRJ:rAD78RZKvPUzeqOmNDI4LKUR50TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676604, "uuid": "9834574c-b5cf-43b5-901f-4afe9de15683", "value": 52884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676604, "uuid": "fc04ec04-c8a8-436b-9a9f-7c04ca964b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676604, "uuid": "be57074a-01c2-4e02-9c2c-21e7bdf2cac0", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6230c23a-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688624076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624076, "uuid": "785f58c2-204f-4c7b-bc3f-3e2b74eab77f", "comment": "Malware payload (SnakeKeylogger)", "value": "3e7a48f302ba953ca961bbec180f3f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624076, "uuid": "ed8ffd81-818c-4f09-a86f-3dd1ae4a0c47", "comment": "Malware payload (SnakeKeylogger)", "value": "4bd65c6278bf0a954b76e47052d212150a61be572f3f0dd2dac5345dfd875707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624076, "uuid": "6f8fcca8-94f4-4ae8-a7e5-48a611137455", "comment": "Malware payload (SnakeKeylogger)", "value": "44c608fe8227227c4f5142316fd6d42b145e5f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624076, "uuid": "08feffb6-b2d2-4a36-b926-f47d05db9433", "comment": "Malware payload (SnakeKeylogger)", "value": "2d385f7bd1908a7741aea87184194490cc9ef4581f293967104b5e93101c20d6536b3778027d6e6bf5752608ad14ee1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624076, "uuid": "a55e57b0-0ccc-4f30-9dde-94aff6017956", "value": "T1F205733F24CAAD27D239E6967430E95DF212B3C237674B4AF7C206A5843236937E119D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624076, "uuid": "4dda9887-1c19-470f-b1c4-56acbbbf9a04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624076, "uuid": "cf570fa2-9103-4130-a779-cee6118e86e2", "value": "12288:cql+z7LnM2Nt53sKrCGweI0mW4ztOvCpP1MKCY0CtU6+ipiflv:cS+oGwN0mBtOapP11CXQ/ifl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624076, "uuid": "0df5d8c9-e875-47c2-afaf-76235e407921", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624076, "uuid": "f2724494-d0e9-4a80-8820-57a92a78a8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624076, "uuid": "97f0c4c0-f02d-4f37-9bc7-7baf011ba1c5", "value": "Piping Bulk Material Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab044c47-1bba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Babadeda)", "timestamp": 1688619904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619904, "uuid": "9757342e-59ff-49c9-89a5-b13bb03e3410", "comment": "Malware payload (Babadeda)", "value": "45dce82d48aaae2c56cf79f3cc4be96d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619904, "uuid": "79b6d18b-4cbd-4f31-9105-7da1ce13c6e7", "comment": "Malware payload (Babadeda)", "value": "4c6754f751e8c8d4b2d6ecb99c2052361dd7b0f7bc11a9c22d1f355f41cafa80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619904, "uuid": "65ec6810-95f3-4457-98f0-4cd49c35060a", "comment": "Malware payload (Babadeda)", "value": "8e32eeb0d07d0a42401b1f4574a20381d84678ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619904, "uuid": "dc87f729-2654-4388-b7f8-463619abc65a", "comment": "Malware payload (Babadeda)", "value": "ccc86b3d676bb35e5bc7f9633b79bf05108d3c27b7f1af9b7989f7e57d0f7ecbf48dd4f5aa238bddc1058158736963be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619904, "uuid": "2010ffac-9334-419e-bda4-e5f9a261244e", "value": "T1BC453D2537EC8226E1BB97BAF8F101169AB4B40FEA52DB1D04E062AD1CD7B80DD5117F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619904, "uuid": "d80da8b4-dc71-424a-8b55-450cf13a4c68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619904, "uuid": "1d98cb0e-e2d1-41ad-adad-810330a8f430", "value": "12288:ismzHxmnz/NpzHb9UJ/pqVwHoIXQrn31scWXgFmTApopXdxxL:is4U7jHRVwHo8cWhQFmTjpNxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688619904, "uuid": "da1bbdbd-3a6b-449c-b6d6-f71e59cacc3f", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688619904, "uuid": "3db674d9-2d12-4bb7-b9f1-ef1e790f83de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619904, "uuid": "42dea44c-c925-4b90-a3cb-3061bc65f7be", "value": "45dce82d48aaae2c56cf79f3cc4be96d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6ce0e6-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637007, "uuid": "04c2cb97-0645-436d-acdb-6f42353bb535", "comment": "Malware payload (Mirai)", "value": "7a20733fa0636998d8b9663afffb86b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637007, "uuid": "b9bd1b9c-7c44-44d1-af12-81d24c884489", "comment": "Malware payload (Mirai)", "value": "4c81429e70045bf684bd0a16dbd41674c4cc55897ed5d12e4b2b0961d0b87be4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637007, "uuid": "d9a9bce0-cdd1-4f69-8692-6f7665efa5ec", "comment": "Malware payload (Mirai)", "value": "c79b80d87a1c6d3199d9fd975081ccda4e63a2b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637007, "uuid": "692a9343-f833-49c3-aa17-8fb1fd8bd51c", "comment": "Malware payload (Mirai)", "value": "9639037562badc1dafda26f736168ce09dbc470120f9c292179c645ae0ae8ca678133bc35cd6e1c210ab55837aed2fda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637007, "uuid": "3ed20b0c-66fe-4915-a831-9f94fd45e73b", "value": "T1483302A2676E69D292708377FC33AC1A96DC17F8886730D62CF0661577C54064EF66C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637007, "uuid": "b6e2aa4f-a04d-49d9-a5bf-61e121899746", "value": "1536:j9O/ZMAXIxNUk0tuLcPqF1aBexo4opKZb6:j9O/ZNKyZuLGqFUFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637007, "uuid": "09bd9907-1af0-4365-8957-2e985a76e23a", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637007, "uuid": "9ecaa5e7-b7a8-4119-8102-6426efe3b9f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637007, "uuid": "e9457b87-f05a-45af-bf0a-29a7027674df", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbb0b25-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638081, "uuid": "969d33a3-f86e-4178-93e4-b181e934ba8a", "comment": "Malware payload (Amadey)", "value": "7001af9aa7c898df7c38fba673797c5f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638081, "uuid": "25e1a098-8256-48e3-ba4a-a1cbb1019841", "comment": "Malware payload (Amadey)", "value": "4c991ce8fcf0590353c0e6509ff68be78df8a08ef19fcf8935926a426c0701b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638081, "uuid": "2e6d653a-c4f3-481a-ad3a-d3aef6176fee", "comment": "Malware payload (Amadey)", "value": "d2754e21cf4eb0b1db09804c4f0b8a601312d8fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638081, "uuid": "df8881b0-d9aa-4ec5-b0a8-c6d10779cc8b", "comment": "Malware payload (Amadey)", "value": "d6a5034a5c46f51f146da46c3fa17af958d8ffc49a5f96da9310753b34ba90e2978fc1704672783b75f30a2bf2d00663", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638081, "uuid": "15c66a98-4fcc-486e-b68d-d4b62f279874", "value": "T166160119106D4E9FC47035B52BED2943FAAD6470671F0E4622C2EDEFE8ACC81F29469D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638081, "uuid": "402d3042-8642-4975-8b68-23b4169b8045", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638081, "uuid": "0102ed9a-50e5-479b-a289-6bfa3fc046f5", "value": "49152:SXsaajP5kFHNc5Z51SjJDDBO/ch5RbkQ/FC6UqZAjqa3ibuulrIKoRlU2zP8b590:u6EYunI5jDGORUVo6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638081, "uuid": "fdf727b1-ed0a-464f-8c6d-728d5a58d6d5", "value": 4071752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638081, "uuid": "56eae599-86fe-4493-bc39-19b09f3e727a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638081, "uuid": "31145067-ef54-4950-b41f-5d7843aefa4c", "value": "7001af9aa7c898df7c38fba673797c5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043be481-1c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664721, "uuid": "330aa8fc-4efd-43d3-b53e-24a368aabc7b", "comment": "Malware payload", "value": "8cfe02754f5d670eec9e1dd3672fcc55", "object_relation": "md5", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664721, "uuid": "59a60c61-dcc7-4cde-a41c-8e5e9a735114", "comment": "Malware payload", "value": "4ce77f261c4ddfc7f58f92b8f55ba29fc2faecd189b90626b9d9f38911ad02e8", "object_relation": "sha256", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664721, "uuid": "626682d7-d664-4273-88d7-38b9f8f1cb57", "comment": "Malware payload", "value": "6914372633485aa977a58828a96b8659cee9dcb2", "object_relation": "sha1", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664721, "uuid": "4267c81d-637e-4c71-8124-46f32c105b9e", "comment": "Malware payload", "value": "f67243e2a15005a936c7246963a26dcafb4747b8f5c7fbd92b010b19098cfbf528c9e01ac528b85e9130e2e4522bafc7", "object_relation": "sha3-384", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664721, "uuid": "02b8632b-f30d-4393-8bc5-b3315ad0941b", "value": "T1B615331F07DE3F8CD5DAAC2CAED08563F2F51A369472594C1E2EC09643CF162B647986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664721, "uuid": "e252ef52-d8d7-4ef3-b91d-9d984e4ca8bf", "value": "24576:3lMVkq+4iTvIDXsfsFiCPHuor5KefjFSKXax9y/vNAh6Vdzt6QMI:3l8kpvIgyPHLrcXeasVAh6Vdz3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664721, "uuid": "0c7a47ca-7fdb-4323-88be-b64aef5c9ad9", "value": 933621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664721, "uuid": "16290890-6613-4ec1-b7ed-a0fb510793ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664721, "uuid": "8ee041a9-e7dc-463b-b7b9-034d56fb7e2b", "value": "Game.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fd3daa-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688624595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624595, "uuid": "ec991f52-7242-460a-a3eb-1d51b0362f14", "comment": "Malware payload", "value": "161b4647401d9bdd3b8eac6b158e9da6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624595, "uuid": "051ec418-8fe7-4f51-acf6-dc25fb3cb113", "comment": "Malware payload", "value": "4ded9938f4f1d44e89c1d0bb85e85c9e0c1daaee78be6005665f0029d6bb8af2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624595, "uuid": "937cca4e-fb5e-4e46-9a2d-560ddc0474d7", "comment": "Malware payload", "value": "e2cd652cafc84b6a09885557ca7f7360d0129bee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624595, "uuid": "06d6c0c0-717a-4d58-9123-a014e73f1492", "comment": "Malware payload", "value": "efbd436790794f2ecd86b1b3f77d6e497cbd7dc8a634fa9f346604da60dc1c9e174304e80d95f27c8457f443e252d321", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624595, "uuid": "318c60d6-1759-491c-b6a6-28da42f17223", "value": "T16B23F2BDB8911069D72BC5F2037B428958C8D7B5F1F8ED1694DF2B72964429F86C2343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624595, "uuid": "98528787-2ae7-45bd-891e-60e621caf832", "value": "768:b/w9r/5USKFIK1uhYjt/8kDnu1cAdQN4c1/0hn0iHR2K+55DF9RAgX2Woa06Gtz5:bI9LcBPDn//Oc1/E72K+RzXPoa0HzYPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624595, "uuid": "e8fce995-6269-444e-bd12-a2d4d5df20dc", "value": 49910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624595, "uuid": "3447d9c6-231e-4026-855d-9d68dc113745", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624595, "uuid": "7119fc1b-8f8b-4ebb-9eb4-485495394b7c", "value": "1c6f71c9f1f5c9ed11f841be0e1a2bbd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249baf3a-1c46-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688679808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679808, "uuid": "80616885-8779-4766-968b-cf15ca44586d", "comment": "Malware payload", "value": "653900a45b22641e4dec1a02af9bf102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679808, "uuid": "ef483181-fba0-417a-9234-1c83a7e073c7", "comment": "Malware payload", "value": "4e55c10e79e88019cc44951789afefd670fadaa18570a9ad3bfac0a495b7278f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679808, "uuid": "71fc7be8-f934-4157-93bc-ebb2ba6907fa", "comment": "Malware payload", "value": "773de83d5315ebe27662bfc325f783b6c4aee3fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679808, "uuid": "d328a8ba-0729-4956-b44d-6fac7af053b7", "comment": "Malware payload", "value": "02b7ad6efd7cbfc971c29ba0a0e11159bd3919354bd2e151e359a60da60dccdabc81faf34e33583470f89b0d0d961b7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679808, "uuid": "657532ef-0055-40e9-80ab-684e14fb4543", "value": "T17AA5330EA7E12877E5B20BB180A55643493278340F7F52FF56C4E97D0D227F0AA71B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679808, "uuid": "3739178c-a9ec-4861-87e4-b3dcac19ff6d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679808, "uuid": "44a4f989-b7fe-43aa-9fac-c39b2647ddc1", "value": "49152:2LodI/9TGEjpKspJR6k9//NCss2Qguja:ktqk3Cs30ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688679808, "uuid": "c2d68645-6eae-4edf-a4b0-cce30b4a70f7", "value": 2174464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688679808, "uuid": "aa18609a-54df-494b-ae4c-0776da3f7431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679808, "uuid": "57f7d80d-e3cc-4c88-ae6f-35ac4ecd77bc", "value": "11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52daaaab-1bff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688649391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649391, "uuid": "454fd13b-9a04-4c93-8266-829c23b5c756", "comment": "Malware payload (GuLoader)", "value": "c9d6af691530cdcf75f95e32210fed6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649391, "uuid": "af164d35-d470-4b15-80bc-13aba1ac2371", "comment": "Malware payload (GuLoader)", "value": "4e94a820c7fa2279e7fb0bb4b698770cc71dda27a008d2b04f72969cfed78f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649391, "uuid": "2be145e4-ef22-4893-bb73-2a62ba1941a2", "comment": "Malware payload (GuLoader)", "value": "7977f25cca58ec560e72fd35d35306987cd2012c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649391, "uuid": "36e2fd83-c876-4e94-b3a6-b6d3d20673dd", "comment": "Malware payload (GuLoader)", "value": "c6858fd13cda3406dc701ff220ea6136b624b9720ff54086954cab556b371cc93fb2df903bd1d9755f80f47f1322b721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649391, "uuid": "d6552aba-8203-43d1-add6-7c238027949d", "value": "T19505232F2960C553FF268235CEB52CE85F77E058A5C6B7811B1CC5C665BA1E0AB2C9C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649391, "uuid": "c7094482-e122-4465-af5c-abb41a1e4219", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649391, "uuid": "53d3e41f-2941-4759-8b35-6487658b5b2b", "value": "24576:E9wQdjgVpgk1jyuJD7BhW+YaMVkG99F94RJz:ZogVpv1rDK5tVki34RJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649391, "uuid": "7045c995-b2b8-4ec4-8938-8a8c73ab8e88", "value": 796807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649391, "uuid": "46e1536f-3b1f-44cb-8b07-eb41d997196b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649391, "uuid": "cd02b710-b874-4d13-8335-717d2c427a5e", "value": "4e94a820c7fa2279e7fb0bb4b698770cc71dda27a008d2b04f72969cfed78f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846862fe-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688646038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646038, "uuid": "a14ba483-c17e-44b2-be21-42c623d0badb", "comment": "Malware payload (Loki)", "value": "fa681a6ce6ddd34f6c571a38fb52e867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646038, "uuid": "554ae57f-c90e-4b02-82e5-b26a7b48705e", "comment": "Malware payload (Loki)", "value": "4f0c6b86c73e464ccd681c2de2a1bd2d0aedb75625afabc632dddf32c0f243b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646038, "uuid": "834916e5-61c9-477b-afb2-96b5d488dc36", "comment": "Malware payload (Loki)", "value": "6ad073d0b36536bd38b976a13bc9479e1febddc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646038, "uuid": "04436841-c0c2-4e87-9f48-b1cc756bf407", "comment": "Malware payload (Loki)", "value": "09f2402dfd10e3752e7523548134d39fec9575f5fd8ed04044f5bbde745d44e55b0375dfe74d98a8308f307b861c0489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646038, "uuid": "0e70e78a-87cc-4ecb-a444-667558f8ebab", "value": "T1A1C4F1166973C74BE92893F7187444C12378538828BDD71C2CDBA0F89D6BF10A667B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646038, "uuid": "51952969-75a9-43fe-bffe-7122a220e95f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646038, "uuid": "a44487f8-02b2-4202-bbd5-ff650327a59f", "value": "12288:wpC6DCkc1oOJJbOGXzPAsHPWB8BpPPNkkEZGD22fPs0NJEG:g6VOGDAsHPNBpPPNkkMGDTns0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688646038, "uuid": "3e1ec781-0caa-4462-8a08-24d7e2077e79", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688646038, "uuid": "bd9fbed4-88e3-4278-ae25-1d2e6733dbfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646038, "uuid": "f7f63dc5-4109-4cd1-bd2f-cf3a0bccb117", "value": "rAWB1164667916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f316396-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688622380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622380, "uuid": "49bb64ce-b4cf-4cf4-a5b7-c82cb162d48f", "comment": "Malware payload (Loki)", "value": "42e12ae62308e7d767aeec4be10585af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622380, "uuid": "13ae353d-7e60-4195-b235-02fb9693b5cc", "comment": "Malware payload (Loki)", "value": "4f5242a579997963c7e2d248b36913a5a2a428f3329a67f10e48946b68049bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622380, "uuid": "7ab90acf-cb23-427e-8f0f-d3da389d62be", "comment": "Malware payload (Loki)", "value": "8fee89192e2bab2fd783eb807dd4ad8fb2c8e3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622380, "uuid": "4d559642-d56d-4d36-a8d7-648c4e60acb0", "comment": "Malware payload (Loki)", "value": "bb55a902e799797c88a71bfaf1586ed00715eb385f1319e6f480be7660fab979d5fcb145216683016f26ce10adec89b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622380, "uuid": "e449c8e2-2fc5-4c26-a9f4-81fd42b71950", "value": "T174E46B3C1CBC7622C174F2F68F9CD421F65094AA3E61DE3765C39899461EA0269C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622380, "uuid": "5f7b6ee3-7200-4a1d-8e25-6252c09209af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622380, "uuid": "c0dae84f-61d7-4499-b2e9-a6450b8ff195", "value": "12288:8zDkjhnjh0rJcw3oxVZLDp/tVIhgFmPH0vJa0:8zQNnNmxCvDpEhMmPH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622380, "uuid": "defcc1f6-8848-4eb2-8723-c8d15286a5ce", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622380, "uuid": "b8a5202d-30ad-435b-bec8-dad045fa6308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622380, "uuid": "175e0ade-1e6a-45a7-a306-64a2f495767e", "value": "thong bao hang den 202331294440291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef84c0c-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628178, "uuid": "d7af7325-7f30-48f5-946e-f7812b7877b0", "comment": "Malware payload (RedLineStealer)", "value": "6a85c88cdb1c22ff824305c1f530d0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628178, "uuid": "c9c27ed8-cd88-4577-8f75-d934901a77f1", "comment": "Malware payload (RedLineStealer)", "value": "4f5a4acfb88067a21b2dc09b4bbc37b8cfa96e824860f48812c49ed9edbb1ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628178, "uuid": "37584dfa-56a2-4055-9af1-3e76b47848f0", "comment": "Malware payload (RedLineStealer)", "value": "35aa8d0110fe9d6ca808ae7b51c9fc743fb964a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628178, "uuid": "b306ea7f-0fd1-468f-a590-fe1e5789be62", "comment": "Malware payload (RedLineStealer)", "value": "714244665195e0824ebc0c8d04be094036f66b55264bab376b00ec20760fe96f2b59860e6102032854196dc5da6033a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628178, "uuid": "fe725469-d0ca-4650-90a2-ac5292faad51", "value": "T1B5560152280D0D1F917634241FDD4463B9AD57A96B174C8232C2EDEFEBADD80F686B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628178, "uuid": "9c5397d2-6059-4419-bd47-c12af6742b8b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628178, "uuid": "6eafa939-b102-465f-936a-248850287db5", "value": "49152:c3exNuy4cHmyH7UHt7v9wWuZIiHoObzZFZX0pDNPXMuQWw2hTbw3gDPuG8tEwhG+:cO6y4cHlULKwtsWLhfktEkGIJVvgw7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628178, "uuid": "d43a4e81-ae55-4d6b-9a11-aa7d31ba24b5", "value": 6013768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628178, "uuid": "257d3428-6c8d-4fb0-9127-a720dd152083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628178, "uuid": "7aea3273-01a0-4f6c-9d9a-48329ce9a508", "value": "6a85c88cdb1c22ff824305c1f530d0f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6414a1ee-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678626, "uuid": "fbd20932-956d-4ea7-bbec-e5d26e35b495", "comment": "Malware payload (Mirai)", "value": "f716e7b270c57a17584acc91b96f19a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678626, "uuid": "e349ab46-6e8f-4e97-ae1a-8b89e62c8392", "comment": "Malware payload (Mirai)", "value": "4fb0b2a3175d1dc6d7892b0a97fef6500ac9aed5c2f11b90a805b2b6a6ba5059", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678626, "uuid": "88ee852f-97e1-4db6-99bb-cf3e2ae6b40e", "comment": "Malware payload (Mirai)", "value": "87fafa8eeec9fe88acecc956a3c4faff922083b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678626, "uuid": "72bd68a8-3ef9-41fc-913c-99eec627345e", "comment": "Malware payload (Mirai)", "value": "e6ee8072765874e6f464033e2d62ad0a24a1f41fa159ed26a149452336fa4549d21be57108e1db647e98555aec7abd1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678626, "uuid": "b435e6e0-9ba0-40f9-a0a6-d6283ee5d91c", "value": "T1B1C3B68A6E227FBEF6DDD77087F3DA3056D6659227928280E1DCDD400E253CD281E768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678626, "uuid": "c5544aa7-1668-44f3-943f-0d7e8af66c69", "value": "1536:1TFHl7FYw3jY3j7gjLmrSnP+heMWf6ye028UUS3B5Oln4jId4:19cq+heMWS6bvS3B5OR4jId4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678626, "uuid": "39dfae83-21ec-448e-aa29-cca6ffc2fed7", "value": 119321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678626, "uuid": "8267ad66-6775-4ff9-98c0-3b261dfc5d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678626, "uuid": "722d8ab9-cd78-45c8-8c7b-d7bebc3361e7", "value": "mips-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da17c5e9-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624278, "uuid": "bb4c26d0-441e-4a2e-961a-e9455b036c9e", "comment": "Malware payload (Amadey)", "value": "d46844d9bc204c6d50d82fb59742d97e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624278, "uuid": "74b9d2c4-25fb-447a-a8d9-d10eae338b28", "comment": "Malware payload (Amadey)", "value": "50980f55a38003664b114fa03937addc91f52cbca50e775efa8cc9cfc432399b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624278, "uuid": "46743924-a046-4bab-9748-c55ded530a03", "comment": "Malware payload (Amadey)", "value": "12d1e7263d4d7866de4e6c08547909b624d48718", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624278, "uuid": "3feb1130-96c1-4c4e-b05e-f34908aaa1ce", "comment": "Malware payload (Amadey)", "value": "681ce041e72bf0abc71450f3776eb39c64198f1b6c00493969e3b4d83d484b93bc2b05feb4f7337381bbb1d33061a3ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624278, "uuid": "fd256643-3a6b-4563-8639-eb183f57e0b2", "value": "T1F7160119515D8EAFC47134B527ED0953FDACA434A72B0E0522C2EDEFD8ACD80F690A9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624278, "uuid": "aca3e767-4df5-4a19-9501-7deae8ae2aa6", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624278, "uuid": "911f098b-1a4c-45d1-81c2-bc78091d7dc5", "value": "49152:mJ7VeIQm+TBW5Mzo/7UaImqKOHznk3YQ4A+3gaIwkLTl3Gp1ssT5Ik4ODBeZgFas:4eDQycdqTGVygLlAz5SOWQ3qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624278, "uuid": "a90bb6e6-f28c-4f4a-abc1-4e2bf03fb175", "value": 4075336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624278, "uuid": "538c79d5-77d1-45fc-8560-a3871f93010b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624278, "uuid": "24c5af8f-dc22-4dd7-92b4-7a76cf1a1dd0", "value": "d46844d9bc204c6d50d82fb59742d97e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83366bf1-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688652049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652049, "uuid": "ada08335-9a68-4367-a99a-b18f1f19ce2d", "comment": "Malware payload (AveMariaRAT)", "value": "76029cae00aad5966fe687490eccc6db", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652049, "uuid": "24ea7cbf-ca72-473b-a8c5-f6a453311be4", "comment": "Malware payload (AveMariaRAT)", "value": "50b84d6a84b7bd56b635bc6816321470c7dc01308b9bffd51dade9b9d1f80132", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652049, "uuid": "e070b960-76b4-44cd-b2a7-a9fc91c9f24f", "comment": "Malware payload (AveMariaRAT)", "value": "36ffe12ec786ab7f59dbc96a2ffa4a05f6b6674a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652049, "uuid": "8d1f027e-b059-4055-b1d1-5c76b950e3ba", "comment": "Malware payload (AveMariaRAT)", "value": "f442cc12e37d85c681677fe743a19bfa809bbdb7f2b6865aaf24d37ad1bdd6470421dd081d032c0d4c1a20656d30efa4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652049, "uuid": "da6efafb-b17a-42c0-9494-cd4f16481287", "value": "T184F4D041727E2A63EAB88BF5025152B097F63F5EA26DE7E80CC670DB56F0F404641E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652049, "uuid": "128e720d-b41c-443e-aacc-c65bae8fce93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652049, "uuid": "f48c2b5d-3da4-4901-86fb-02259dc4983a", "value": "12288:RlKnuFEXqXdVG5oWOT8D57sCQoUdUgYVT5jxMt6yzmexm:mo4qXdVG5oW28ZpgUgYVVQ6fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652049, "uuid": "e5c2fda3-6f58-4389-bc4b-a8f43f35150e", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652049, "uuid": "9809b883-906e-4bcc-a7f4-c124ab1de9a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652049, "uuid": "603904b9-89c9-4e7f-ab2f-b6b54fa66276", "value": "50b84d6a84b7bd56b635bc6816321470c7dc01308b9bffd51dade9b9d1f80132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd8b522-1bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688641783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641783, "uuid": "e5cc60b4-14af-4972-a135-6ffa6e549b7a", "comment": "Malware payload (Loki)", "value": "482b789757748639f1650439cee279ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641783, "uuid": "c128e1bc-087c-40f4-9b3b-54a5283526c5", "comment": "Malware payload (Loki)", "value": "51134c2653c4523f190ad0616836cfdee7531db03a6462a50d80e2c674c2bed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641783, "uuid": "c6029132-3d74-4c74-837e-1eb59a11812e", "comment": "Malware payload (Loki)", "value": "5cc4a7788951efe812b948787a904d44e2c6e0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641783, "uuid": "b4bf5e7c-839d-40ae-bcd9-10f8f9e8fd1b", "comment": "Malware payload (Loki)", "value": "5e46b63f503611d68ee394569e48893b147d04a773876112515269610c2173fa75624d5187fa3b77cf516c3ac6f986f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641783, "uuid": "dfd0df5d-8226-4f42-b1af-49aecb04c9d8", "value": "T196E401A833E3540FCE6E7FBD19890BB9C9F9AA023112D2474EE7784DDC68F558A40257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641783, "uuid": "9daf73f2-47e3-4a5d-908b-31c41d4743dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641783, "uuid": "e15da8db-f98c-4a58-bbbe-a0fcc04e2dc4", "value": "12288:Hd6L7PV1fFiObhaDnLMzIL2q+RTdOL8yjhgQtn82SU/m30Iltu1rGH4hjJugruc3:2OyqGUL8shXteE8tSrGHWjJugH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641783, "uuid": "7ff960d8-388c-4df7-9d6d-f0cccef32f6b", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641783, "uuid": "5ca5c9a9-b67a-4eaa-954d-4df5279b7daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641783, "uuid": "f5a0a130-0fd7-48dd-bb5e-6f70e9731318", "value": "51134c2653c4523f190ad0616836cfdee7531db03a6462a50d80e2c674c2bed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeac3c7f-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688627319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627319, "uuid": "c7147919-b88f-432d-a559-84ff955204bc", "comment": "Malware payload (GuLoader)", "value": "5e4047ef7df30950a95fc40c03263041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627319, "uuid": "8121c30c-e6cb-4b37-a356-6fea59e60270", "comment": "Malware payload (GuLoader)", "value": "51592c5fa1a8aae327b61c17649403e42c1bfee75644e87aad87c52e7cd63529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627319, "uuid": "dc6c1e2c-9797-45e3-8879-15f5214f53af", "comment": "Malware payload (GuLoader)", "value": "e77eab466a7b0d939c49352df317e433d558f561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627319, "uuid": "959ba600-f03a-4b09-9be6-774d26abe58c", "comment": "Malware payload (GuLoader)", "value": "a7b30eff81d59b003de063bc359f0c8683049e74d03d7f43b8ba326ef5939e9db0ca36153434cf2844feae92c018fcbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627319, "uuid": "54c502c0-acbe-4cfe-8cbb-ee11506bf652", "value": "T11E0402666451CDBBD6A256310E2BDB1BEF91CD5421BC19637B84770BBE328C3972E202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627319, "uuid": "78c993da-f1a3-4ed1-b99b-6ad58edb7211", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627319, "uuid": "de9117f4-5041-44ff-ab36-94721120c88c", "value": "3072:VAwC5wP7dePo8fCcXbbas/7rIlpKjyGJifvZbmBBP3dAVKuX7DVoc/neaPzYRVrg:Vx/MdaszkMniHVMqVKC9/easRVhe4X21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627319, "uuid": "174dbb1f-f23d-4fe6-906d-506c1fa60992", "value": 183377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627319, "uuid": "d6c86448-090d-4002-9896-0edd10742c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627319, "uuid": "264c2c59-8aea-4fcf-9312-dba114708d54", "value": "RFQ - and company profile 00233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682514ea-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645561, "uuid": "bb64b755-3033-463a-bebf-7f998ce58c6a", "comment": "Malware payload (Mirai)", "value": "0487f78e8a33f00670ada30afeaaba4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645561, "uuid": "8a956de4-357c-451e-a52b-99ebdbd9e1f9", "comment": "Malware payload (Mirai)", "value": "5176a04623f4bc5d85b0c78b97d9a6d34edfa7b84e5f40e6c0b987492a3d894a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645561, "uuid": "76e69ea4-d307-4e0d-b2e7-f014538de970", "comment": "Malware payload (Mirai)", "value": "afdc82a8978a0f55d796fc715301f18a392c36a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645561, "uuid": "7c7c2d14-1a8e-4c77-9966-ab4d3694019a", "comment": "Malware payload (Mirai)", "value": "2649344e1947b3c69385c9401ced869cc49ec470b81731b2f163d9e84a9dc3c25369e4439049cc74756564d31eea13ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645561, "uuid": "5211ff95-a091-45d6-836b-505408ff99d9", "value": "T168733A42BC915A12C6D0137BFB2E02CD372663A9D2EF3217DE216F21738A86F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645561, "uuid": "1044cdf5-083b-402b-8a71-b66a61f4f8c6", "value": "1536:dHDnmLHzYY1p4dwI5WrqPrS36/TzlQsXgMXfwlNaNNm:dHDnmDzn1p9gSEBQsPvw04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645561, "uuid": "97d637b7-09cf-4563-9f4b-30e2955e6f40", "value": 76044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645561, "uuid": "e3b27ee5-7a19-4f65-8bba-40723ee1e660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645561, "uuid": "019cbb29-bcdc-4b66-a92b-0d4557ee0c87", "value": "arm5-20230706-1212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4e4825-1bd5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688631613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631613, "uuid": "c6b8049e-a3b4-45b0-ae7c-a8846f1a0d18", "comment": "Malware payload (Mirai)", "value": "cfda8980103990e1a81df645f90d8067", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631613, "uuid": "10e9540a-7425-4170-846e-c7b3eb12d42b", "comment": "Malware payload (Mirai)", "value": "52170fe9202b45f87f560a1db67dc43b437cc5d98d75a3afe5a9dda989d969af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631613, "uuid": "0edc330a-9e66-4b7a-9b35-c02404c40a7b", "comment": "Malware payload (Mirai)", "value": "388c1a2cfc7b5159394def0f5ba05ff282ac5f9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631613, "uuid": "12cd4736-7d91-4c3b-b6c4-fc8494b25697", "comment": "Malware payload (Mirai)", "value": "4d6a86e3b0035c206c0f7a77b7cb53585dc61b4d8d4c68526b615ce37470ec112d5bb69d6a8aa0af70a262087fe3e047", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631613, "uuid": "6fc7b1e2-f174-437e-acfd-d6e3e4d8e273", "value": "T1FAB2C0CC60943084CA8D7C7C178D4A674F6CA190BAED9B16E360CD98B3BDA4B785D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631613, "uuid": "65e5639f-c720-49ac-ab41-d1aa28d9f361", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBp+ZqEWvk:/QlS07FUXqIYSXQKquSqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631613, "uuid": "3fa79e2a-53b6-47e1-a838-6870597513d5", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631613, "uuid": "ba9d7550-ceae-4b63-a8bf-fcf82ab84e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631613, "uuid": "6528ed9a-cd3c-462a-a593-99fc6060f0d3", "value": "cfda8980103990e1a81df645f90d8067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f2b70f-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622955, "uuid": "6c0a09b2-ea14-43a0-bb35-c8db66e989c6", "comment": "Malware payload (RedLineStealer)", "value": "717023eadb491537ed25b75638fa808f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622955, "uuid": "6a4c91af-04cb-4913-94b1-7c0934f53417", "comment": "Malware payload (RedLineStealer)", "value": "52528b43a9738fc10cbcb3b7c2b4ea9ae3ce9d368990c54788908da9a96ed51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622955, "uuid": "512cba27-0b77-4a08-85c8-d4ba1d58bf1b", "comment": "Malware payload (RedLineStealer)", "value": "13bd77bc7152df655ebe41835a3df5afc5ec4897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622955, "uuid": "633356a8-c7ec-43d8-9fdd-fadf01f61b55", "comment": "Malware payload (RedLineStealer)", "value": "37f0ae3b2abd6c4a75101db25daf1ba292f5cafc2667f2fdbc15706b2d0e72a11e1564a1a08dc17e6e55d5de6c8b5a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622955, "uuid": "ee6078a8-9889-4939-aa75-5584bedc3181", "value": "T1A5160118206D4EAFC47136B527EC1593F9ACA475A75F0E4122C2EDEFD9ACC81F6904AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622955, "uuid": "42c46166-9d5c-48d9-877a-c0dc9cb78e34", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622955, "uuid": "1a5aefee-bf01-4b1e-9fff-a72207791dcd", "value": "49152:txMtVj/RmVUi6tdSh/MWYGDwW29JROeYDFEgIQ8gMxYH5B/bMAHJMzikB60xz9oI:txOEIIPeJROP8gMM5RHKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622955, "uuid": "0886bf56-a838-4f9d-963b-84f762ca04c8", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622955, "uuid": "9e14d9ac-1b49-4f27-a5ab-c3075a25afc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622955, "uuid": "12ba1776-c574-4973-a940-c4635b1d1b3b", "value": "717023eadb491537ed25b75638fa808f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c9fee5-1c02-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688650760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650760, "uuid": "85fd6299-4220-4840-9b36-409b16ec5cae", "comment": "Malware payload (RedLineStealer)", "value": "1a4e1d404eeb8a9e458ebbc3477b59d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650760, "uuid": "74284207-46a2-42a5-8a51-795aafe6df7e", "comment": "Malware payload (RedLineStealer)", "value": "5304ac5e1ab8c0981fa569f23362d1147c3d1d583e634101ff80bdd58bd1dd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650760, "uuid": "16ee8138-025f-451a-b4d5-a1f70782c16e", "comment": "Malware payload (RedLineStealer)", "value": "fb2bcdf971ea9d1547a05b5be12457265cfbfb28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650760, "uuid": "91059305-3ce0-4a87-8dd2-b8c1834e8cd3", "comment": "Malware payload (RedLineStealer)", "value": "9bad376e00061880e81a3c61e8a76ed12cd8ebbded3e792c9893073fdf6c7d9998122cdcebc12f579da2d230e59f8343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650760, "uuid": "3d6af95e-bdcc-495b-af60-72d7a679d143", "value": "T159B401333960A953F09AC931A57645C0FBADF7A53B7282DAB52DD03A6F572C1D334228", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650760, "uuid": "20352167-c280-4b57-b50c-b49dbba71aeb", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650760, "uuid": "cc060d28-90eb-46b7-a7b7-92093f28e14a", "value": "12288:EicCTCfvZaRdnQgqtgBzs3TLINDJmebH7AiY:EicCTIvZ82gqtSzsDLITmebH7FY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650760, "uuid": "ba5ac3ef-04ba-4a51-a2f5-ec76b0ffea6b", "value": 525128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650760, "uuid": "38c99846-483a-45df-9f6b-db123297ffbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650760, "uuid": "ddc96f37-2299-4e3f-b41c-148012573d9e", "value": "1a4e1d404eeb8a9e458ebbc3477b59d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5467cd47-1c2d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688669151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669151, "uuid": "650e365a-fcda-4e83-a72f-38eecd3754ec", "comment": "Malware payload", "value": "e3e9a47cb7e04b3aefc0de2e3a20c42d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669151, "uuid": "afbb6302-0614-4525-a55c-38e2fbbfc44a", "comment": "Malware payload", "value": "531d938d5cf67f05b6bedf7dc9783335bfb98cf1612638811ff902398ab3fe7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669151, "uuid": "9954dd3f-2393-4726-ab11-d4900fbf86f2", "comment": "Malware payload", "value": "0d2b5f89a422f0ff27ef46ee7b12f70b1437f49a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688669151, "uuid": "9d82b9c3-cb21-4e1b-8550-9feed5ca0bb0", "comment": "Malware payload", "value": "fde6b5b4f20c05b5faff3a0d8bef6a12f1e5db921686f1c20e1917455e0726cfaa868700de0dcf720b9869990a6470a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669151, "uuid": "0d92b3a8-06fe-43d3-8cbc-f89e1ec9354d", "value": "T133D4E00076F39B92E1B983F639B5104017F9325A69BDD21C4DC7A0FE9976F045AA3B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669151, "uuid": "b89e41d2-2206-4eff-86f8-15fe0e6197a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669151, "uuid": "399ccee0-5961-4b83-a41a-492fd7720372", "value": "12288:2dYIXIE+7fmddcQmCjMknaSgN2HjLViJDxDqDSV8OvJi0rHxr:w4E+7fKSQmUgN2RiltqDSVhi0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688669151, "uuid": "0cd5e0b8-4951-44e0-bebe-1d9e4ffbafc2", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688669151, "uuid": "371c4a49-0385-4aec-affe-8f324ac8effd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688669151, "uuid": "75e4c976-2b57-4d42-9f33-6e82919a80f4", "value": "Payment Advice 06-07-2023 SKMBT03783930229080488904003docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52d9c49-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624269, "uuid": "d330bdd2-7540-4f16-aa5e-0829546e351f", "comment": "Malware payload (RedLineStealer)", "value": "e14f4cbd1a73a7d45354359b1d24c793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624269, "uuid": "00ef62ec-b523-4e80-8a62-5fda21f8d319", "comment": "Malware payload (RedLineStealer)", "value": "532d22ea7125595af97a213932acaaa318c078dadd5e0fe73921b925df506112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624269, "uuid": "ec6f73b5-834d-4a42-9b77-7e100bbbc7b2", "comment": "Malware payload (RedLineStealer)", "value": "b6929d2810e065ff8eb302677b7fd04a721070e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624269, "uuid": "8156777f-316b-442d-882a-e82d064b711a", "comment": "Malware payload (RedLineStealer)", "value": "f5965628e7914c735bf0428ac39f44ef1a5542f3170f9a77f4fd82c8fba957ead71784ed0153be10d844e7393395f02c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624269, "uuid": "8538591a-a67e-4927-ac81-6f3af73eda21", "value": "T103060111654C8E6FE139387A77DC4817FA2D9474DB080D4521C62CEFC89DE83FAA6A9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624269, "uuid": "820449c1-7ba4-4100-bb69-46c0b314581a", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624269, "uuid": "a88c4b27-08ca-49d6-949c-af9ef984e355", "value": "49152:UHzP2u7zzJSSDrLwMgPA2ljBzMraXFGMrtKIJHgR2d5d03/MMac2CEWQq6ilrQzJ:KPnr6FblWE0EYP5eCgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624269, "uuid": "72705eb5-8323-4ccd-832b-230f82d1b904", "value": 3763528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624269, "uuid": "7e980a13-00ec-4546-ac68-00bbcc271c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624269, "uuid": "2312ca08-ebf2-4922-aa60-9427bd025652", "value": "e14f4cbd1a73a7d45354359b1d24c793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3433d253-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622711, "uuid": "c9def619-041a-44c7-9038-bc887d43dc02", "comment": "Malware payload (RedLineStealer)", "value": "3fc77ff83654b435b566e0df9dab22b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622711, "uuid": "de5b7deb-1bca-4545-9d46-db845c290c9b", "comment": "Malware payload (RedLineStealer)", "value": "53859a6b8deed95c141a8864bce57aab648899d07c7efe3c6b595a53649d946d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622711, "uuid": "e75d14f4-70e8-4045-83c1-9ab755f00329", "comment": "Malware payload (RedLineStealer)", "value": "b30f1a6c9a6ee6ef0082ba57b5e9c97c231615a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622711, "uuid": "b09c980b-423d-4983-91f0-60e98cd0c5eb", "comment": "Malware payload (RedLineStealer)", "value": "d60f35f8126bcb77b7e27637d330e4c17147e38379c18f4f3d96f95d907c0bdc56aa8795e79c16e4546cde8a5113d4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622711, "uuid": "7ecb5c90-046d-4221-8216-561ed4452c74", "value": "T122160119606E6E5FD43434B12BEC0453F9ADA8712B1B4D1126C2ECEFD8ADD81F6A18DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622711, "uuid": "b49c8945-998d-48e6-b409-d6566aed89cb", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622711, "uuid": "78851bd3-d232-4fca-8ea6-e610b81d6e1e", "value": "49152:XHHlCUyURleKTtZHltOlzRvfFguEqIM2Dn7i+RazX9D3F1h5YNzBQ2fcJ7+Etq5V:XHKZ1tnXauFJAzB/X/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622711, "uuid": "547bd431-478b-407d-a42c-1a6ee35912ec", "value": 4056904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622711, "uuid": "26498317-bdfb-4cbd-9fdf-1de33820e1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622711, "uuid": "725cabc4-1d8c-4e08-9cdc-2ba452568138", "value": "3fc77ff83654b435b566e0df9dab22b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04d7949-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648313, "uuid": "30f1b42f-cccd-47d2-899b-9ba7af4350d5", "comment": "Malware payload", "value": "53856c38f70c7d6ea9d1b65f734e4fcb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648313, "uuid": "06824e72-3a0a-4253-a741-aa0b30022928", "comment": "Malware payload", "value": "544ceec37ce3c6b670b6ea8b94e4869ea768c4e55ce23d726c1797bb8605f92b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648313, "uuid": "66a336b8-a56c-456e-a38c-01ba153eb622", "comment": "Malware payload", "value": "64709091d1f6c6c287d8676320e24da386e30c7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648313, "uuid": "d46dede7-ab26-49f5-a58d-be330c870dc8", "comment": "Malware payload", "value": "cc21431a1a66892215e9df9c707412ac21220eb03e0e14752ef661bcd442186f3a8c4162f08dc4745ea3d20704f85910", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648313, "uuid": "4e75a93f-c40b-499a-b363-fa5731301c00", "value": "T15883D8C2EE53BDF7D6C3EBF492EBE22855F298051B660645F7D99DB0C61B8C83009258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648313, "uuid": "29b02cfb-9e66-4b84-a35e-0d2b346d77db", "value": "1536:e7PCFKtwuTJvYHJDwMkdDYYh75fWEdwb6kQstJDduxId97RnW705cGDfIYqfn:erC7uTJEJDwMkdDYJECb6kQs3DYCdz52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648313, "uuid": "de6a3f58-1413-4354-be55-02029c4d5a86", "value": 87361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648313, "uuid": "9c5a0fb7-1e03-46ad-92ab-b9e90d6baa64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648313, "uuid": "43136edd-e9ec-498e-84b1-33ea037e48d3", "value": "i686-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2a737f-1c02-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688650754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650754, "uuid": "0c9a13af-51d5-4ff3-8ce7-6e1bf3792cae", "comment": "Malware payload (AgentTesla)", "value": "051f2b0aebbc24f9bfae6338c7954a0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650754, "uuid": "dff7acbc-7344-404f-ad49-740b7b3ab276", "comment": "Malware payload (AgentTesla)", "value": "545bbec8b0437ac615923ad6c91885555a239596aa3d531674acd2b05122b9f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650754, "uuid": "5a1c9658-1868-4a89-8521-407b7800d355", "comment": "Malware payload (AgentTesla)", "value": "53a7948d63167f5f32a4f925754ebc97b88fb44b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650754, "uuid": "7f0f68fb-cc05-4fce-980e-09ef943b67c1", "comment": "Malware payload (AgentTesla)", "value": "e98fc561a4ed47573c76adeea8957d69169c285be96be555b0a3991a9a85290a282cab3e72fcfad05549d23311a21222", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650754, "uuid": "da89510d-894d-426c-b820-07bae6c349b4", "value": "T1D2D44A3C18BC7623D174E6F68F9CC421F650956B3D61CE3769D3989A061EA0229C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650754, "uuid": "4438899e-ddd2-49db-81db-2dd483ee037c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650754, "uuid": "38d28cce-e4dd-428e-86ce-5a18ef67605e", "value": "12288:m7UvjnTVyGAYi0D06r4gHbbVB2j4IRcMZ7QnM4ICR3K:pLnR2YZD06HbbVUjtcKOMgR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650754, "uuid": "3d5c42ef-6f9f-4c23-97d4-4c5020a05e88", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650754, "uuid": "979a85c2-7e60-4dfc-803a-3765c225845d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650754, "uuid": "90f19585-1e5a-48ec-879a-c7322d6b3d18", "value": "ppo_opp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2401cf-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623449, "uuid": "9c93b43c-2c17-43e5-89f5-2f85b490c5a8", "comment": "Malware payload (RedLineStealer)", "value": "a1991ec39e1dea86e3b84c55ed284acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623449, "uuid": "ba30e0b2-1544-4ab8-8a42-5d6e287e25ac", "comment": "Malware payload (RedLineStealer)", "value": "54fbefea5bb9b08518c01318027147447a30aefb0638f1a0cf7ad27de3513ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623449, "uuid": "766c4435-fcce-4570-8be8-af7891eda446", "comment": "Malware payload (RedLineStealer)", "value": "01aed472faf2a39065298f1e87e3a79383414d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623449, "uuid": "90a65233-339c-4ee2-b209-511ce3c1c8da", "comment": "Malware payload (RedLineStealer)", "value": "5239a00069ee54799dbfc7cb68237378d47dd3f858fbdeee08c7ed3123e7a3bec2a2dbb212f8b68a85f291866e3bba02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623449, "uuid": "4b8ae6fc-b33a-41c0-95df-e7971ce27dd7", "value": "T14C55BD05E09D1D5CC572E7B2BADC23223EAC8474291DA13952E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623449, "uuid": "bf37d113-3a24-4200-98fa-90052bf1c709", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623449, "uuid": "01012441-9e7b-46cb-b845-2a7f367fa11b", "value": "24576:pQjP2YH2PjXBzAgNUYzXHpzqedjKV+hBgme7SIj2wTt:pEP78bBcgNUYzXpzZdK+f/t22wTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623449, "uuid": "d2737379-2ad3-4f26-bdc1-cba5fa0b19f5", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623449, "uuid": "57c1f675-49d8-4f63-abfe-53e67c092a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623449, "uuid": "ce11857c-6f7f-4e1a-94fb-ba446ef9639e", "value": "a1991ec39e1dea86e3b84c55ed284acb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6279c67-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1688636700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636700, "uuid": "7168d6a4-e107-4b04-be7c-a9a585ae6207", "comment": "Malware payload (IcedID)", "value": "b5eefa42e9420f917adbb140c8e7c6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636700, "uuid": "d88124f4-145a-4993-b8cb-f5d88aca1a12", "comment": "Malware payload (IcedID)", "value": "552cea111b332fe80b91a0c0dec1ea82ed7718d2a004fb07613f8a2626644bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636700, "uuid": "da642d55-8bc0-49ec-8d30-4b880fbc4a50", "comment": "Malware payload (IcedID)", "value": "21c09cb69a5dfb143b5f914c03fab0cc14f84a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636700, "uuid": "ca06857d-1205-4581-9b11-69b9276234b2", "comment": "Malware payload (IcedID)", "value": "f972fb7540dbaafd20775c0633d466c2e37fa1bf381787f599f3430ef16f84e97c1a8418f977408b3ceb2b3cd0c6d633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636700, "uuid": "c5e604b1-b292-47c2-be49-6f5e1a6ac471", "value": "T133056B87E1E310ECC66BC1B14757A673FA32BC198124797B5794DB703E06F60A62CB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636700, "uuid": "e016bfde-5ab1-4e76-bd06-487559b58d86", "value": "fcd69661d52485330c4a65d12b66db6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636700, "uuid": "5f62d3e2-8794-4cc5-b918-567e0bfbe710", "value": "24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9LF3N3:WF+uTsAx0tlpidvdkxF3N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636700, "uuid": "5a5dd18b-c620-4d45-bccd-1a4398430e6d", "value": 845210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636700, "uuid": "75e76c87-77f4-497f-862d-f03bfd01f0a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636700, "uuid": "6d1d6b3e-b4de-4024-89ff-47f76ee92de0", "value": "955501.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1a912c-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624201, "uuid": "51632a21-c16d-42e5-bd8d-6be95bccd201", "comment": "Malware payload (RedLineStealer)", "value": "8e6bcd28990615c177ff120be9eeb2f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624201, "uuid": "17e26360-c2cf-4c82-a09f-ff8601960d81", "comment": "Malware payload (RedLineStealer)", "value": "5569c83ce875804bda21272a98fd2f9ca2074c1fb97d7becc3b8996d543300dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624201, "uuid": "cb1b7f22-2b5d-4a57-b124-23ec0bf7b299", "comment": "Malware payload (RedLineStealer)", "value": "437708d6fae19ab59a9ef21bceaf233936f6182b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624201, "uuid": "c2a2f129-f2e7-4c61-ac95-da4379e17bfd", "comment": "Malware payload (RedLineStealer)", "value": "8816f9878b4ab6619dafee26b9cd3137ad6bd9635366d5c93948f12a4cd691e4180f0edeefae5ebd8309a74fef184155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624201, "uuid": "88665aba-b9da-499c-ae86-9a445188cdc0", "value": "T10455BD05A09D1D5CC671E7B2BADC23523EAC84742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624201, "uuid": "9580d151-7f6b-433c-a9d6-e7ad2b0f1229", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624201, "uuid": "8d0bbfce-9862-4491-95dd-a42f8dcf121b", "value": "12288:z66ZZF+94P3ezcZ+whkMkqEt5+6Jili5RAjfrYwlth2rDBXWNN/HVUBnFUHXOtrJ:OwaPgfU5G/fYuTORU/133iRrsgUP9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624201, "uuid": "f63a5ad8-27e0-4e4c-81fe-f9428268f600", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624201, "uuid": "3585c548-66aa-40b2-a7ac-bbfad60f7ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624201, "uuid": "3180da52-4821-4cbc-91a5-a1062de73ba2", "value": "8e6bcd28990615c177ff120be9eeb2f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928ddb80-1bf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643485, "uuid": "2dffbc3b-ebb7-4012-a2f9-be854d9dbd93", "comment": "Malware payload (AgentTesla)", "value": "2dcb70ad4134e6a894926c80379b5dab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643485, "uuid": "85c31677-57d8-4c69-974e-96399bf540f0", "comment": "Malware payload (AgentTesla)", "value": "55f3d17f0bab350032e410b1641d63ee3e4a83a87201c1f66f415b71ada380e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643485, "uuid": "752a616d-938d-4432-9320-fe487cf07de2", "comment": "Malware payload (AgentTesla)", "value": "dd6cacde9996c3f293de94251b4700a7556d7ba5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643485, "uuid": "5c33f666-91b1-44e5-aa49-c69a59988379", "comment": "Malware payload (AgentTesla)", "value": "4dba2dd56847ff04d899eb94e841c8b5132dd37271545704bd123137c3de35e3469fa93f71992cafd87db279d18a6f94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643485, "uuid": "e5821c0b-102b-4881-a915-35c7ec164536", "value": "T10305026D07FB462DD52B3FBC4D1402B2D3E69A997127C6078FABA8E8EF177150950283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643485, "uuid": "4b588a27-8d26-478d-a586-dbeaa41444d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643485, "uuid": "42cef6cd-a9ca-4df1-bff9-3736b8d6b691", "value": "24576:v0biRoSErVxIE5Crv/VbsGYdzTNuPkNof2qW2w2xtw:vy4oRrjIwCrv/BsGOKlf2qW2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643485, "uuid": "85790738-c77f-44e9-a41c-23bb369ba264", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643485, "uuid": "da33c8a2-8559-4c2c-a116-55db09884a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643485, "uuid": "9de2b3fc-d7cc-4708-99d2-03eccc770d36", "value": "55f3d17f0bab350032e410b1641d63ee3e4a83a87201c1f66f415b71ada380e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea838a7-1c4c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688682589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688682589, "uuid": "239058d4-3cfc-4259-99df-aa72af337561", "comment": "Malware payload", "value": "bd7b6ff355488e6ccaf36c43e9ab1dea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688682589, "uuid": "b87e5b65-8d7e-412e-baa6-24fd029380bc", "comment": "Malware payload", "value": "55fea65117efeb4fabcf7caf4ff6c2277ba0cf0d8fac8468d1cc3e4e317bfec2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688682589, "uuid": "6f3994a8-5d56-41c2-9bc2-81c09bf456b8", "comment": "Malware payload", "value": "146f3b203316be225ba9921da419308c2a8a25d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688682589, "uuid": "84c4dc91-5b45-4e3c-b0d9-ad2aa2cef1ec", "comment": "Malware payload", "value": "5aa82a41f7b40b087896506d58845a4de7a68dc444b04ff6e196f7e9f52fbde8e8b00cc4b7b17e1807dbbe91a116120d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688682589, "uuid": "28d2bb03-381b-4406-bf0b-1b05449d493e", "value": "T1BD939D1339D0E072D49BC870A0B4DAE16F7DF1522BA15187375DE27B1F227D0633A2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688682589, "uuid": "7c2ff92c-4c83-44d6-aefc-c0dd304a217a", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688682589, "uuid": "e1afda95-e3ab-4e82-b991-ba9dba89a78b", "value": "1536:+vPI/CI7W3vWOZsn/tkYN21pYu5GpydopBaX7qQwH7Pxs:uIaIyBs/Vmmu5Gpy6BaXejxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688682589, "uuid": "820b31ed-fc7b-411f-bae9-fe5517a18205", "value": 96072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688682589, "uuid": "ff66e44d-8bc1-455e-a268-22c605201da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688682589, "uuid": "c34bcf8b-5984-476e-819f-0804bafcf565", "value": "bd7b6ff355488e6ccaf36c43e9ab1dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2806984-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688643109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643109, "uuid": "f3e1f902-7593-4f98-83de-d287abb1d293", "comment": "Malware payload (GuLoader)", "value": "81a1f6dd8065f9be6072fdb5f1badaa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643109, "uuid": "9ccb4208-6d37-4f55-a3a7-8ab19bce9406", "comment": "Malware payload (GuLoader)", "value": "56e3bde06c00384a76ba0c230480c664630df17fd3a1d5a1bda0574d26618c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643109, "uuid": "e8be5435-4821-4e9b-b0a8-f686c91dae13", "comment": "Malware payload (GuLoader)", "value": "87f58e753835e921ba298e9c78c36d71b95f9352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643109, "uuid": "d2655fac-b914-48cf-bdd7-f2ba3992785b", "comment": "Malware payload (GuLoader)", "value": "1b5a14175833bdd212c64343416888ed3a53bde737a61cfdbcdd3bbfe384a62a346bc989856b1af2ed86d5730e1c1193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643109, "uuid": "e46b1310-2535-4ee8-9139-eebe3c65f756", "value": "T14FF302117BF9C867E9638B751E768B168BE1A2261434875F53405BDC3932E12CF0EBB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643109, "uuid": "c4ec15cb-5e19-4c82-976a-8b05fbd96a3e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643109, "uuid": "21cff8b9-cb8d-4f25-b1b3-05932f3cea18", "value": "3072:EAe+3aJpgWXTBuWbhm700zojz+gUE3z4u8QwaN87/eM/u9nUj2dq8toIjB:XB+pgUzE700zwD3cueaN8KHnUjWlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643109, "uuid": "ed07fd2a-2086-4b3a-8e49-8295fb72b01d", "value": 160527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643109, "uuid": "a324f3be-b45f-4e82-ace7-4a79f9bfb838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643109, "uuid": "a535ae5e-3b52-43f0-a588-b6aeecbb961b", "value": "56e3bde06c00384a76ba0c230480c664630df17fd3a1d5a1bda0574d26618c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0aa019-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688622400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622400, "uuid": "d165c378-2417-464e-8c30-b726cc207062", "comment": "Malware payload (Formbook)", "value": "af9ba7b780c8267b84ee53d2a79b88c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622400, "uuid": "ba141518-b45e-4619-a26f-950f8a5b6e4c", "comment": "Malware payload (Formbook)", "value": "56ed3fa85ad9bce9ba0d066676ea2386d9774f51bd341789e278a9dc9fa9256a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622400, "uuid": "033333e2-03bc-4e3c-8434-bf292b734b40", "comment": "Malware payload (Formbook)", "value": "1eb1ba5b76e41663e167a98ddebaa53948a544f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622400, "uuid": "2c3dc079-377c-4b5d-b8dc-420b9743bf57", "comment": "Malware payload (Formbook)", "value": "68d1109a8492eb59f2cd51906bc20ccc1439455309c6178f0e0c9e59d077df28861cc2e8f04f615d11522fdbbff3fa1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622400, "uuid": "1bbb9f8d-f1fb-467b-a5e3-56668890a02c", "value": "T1C98412C9DAB88967D497833284BACA612EB48DBA344497074710FA6D7DF23D2840F777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622400, "uuid": "331f67f7-49c0-4059-bcf6-416ffa0a2918", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622400, "uuid": "01791d51-96a9-4df3-850c-4eb9c4515722", "value": "6144:wYa6Tdn5RszxewFY32dM2+0b/jMVFShQUHNqetQmb9m5Q++Iepvi04fG5KLJ:wYpdn5WJpdnbyeHUCQS9T+BeM9Gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622400, "uuid": "8f12f447-fcee-4788-80c1-d198fb60ee8d", "value": 385086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622400, "uuid": "350b86d2-23a9-4484-9b7b-50b779caf72a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622400, "uuid": "453cf67d-bc55-44bb-a80a-b4e764f2c3af", "value": "PRODUCT LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b38632-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623648, "uuid": "2d8f5b41-604f-469b-8037-be06721370c9", "comment": "Malware payload (RedLineStealer)", "value": "9b90f636d0dd41338d49b84d0002f336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623648, "uuid": "637d184e-9b81-434b-bef8-ae46aa2f8812", "comment": "Malware payload (RedLineStealer)", "value": "5719ba56603278b9ea19563bc311336e9f39e8250b1b9b8ba60cae8671b849b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623648, "uuid": "6a6028a6-3f01-446d-9b92-05a0dc25b9c9", "comment": "Malware payload (RedLineStealer)", "value": "90e70223d79dee14c2c016ea212a2bb731fbc945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623648, "uuid": "eb6ccae1-0346-478e-98e5-8324ed3fb023", "comment": "Malware payload (RedLineStealer)", "value": "c8d3efcae181aeba05b773d93891dee91cde2f1dba1af08d241f2c54a498c7adf1fd5de420b4c92ddf1e0d0c35fcca0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623648, "uuid": "790d638f-f060-40b3-9dde-d22f01a07aa6", "value": "T1C855AD05E09D1D5CC671E3B2BADC23523DAC85742A1DA13952E21DEFA5F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623648, "uuid": "9db226b5-3c46-44f3-a3c4-d3899d332531", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623648, "uuid": "3dd92d57-778b-4bb5-8d73-4e3277b54909", "value": "12288:D6apZF+94P3ezcZ+whkMkqEt5+6Jili5RAjfrYwlth2rDBXWNN/HVUBnFUHXOtrL:+AaPgfU5G/fYuTORU/133iRrsgUP9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623648, "uuid": "770cd81f-0b47-49d0-8a49-e1130e8ea042", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623648, "uuid": "f150908c-013e-4c95-a524-42ccf89f9e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623648, "uuid": "9898ac36-d745-4f00-bc3f-a367eb92ae6a", "value": "9b90f636d0dd41338d49b84d0002f336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc170c83-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Triusor)", "timestamp": 1688645756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645756, "uuid": "90b30b20-9e9c-4b0c-ad6e-c5ffa101fc5d", "comment": "Malware payload (Triusor)", "value": "35d57db4b32cff32f16ad7afe069c4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645756, "uuid": "ee97b02c-b04f-4420-9c4f-98d61820267f", "comment": "Malware payload (Triusor)", "value": "575201d1dfb5eb4f04c06f3381057d3b1d65b9842d3c2ec883c8be5ecf9e054f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645756, "uuid": "17703ecd-2818-4978-a0e6-8aee37cc2868", "comment": "Malware payload (Triusor)", "value": "39ca379e9f9c1279ab904b70ceeff99dbfe05d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645756, "uuid": "f92a3856-db7c-4f78-b2b0-a0ab6c2eddb2", "comment": "Malware payload (Triusor)", "value": "5c91943499262be998f565898f6c1b86c5b10dbb0366a14655c159198498cf5f00697e8118a5ba33e5912347da7f3926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645756, "uuid": "737cbe6a-5443-475c-9dd2-e9a31a23eacb", "value": "T126A48D11B9918032C17378344679E2721DBEB9311E31568F63DE0EB96F740D1AB2AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645756, "uuid": "b52e52d9-412a-41d3-bdfc-21dc224a03d6", "value": "fe240f7686d6f4c6f7be28b1fc58af59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645756, "uuid": "bd16bdd9-3dd1-495a-834b-8da6161ff562", "value": "12288:L5NaIk7nsp5pahQ2hkhsYvCpJZ2u4TsgUd/:L5lB2hkhfvCpf2fTfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645756, "uuid": "a81e0621-78c6-49c3-8ace-abf4c936eb7e", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645756, "uuid": "7a079f5d-b172-4080-87eb-35fa1e85b1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645756, "uuid": "bec549af-4be7-4f53-92a2-d6de0d64fd60", "value": "575201d1dfb5eb4f04c06f3381057d3b1d65b9842d3c2ec883c8be5ecf9e054f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc81b0d-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688652361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652361, "uuid": "5646df9e-caa1-485b-ba67-a63f7f6e65ed", "comment": "Malware payload (AsyncRAT)", "value": "6947d4fb2e21dab65519bf3ca0a0b1cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652361, "uuid": "eb4ffd13-1227-427d-9930-45445f6637d5", "comment": "Malware payload (AsyncRAT)", "value": "5858eb19366d99c81ec9364f2a8cf5542403765b4d7b7acb9a0279f4e55b8937", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652361, "uuid": "96b737e9-1a3a-460d-8066-7fe660f00995", "comment": "Malware payload (AsyncRAT)", "value": "22cc3ea27c89a1e63be6f271e049684e7fe6abd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652361, "uuid": "8c291aef-2626-40f5-ad95-585403f14eca", "comment": "Malware payload (AsyncRAT)", "value": "b588a46b1c5c63e38d59d3c6c70be49f2186782093f8784c501f69d4163ba5da98f7f70f831624aee5f5b181e83a7aeb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652361, "uuid": "29d00664-9462-478f-afe2-6935d713058d", "value": "T1C636E743F49F0A9ED4A237794C4B2325623CFC26DAA67A5F5716D3243CA39C46B19F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652361, "uuid": "6909f428-0587-4bf0-a66b-298d8e3cc6b5", "value": "77b15ecd8e584dc77fc9e421a3ea6e0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652361, "uuid": "11bbb471-b3f2-45b2-a879-5655a8b71644", "value": "49152:m9TUg5Hd4/py9PH4lDIBMT1gP8Gos9JC//6u+RUl8Pud+9kY+BihNnymbtabi3TU:QFYlwMuAbE3TnidZ91hhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652361, "uuid": "5db44919-d0af-497d-bd05-2f6ef2a8f665", "value": 4913807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652361, "uuid": "207778cb-0bc9-4c92-a56c-f1bc7d35c3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652361, "uuid": "0755b044-1e8a-4d8b-87cb-9a52469339da", "value": "DEAD16D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1933172c-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624384, "uuid": "6b5c0eab-51eb-4515-bd65-935e0359bed1", "comment": "Malware payload (RedLineStealer)", "value": "cf12fd25cf136abdc5f5660a844abb27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624384, "uuid": "6dd029fb-4301-4f14-b628-489d8ce19722", "comment": "Malware payload (RedLineStealer)", "value": "58c8a8754cb9df785bb0eca28e699b5780e8255284b3f52faf230d8f600d00c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624384, "uuid": "ac525833-e463-446f-96b3-abc8e29ccd69", "comment": "Malware payload (RedLineStealer)", "value": "a105d9c658cc944fe49a47a9fc61d8275c52e81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624384, "uuid": "0cb1579b-05fe-486d-9152-d99dfc9ac77c", "comment": "Malware payload (RedLineStealer)", "value": "991804cc2dbcd12a7218668e0822e4e02cf1cc10c7477658aade034cf5b08b59883023ecfe0704aa2e3f3880c7680b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624384, "uuid": "c0622e21-b958-4af3-a8dd-59ebed12056f", "value": "T1C716015AA06C4D5FD67138752BEC1943FAADA474271F4E0022C2EDDFD8ACD80F691A9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624384, "uuid": "9a0cda0a-8696-4d42-a244-3b22a33a5f8c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624384, "uuid": "4c47fcd3-2c14-4d7f-8fa9-e4381f416308", "value": "49152:X32gyY6F96PceZ2lrtWAtkr9g9/eh3PttImcwPf3MWH2kqSmqlvQyyIFC0hkXo5O:n7hyafcJclGIFGAKqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624384, "uuid": "77c0519e-e003-474c-a7d6-63644cf28fbf", "value": 4089160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624384, "uuid": "b9cfa070-5c02-4478-be5f-983fccccf639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624384, "uuid": "cb7d4b32-84f7-4068-bfd7-a4aa7deafece", "value": "58c8a8754cb9df785bb0eca28e699b5780e8255284b3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6230e4-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620466, "uuid": "cae9a6f7-b976-407a-936c-9d248f8c9426", "comment": "Malware payload (Mirai)", "value": "757c7124821af1151914f309467ef411", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620466, "uuid": "7de6684d-60ad-400e-9686-08892dd2c7b8", "comment": "Malware payload (Mirai)", "value": "58d79bac2940675b4cf281a3f0fc64ec1e5d501bbf6032093fa81aaa1c7f15c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620466, "uuid": "b8aeb08b-679a-410f-a957-b1e967bdd875", "comment": "Malware payload (Mirai)", "value": "5cfea7531b7bb419c961c0aea0c4cecbb7d6715c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620466, "uuid": "bb9ad7cf-fb1b-46a1-b666-78651ff72a05", "comment": "Malware payload (Mirai)", "value": "ffa1f97801e100deffe8ed38f79a5825f97103eb3982e343e54684956694b3cbbc05653f44915962c6e4086c9cfd5158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620466, "uuid": "c59f4f38-f246-41e8-9ac0-e25ebc8b3a52", "value": "T1014467256926E726D0A6EFB8DFF67A91435CF2830F868243E1AC904D0EF459D241FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620466, "uuid": "14be6378-d8da-4d72-8091-8d6b521b57fd", "value": "6144:7mDlNBCa8bpo2w1wpU3wGnICrCqxEZwo5smy:7mDlvQUAGICrCqxEZwo5jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620466, "uuid": "ec78788d-d217-49d6-abd4-85a26b1ce83c", "value": 257774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620466, "uuid": "b5166c89-f579-4c27-8a41-e1c756671bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620466, "uuid": "adf19c51-4ad4-40e6-ac5a-c7b053c9e5f1", "value": "757c7124821af1151914f309467ef411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3068d2-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688622375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622375, "uuid": "2e1b1baa-aa94-4365-89f4-44af5e167a27", "comment": "Malware payload (Loki)", "value": "9918a3899c2682851d23d07e10a7153e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622375, "uuid": "7585ba87-f65a-4f4b-a100-7d052cdc8295", "comment": "Malware payload (Loki)", "value": "5919ae288790c1f2e0f81d6016f5f6c037738b9887d0dacfd259cac766d8e882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622375, "uuid": "5f11c46a-6df6-4eea-89c3-cd8108f8771a", "comment": "Malware payload (Loki)", "value": "b2b4dfec7c439253abf2ded7ad4e5befcdc41a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622375, "uuid": "a0ef48c7-1e62-4d1c-a1d6-e868e886196d", "comment": "Malware payload (Loki)", "value": "379d5baf27f3f1b15f5cfe2a6af5b2feafcd08e866ca0b3fbcea1195e92906189420148babd4d8e5134ffccd6b9104e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622375, "uuid": "9cc17422-084f-4522-9cec-2c87cb989cb5", "value": "T1AB064B93B64794E1F4471B3AC99AB82C0371F4D366D3F91926CE23148E47B762A49E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622375, "uuid": "04c85ede-46d4-4bc4-8e35-2350327569b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622375, "uuid": "6ab0ac91-bb8a-47ac-99fb-534ac8f775b1", "value": "24576:c12J/ToakWT1kuSWUpP53m0Q4fAGkqWJvc111kTFdSegrgJYuepHYUtVsJ6nPbQ8:82poaCuCpx20Q4fAGkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622375, "uuid": "df3a22cb-dcc2-4c5c-8396-a2ca7915c5ea", "value": 3745792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622375, "uuid": "976b9055-4e8f-4d84-a829-12e57b55f383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622375, "uuid": "985f3493-4da3-4043-af08-123e94bd21a9", "value": "PTT-20230706-WA25016pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d0b296-1c08-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688653468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653468, "uuid": "e0eaa9d6-4ad1-4563-b99a-1dc07b995cd3", "comment": "Malware payload (RedLineStealer)", "value": "3021734efa42f59032100c15c671c8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653468, "uuid": "632dfe6b-6ec9-44f5-88d8-b6722b3c1f51", "comment": "Malware payload (RedLineStealer)", "value": "591b57b2cef9609e249dab874491010f1a85ccea9795ca609dcb1b314c37b1fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653468, "uuid": "b752b300-6a21-4d6b-b49e-6b63f9dfcf99", "comment": "Malware payload (RedLineStealer)", "value": "097ce7e69451aa7c90290d26d755bfc0f11cd108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653468, "uuid": "d4c5b218-aee2-43ba-b920-fef5c0689823", "comment": "Malware payload (RedLineStealer)", "value": "7d7665d82f8e594291da7bc6242e2096ed8753d3001a11357ad9929d44465986841920965156653259f2a299b17a5818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653468, "uuid": "41609424-2a96-4fa1-b15e-8af9799cb69e", "value": "T1DDB402333A70D963E4C9DA309AB615D0FB7AF3993A764187726CE03A6F472D1D324219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653468, "uuid": "f90b2d42-d7b5-43d9-8423-bbd048df8898", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653468, "uuid": "24b27a8d-a620-442e-83b7-028d6f6f5e4b", "value": "12288:Gkuz0fvlaRdnQgrN/9GpWao4CQnGITXW1Kg/Ci:Gkuavl82gTGpWn4rnlqQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688653468, "uuid": "23834b4b-5d02-4a85-8079-b7d55a8db404", "value": 513352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688653468, "uuid": "13b4ad5f-2b39-4384-9723-72b977603380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653468, "uuid": "a25008dc-86e6-4d57-a1d4-864e76500a95", "value": "3021734efa42f59032100c15c671c8a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a24bd7-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678633, "uuid": "0fc202fb-aa60-4cc8-8780-a9e187b27665", "comment": "Malware payload (Mirai)", "value": "e7df6adb83343d11c878e34807e99a22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678633, "uuid": "48eddc41-4bd2-491e-8b36-186300b88003", "comment": "Malware payload (Mirai)", "value": "592424484e898530a361f4c90ac0358464d3a1027b204e40fbbe87f4716309f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678633, "uuid": "cc4eae56-505c-4bba-9ec2-012d38a8fed8", "comment": "Malware payload (Mirai)", "value": "25bf80594e35d7ee621acd150785d6c4a569cf74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678633, "uuid": "dc716411-43f4-449b-822e-2152a0fe5aa9", "comment": "Malware payload (Mirai)", "value": "2ec2f7340772ab43cd64eb81f549aee2a5a7ecceeda7c729f79a9e6e44a3a9bc75e3cd3984a597ce062bbfc48e183b89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678633, "uuid": "4318b0b6-6702-4ab5-b69a-cbe10d296cdd", "value": "T102C309C29D537D33C2C29BB5FADBD14837E35A24939B3301A5986FB04B4BACD0E29255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678633, "uuid": "7be070f6-b2b2-4395-8c13-619b85101485", "value": "1536:Ikn1vPt9rPenhBLoLksxQZaaAgOcRddwi56MP6WgZ5SUYnifGC+XHLn/IndBFTgy:5PvrPevckIaN6MP6WgZQU9fGfnMLFTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678633, "uuid": "8fd73ac3-cf8f-417a-83fe-913292241569", "value": 123657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678633, "uuid": "3f50fe2b-1f17-4e3e-85d2-9143806b6141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678633, "uuid": "6c987926-cd56-4c5b-9e73-10a4128b3979", "value": "armv6l-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15031bb0-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622659, "uuid": "f7fbcc57-983e-4614-9451-8c3c66b33732", "comment": "Malware payload (RedLineStealer)", "value": "50a12223328a85f653755fb7269f9a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622659, "uuid": "cb253e37-6d5f-4863-9172-e77a44cfcb83", "comment": "Malware payload (RedLineStealer)", "value": "594f74519a4d890197f7530bbf873cdb794ce55063ef600c99a85a218431e782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622659, "uuid": "8153ab01-3736-471b-8338-02d9bb0a36bb", "comment": "Malware payload (RedLineStealer)", "value": "3fc2546923d81ce4235636a680a2ed5d2200fac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622659, "uuid": "a56af8be-437b-46f4-b117-0adc14bc7f69", "comment": "Malware payload (RedLineStealer)", "value": "995d2620893e3ae87e27c77698330ecf54f90a4211178550615e72878c58c35a9bf1d221c168b4c3079657d1c7eb7df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622659, "uuid": "889569f1-0cae-4cd8-a5b8-34eb244f2816", "value": "T1FE160159616D5E9FC47034B527EC1983FDACA874A70B0E0121C2EDEFD8ACD81F690A9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622659, "uuid": "49f073d1-18da-4beb-9565-4586e5a07fd0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622659, "uuid": "554eabd4-b575-4b67-a2c1-75fe857598dd", "value": "49152:pmTJ+96wQMXE/Zj71214V40ymjf0bclf9+7xO4SxIrLo8qXNjjBT+0sT3J0QV6aj:4YEDRYQfxJ9jjyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622659, "uuid": "2d87507e-6ff7-45ec-8028-d38014b3e0ab", "value": 4074824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622659, "uuid": "4bd6cdd1-d27b-4204-a502-209ff0031fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622659, "uuid": "cd231d8f-bc8f-454f-9f42-38f44e1ed51d", "value": "50a12223328a85f653755fb7269f9a42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8b676c-1bef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688642639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642639, "uuid": "a09ad134-784c-492f-a300-c6aef682f665", "comment": "Malware payload (AgentTesla)", "value": "d901f2a5005511ace68e0adb46c08029", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642639, "uuid": "a1eceff0-49dd-4d93-941c-3732ad4cae0c", "comment": "Malware payload (AgentTesla)", "value": "59e807e212b01f766205224ccf77609b9953cfa0423f0b506f0743ce5cd6aa51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642639, "uuid": "ad6aaedb-90e7-4f85-8145-4544a0e7365b", "comment": "Malware payload (AgentTesla)", "value": "9b6af83e66f809709153010127e4886067679ba4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642639, "uuid": "7f1aaa87-0f65-4432-b313-e088e5f18302", "comment": "Malware payload (AgentTesla)", "value": "30de4b475a24ce81e001f286bada6a9de47a8f8633042006d1dd7366d837378435be1ed3f67676a3aa4337dcc6fee1bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642639, "uuid": "7317d1ec-b660-4e60-b462-a31a7901572b", "value": "T1C6F4026823E7515ECEAE7FBC1C650A78CAF5A9463113C2875ED7385EEC68F468A00353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642639, "uuid": "dbb4bb83-928b-449a-9d0e-42b7b3504c5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642639, "uuid": "3e7ba846-9c5c-4cf6-9a34-4439a637afa1", "value": "12288:Cd6L7PV6fFiwbhaDnLMzIL2q+RTdOL8pO1jj2h56d8zS+EXF1bCd+6tD+MrhVKRr:QOyqGUL8Ut236ShEXF1bC/Fj26nxLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642639, "uuid": "7d200905-83bd-4062-8546-cdc1bccd2bac", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642639, "uuid": "b9847298-1244-4589-abe0-6a2b66190d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642639, "uuid": "944e8686-0162-4a4f-9d48-6e4185368d6b", "value": "59e807e212b01f766205224ccf77609b9953cfa0423f0b506f0743ce5cd6aa51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8421303-1bd4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1688631173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631173, "uuid": "ca7b6264-954e-4cb8-a279-a7b0fe894403", "comment": "Malware payload (IcedID)", "value": "9e360d1872f3cc9fe40b0ab7467dd9e8", "object_relation": "md5", "Tag": [ { "name": "2738000827", "colour": "#173F77", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631173, "uuid": "59c3bf18-0991-4ebb-a7cf-a3802214f5cb", "comment": "Malware payload (IcedID)", "value": "59eae7e55775a390cd710598128c8eca3e83809ed561b433e5471961d0ec999f", "object_relation": "sha256", "Tag": [ { "name": "2738000827", "colour": "#173F77", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631173, "uuid": "bcdaf14c-7d94-43cf-8558-4a92eb127b4b", "comment": "Malware payload (IcedID)", "value": "afb2f675020d1de318cd89dff49d19b7dd1a6499", "object_relation": "sha1", "Tag": [ { "name": "2738000827", "colour": "#173F77", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631173, "uuid": "dc7a6c9c-379b-4c60-bd50-ac5c96f2a650", "comment": "Malware payload (IcedID)", "value": "cb6b0b59a3fda6a20d9566d245db21a7238351015378924e3ce11024f0745bee1ea5a420e6b3c8fe81e5cac20185024d", "object_relation": "sha3-384", "Tag": [ { "name": "2738000827", "colour": "#173F77", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631173, "uuid": "e13ce9c9-a52e-42c9-9403-8695823d955b", "value": "T119F4A7C223FBFD420817537A335526F9993ECA55D98A94CCF4467D58F0ECE06BA982C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631173, "uuid": "9beaf628-8768-425c-80ed-e01af2cdd3b0", "value": "12288:gdfaPoG0EfEbaHkcC6eB18YMfeu7N2TcxWiAQBBwuuALemLoXtfXfNC2oRrQ9Vuk:gdYoG0Ef8aJveB18YMWwN2TUWiAQBBdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631173, "uuid": "f778db0f-a6ab-4254-b24d-3151d09ccbd4", "value": 785622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631173, "uuid": "2cbcc92e-f45b-4833-8559-2470c059ae23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631173, "uuid": "15561578-c112-4061-9bed-285e0aeb0c7c", "value": "Document#002184.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3800e087-1bf2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643763, "uuid": "8bae77bf-c13f-4f84-840e-a0387b1475ac", "comment": "Malware payload (AgentTesla)", "value": "b34b56439817ce4bab3920d45a3eb5c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643763, "uuid": "388e9b7b-e272-4479-b881-495d8b68288a", "comment": "Malware payload (AgentTesla)", "value": "5a81fead2a1183f46fb263e0104e31681ca90f4d295c11af386cd3015cc80a4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643763, "uuid": "be02bf70-1587-4892-b6ff-5edb19473471", "comment": "Malware payload (AgentTesla)", "value": "e8b67985741b66dd16a897786e12df8e3c7d67d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643763, "uuid": "a6192e9e-d854-4ed7-9064-223b2447e9d5", "comment": "Malware payload (AgentTesla)", "value": "c74762a10ca65bad473f9cee1195f3007c92043d5a8f6b01dad42c9cfa7e560b343eb54887f8856ddd88e024e3a4d470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643763, "uuid": "efe220f1-e3c3-4d2f-99c5-e197db6f053c", "value": "T14505122907FB051ED85B2FBC5D2002B2D3FE599A7427D6178EAB69C8AF2771409847C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643763, "uuid": "99844a4c-07fe-443c-a024-616e5b0cacd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643763, "uuid": "d5285647-edfb-44a2-b07d-e87cb2bd0b95", "value": "12288:DDfIECB8fTkRVdiRobaFErwRgxIE5sgQN65+V8OMLnrCrYHnYAE1Rp0TkGtL:Pfz0biRoSErVxIE5XZcV8O4GrYHW0IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643763, "uuid": "9d4deedc-51db-4bde-8e32-731ae054577e", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643763, "uuid": "c80a72e8-7a83-478b-84ab-c9f3e1e554a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643763, "uuid": "fea6855d-bf45-455f-b97e-2f7bac3b65bb", "value": "5a81fead2a1183f46fb263e0104e31681ca90f4d295c11af386cd3015cc80a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e6a0b8-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661628, "uuid": "c16b8011-8912-4b49-85fd-f7f704a7d25d", "comment": "Malware payload", "value": "c4794418f4f9af91ea4a8c222e3bd352", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661628, "uuid": "31cc809d-16e0-49f3-8067-6bde7eb68202", "comment": "Malware payload", "value": "5a9dba0fc2a6d0a2e9cbac0bc774059d329d36c8308ac05882146a8362374fd5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661628, "uuid": "baec0629-7217-40ee-86c4-efa0789497a9", "comment": "Malware payload", "value": "48d40ae68eafa9388bb061371982c725a853b52b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661628, "uuid": "3bef863e-26bf-4fcc-a70f-4b93dceda434", "comment": "Malware payload", "value": "764fca2dbfb81b4d9afc348e38daa10a848f344739a36180bc9cb69e48df3855205e01f6f51fa1ccac42dfb719d397e6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661628, "uuid": "d2d423b4-3cd5-4b75-9f5d-eeb541787d9a", "value": "T104D3F4ACD78A58E18F8957B363075D4812BD327EFB8510A8304DA7B537EEE3845188BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661628, "uuid": "1ca75e89-80ba-4abf-a017-f451dd4842b7", "value": "3072:kSYgia6rls1Pnx5rM/WJEZk2skcTpz1Bxnei:+c55rM/629cTpzzUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661628, "uuid": "4768a3f2-1830-4107-9546-9804dfc529f3", "value": 134806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661628, "uuid": "1d0a30e3-4225-46fd-a7b5-bde81dcb37b9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661628, "uuid": "2851d6f2-805d-4e7b-9b07-c0b66f00500c", "value": "SWIFT Giden mesaj bildirimi - 9.000,00 USD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60016171-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624502, "uuid": "de44f510-9078-46f6-bf44-57c7581c6a01", "comment": "Malware payload (RedLineStealer)", "value": "e397e50f66f22212b8621feb12a7e908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624502, "uuid": "1d51c4f2-cb16-4281-855a-0bf58792d22c", "comment": "Malware payload (RedLineStealer)", "value": "5ab32eb68420541327c1fabed0fa4ab9a58486752f67c1fa40a5a82e99b87f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624502, "uuid": "9970a416-967d-4d53-9ce9-fbe7846d7bf3", "comment": "Malware payload (RedLineStealer)", "value": "cfd13195def55c4bc9cc32e8794dcf62068927b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624502, "uuid": "70e5fbc9-2c48-449f-b070-fd0d3eafe4a1", "comment": "Malware payload (RedLineStealer)", "value": "631abffcc0420bc81dc1d06e99a4b760cb6037dc28c7c357af19ab6bb5be51f627f3e21ec34dcd989c9130bf35777aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624502, "uuid": "d05ca240-913a-4254-90c8-1815cc163bc2", "value": "T1A4060102248C6E6FE53A397567DC0583FC6C5474EB0A0D4522C6AEEFC99DE43F6A249C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624502, "uuid": "ad793c92-8421-456e-abb3-8498ed81690d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624502, "uuid": "b3a9a573-61ec-4254-a25c-87985e947de4", "value": "49152:BJDa9tTr/R2cJftzzSFkmpAKEsNzIK8qhQWoqTx35phg9C8U5ADySZqMLh8P+Ck9:4SFHphzCDUCYahxAPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624502, "uuid": "61caed4f-837e-4017-b5d6-02104cb900b9", "value": 3791688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624502, "uuid": "0f75b80c-60b0-4998-9a9a-164fc90248a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624502, "uuid": "e133c5f3-16ab-447e-97b0-d0bc89617fde", "value": "e397e50f66f22212b8621feb12a7e908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1240a86-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623833, "uuid": "184efbb2-e242-4021-ac1d-021e1cfa145c", "comment": "Malware payload (RedLineStealer)", "value": "8395609a6f1b5de607108ab07a28b2e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623833, "uuid": "d05aa9dd-3552-4bb1-b711-e62f60f520a0", "comment": "Malware payload (RedLineStealer)", "value": "5ab540c46aa189db7fbdb6320eaee1c8975dab0f557c339ba80a38a65d06ab4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623833, "uuid": "e1211327-c6fb-4427-bbda-acb82c9afbc2", "comment": "Malware payload (RedLineStealer)", "value": "d391a6d6e838703cdbf2987c1d4ac6c42c375507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623833, "uuid": "969c51dd-2a36-4e5e-ba46-078097d74787", "comment": "Malware payload (RedLineStealer)", "value": "d19a4f50a2904a73f16e02576db6051a4634db7920e3fc120dce823b2d6998a8027a8945aa4b8a2e30f6207aab80fbd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623833, "uuid": "8e5804ab-4856-4f9e-99ef-b25407709a7a", "value": "T147160029506E9EAFD47434B12BDC1993F9ACA831671F0E1122C2EDEFD4ACD81F69548C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623833, "uuid": "4fb89795-cc7e-4835-981e-4e3fd4293f14", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623833, "uuid": "caf570b5-641f-4326-9769-74450716e664", "value": "49152:diGf8hwCqihJ/J6QHR/mDD+Wga/Rlh6MsuUrI2fF9LuhzhoJ5oxoCU9jc2v0JgRr:F0TJtoTh5HcGOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623833, "uuid": "6cfca48c-a563-4e9b-a2d4-f6e41f5bcd34", "value": 4060488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623833, "uuid": "a10c1055-59fa-40cf-af2f-82a02c9600a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623833, "uuid": "a642034b-2e2b-491f-8b5c-db4a3a0860a2", "value": "8395609a6f1b5de607108ab07a28b2e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e7c7ec-1bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1688635627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635627, "uuid": "1fd73402-660b-4cdc-8547-9fe647fbb86e", "comment": "Malware payload (DarkCloud)", "value": "7bb6ca7a5fbe72d9cc102c78c648d848", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635627, "uuid": "e07e3442-e800-4a0f-93f5-491c05db5647", "comment": "Malware payload (DarkCloud)", "value": "5b1f95c9a78b31202741bf940fbec2c5d820fe8b8ff1ba74f3d5a0cb532ba26a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635627, "uuid": "08f746e6-98b1-47e6-aabc-fec450911864", "comment": "Malware payload (DarkCloud)", "value": "5aa9b0e5225d08deab7697d030bdd65cadbfd590", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635627, "uuid": "a63b01e0-bfdd-4690-bd4b-fb862aaed1e9", "comment": "Malware payload (DarkCloud)", "value": "20fa9d350c6419bfb5556e271487ef1a16abe0b311687850dbf4d8ee8ee53196d571411fe397e1e5719be522a677e33b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635627, "uuid": "4d518824-c167-42a9-811f-a7268d82ab19", "value": "T1BD0533973734A6E72F839FF3E46250C9A57F7240CE9F4486B6ABD4211FA29148401B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635627, "uuid": "344549ec-8e46-4596-8b68-deb86f4fa79c", "value": "12288:+rTSup4qjOEO9jDPL5lrp4zZJTZpeDi8XHa8HwSpDZMfUua2ShEZgfEpBeE6:+HSup4q+DPN74LvEi8XaanN+tbZgf7E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688635627, "uuid": "9bd10a86-e684-4ae0-b414-4964edf6b8af", "value": 824336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688635627, "uuid": "61350bb9-aead-42cc-9954-296d1524676b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635627, "uuid": "66d82588-f794-402c-befc-8008cd18eb87", "value": "PO Hortech srl .rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652e6eb6-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661448, "uuid": "f1389748-56b2-42b0-ae1f-7b6a777d3a45", "comment": "Malware payload", "value": "b6bd074fb634b96031612f50685849f2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661448, "uuid": "d69d62a4-509c-4ce3-9fb7-70dde591d879", "comment": "Malware payload", "value": "5b9c11d13a4248d503ccb0f9838e24d7893c4439c6c03891a9462d91ebc066cc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661448, "uuid": "b58b34da-21a6-4a39-9269-72dcb60cf5d9", "comment": "Malware payload", "value": "61f4715dface3ab8d454d4c95a963273dc51be76", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661448, "uuid": "25cbef37-280c-4307-b976-39fb22051ea4", "comment": "Malware payload", "value": "0c59b3565d177e8cc028116305846434b8ef28faf1914d965a634cfb2f58daa10b0baab057b4fe66edce1ca187324ab2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661448, "uuid": "0a5cadf8-2192-4d4b-a7af-d48a0112a330", "value": "T133329E101B7C1622F026E161EFD8FDE41A6770AFDBC7299CA395E7110F29366DF864A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661448, "uuid": "68efd112-ee60-448d-8221-799a764a8225", "value": "192:fDugE89aENkjAI4TlUbrRi1uPjRKNS1zqdQtNBF3eNfBUq4Bht7Hk4JjlgSL1DIy:fK78b4h4T2bQYrRRaclODUqqDH/HgSLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661448, "uuid": "c78d2462-53ad-425b-be4d-f8f63473a92b", "value": 11439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661448, "uuid": "ed12c170-e91e-4f30-93bc-85302225df71", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661448, "uuid": "b4552f7b-e5ea-4e37-9b8a-f3a9ac484711", "value": "Order PO-REF67340982.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56af6679-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622339, "uuid": "0d863119-ff73-4aef-a611-f9f199c7dfe4", "comment": "Malware payload (RedLineStealer)", "value": "0ba6681e2328ba904ec9a55362f12c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622339, "uuid": "2885858b-5d69-4ab3-85db-8a0807447cc2", "comment": "Malware payload (RedLineStealer)", "value": "5c25795356b265ab3301a9b291942e319948532970a63103f0ea5cf940de988f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622339, "uuid": "807db0bc-d7c8-4ad0-934a-2b5d8127a87a", "comment": "Malware payload (RedLineStealer)", "value": "147919285dd2a1c074a4fa23f15aeb6241f4da56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622339, "uuid": "3c08f176-667f-4281-a316-59b65830a62d", "comment": "Malware payload (RedLineStealer)", "value": "583e379c8a25d1ad54441f67b6ca952cd6cec6ba6704c75316cd6b4a6ec6b4e8c62187c51d53f0fdffe922a62dc01cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622339, "uuid": "37468d0b-a6e2-48bd-a0fa-596744945dee", "value": "T1C2060102648C9E1FE13A357573DC085BF96CA474DB1A0D4562D62CEFD88DE83F2A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622339, "uuid": "1dc5b157-8527-40d5-ae97-c3c9a7bf6feb", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622339, "uuid": "d5b33fd3-a7a5-4425-9a29-1f04df9c0b28", "value": "49152:M5bowDQGJrHiQIUGA86vGe6efSkiwza82GAT0WW4dSmoKTdh7j0zVL3h/N13gYe4:40mKkiWMTns05h1rtn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622339, "uuid": "92cac6c0-5a2c-4e35-9778-2f47b727409e", "value": 3755848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622339, "uuid": "2949b3e7-7aa1-4466-91b7-628b7da0bec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622339, "uuid": "c49c0532-df40-45fb-9dff-cecf90ecf4d8", "value": "0ba6681e2328ba904ec9a55362f12c2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67aa05d5-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1688622368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622368, "uuid": "f13a3250-9dd2-49ba-8bcb-9386b25ec6f1", "comment": "Malware payload (DarkCloud)", "value": "c22802f9eae4def8b6586b70ef1ca8b5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622368, "uuid": "c6db74e3-e61b-48c9-8aaf-c75f75e84a16", "comment": "Malware payload (DarkCloud)", "value": "5c2f77ce4a869075caec54297208317d3d5c274f8a732f698be0fc51cb81ae6e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622368, "uuid": "680b86d3-71c2-4dd9-b4ea-0e7cb250e628", "comment": "Malware payload (DarkCloud)", "value": "b3ddba1e56d6301dbb0442789af9add618dd6822", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622368, "uuid": "4f41636b-8fb6-4cfe-bf92-3be82843b1b4", "comment": "Malware payload (DarkCloud)", "value": "6611b3d0b04e8cbf88e7d3a6c78afb36ae64d526c2b85db7f76199e352a358139018d6e6d763a3e57b91f9e7b4fc0173", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622368, "uuid": "6770f712-9b92-46aa-956d-f7a7f52829fd", "value": "T15D159D3C18BC7223C170E6F68F9CC425F650956B3D65CE3769D2989A461EE0229C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622368, "uuid": "e9624684-b8dd-4f01-815f-e2bba6f227b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622368, "uuid": "a43f2e80-1da2-4d40-a799-ee418c395044", "value": "24576:3DAVBN/hXwDI61LRU509Jt8R64POjoqDCmIm+Mpo:zAjLl61LRUvg4VMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622368, "uuid": "90acbb21-55cb-4252-b7ce-64b305ba330e", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622368, "uuid": "e4bcdae3-441d-479b-9cc4-137e4845afdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622368, "uuid": "fbbbc4d8-3fd7-426b-a256-8a1a2b82b9a4", "value": "PO Hortech srl .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6b9e39-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623907, "uuid": "140a1c89-30b3-4b04-9a5e-dbb68eed57dc", "comment": "Malware payload (RedLineStealer)", "value": "a526acd18299b8959a660ad70ab45acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623907, "uuid": "7c71ffbd-7fc1-4798-93c9-24349b6c6cb7", "comment": "Malware payload (RedLineStealer)", "value": "5c30f8ef14364338b6ae9ebe416f1c650eed9c40d514d66d40bf5ca5dc6090a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623907, "uuid": "842080be-f131-484e-8977-4deecd5b0ff6", "comment": "Malware payload (RedLineStealer)", "value": "47f6a54e7a7cb3eb72605763d16680dc49157e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623907, "uuid": "45d3ca12-5427-40ad-a0aa-e38dd2c0764c", "comment": "Malware payload (RedLineStealer)", "value": "c80451e9e86923eaf5588e4f025de462a2a004a5044be495ebda9e4aad63d474003f72d1ed119f57f0f3ef54fdb77601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623907, "uuid": "461310f5-6a77-4758-b26c-de3b24aa0dcb", "value": "T1DF35D010B5D1C472D572117708A4EBBA5A3DF9310B6599EFB3D40EAECF302C1A731A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623907, "uuid": "c867a40a-a24c-4f49-aad8-a5cdafb34920", "value": "cba2b01ef63841504879f03f82c47db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623907, "uuid": "5f4e1e42-2b24-439b-8771-faa9623d3132", "value": "12288:6Mra6wNZ0m4DXC19mwjRA844sZ/FLMyf:6MzwLTGXCXH284HLMyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623907, "uuid": "d802ddd1-4cdc-4ec4-bcfd-a290f381ce58", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623907, "uuid": "9b2abcca-10e8-41bc-98e9-73c075f78943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623907, "uuid": "ca2fb666-cadf-4378-ae6f-811ebb691389", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211944b2-1c1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661763, "uuid": "8cfa0486-e377-4de1-9642-cfeb0a9c9ac4", "comment": "Malware payload", "value": "2b68216ee5968e369ce45b1ec0b3b3ce", "object_relation": "md5", "Tag": [ { "name": "Destruction", "colour": "#F9B9B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDissolution", "colour": "#DB0332", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661763, "uuid": "9ad211b0-ac55-447a-b12a-d5fb2583eef8", "comment": "Malware payload", "value": "5c5a614e7fd08e67dcb2d584f6877c682e9e17d291c7e4ccdb07e7afd6b5f277", "object_relation": "sha256", "Tag": [ { "name": "Destruction", "colour": "#F9B9B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDissolution", "colour": "#DB0332", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661763, "uuid": "f1f6e5a7-3ca0-408c-bde0-2b31a16153cb", "comment": "Malware payload", "value": "42b5256606a08880d19e9435af980f13cd8ae860", "object_relation": "sha1", "Tag": [ { "name": "Destruction", "colour": "#F9B9B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDissolution", "colour": "#DB0332", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661763, "uuid": "18730c41-8f88-46d8-98b2-1a69ba7ca1b6", "comment": "Malware payload", "value": "b16b37306f6f73d4f7076819c8a1ad3081a759aecde1645aea84da2f26fca6bed50b2ab9d6e797949fde786986e7a2bc", "object_relation": "sha3-384", "Tag": [ { "name": "Destruction", "colour": "#F9B9B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDissolution", "colour": "#DB0332", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661763, "uuid": "08bd626a-e444-44f0-88aa-cf033976ffdf", "value": "T1B725E1647B8C556EDCAA897EC0C3A5FA0A32EC37AB47D783B9C4765C25367C70402A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661763, "uuid": "3d92c350-9e29-448f-b05a-5272b9ee8dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661763, "uuid": "c79ec6c0-612f-4d6b-b2d4-491311d20ae6", "value": "6144:m0ZlWl+BJ8Ek54Aal5v4uuDDsDEMGKn93s:m2zkuE/DQgp63s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661763, "uuid": "d20f0b6b-62e7-4725-87de-08cc1ec7e8ed", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661763, "uuid": "3284e4df-2df3-488d-ba06-5d5054ffb69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661763, "uuid": "efb36371-aa34-4bfb-a423-46e0a0e05b45", "value": "DestructionGame7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8869b7-1bca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688626568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626568, "uuid": "a46a42bc-99b2-455c-8f6f-b3809d189294", "comment": "Malware payload (AgentTesla)", "value": "ac4a73027d59d729b5d27abdc457a9b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626568, "uuid": "69c26d82-b1be-440a-8373-aea6c0a9228a", "comment": "Malware payload (AgentTesla)", "value": "5c61d2a5fa3c8ca792b3f92718de1b6e21df1237c8fae6db4a2604cb30e26dc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626568, "uuid": "5d57291f-ec00-4944-9b11-2f1b711968e6", "comment": "Malware payload (AgentTesla)", "value": "9337a161a27be70ca12e30dcf2cbed4b30010d01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626568, "uuid": "d6aad5e7-bed6-46ab-aaf1-123005ec69c1", "comment": "Malware payload (AgentTesla)", "value": "4890ebab6ea3c30913bbcc05f8caf263fe35b3bb0721e4406e641c3003585df95b711ef2d35cdab300b6de69f2e8a33e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626568, "uuid": "32d7d540-b499-4fd0-bfa7-9796aa9e5e78", "value": "T182C42364A50FEA92D40F9908F9E31EC6BF976CCD82434F20E65C444E9429FB74DAE067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626568, "uuid": "8343303c-3925-459b-8127-1aae7730dbbc", "value": "12288:mpRXvwrcWNQaAwQSy8ERxpvqqTyF5Ryo87dF6FMZJbyVNSX1w:mbwIWgwHyPLdqMKaRdF6MZJuVNSFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626568, "uuid": "a3b11ddb-44d2-4260-9ce5-5659855ed08d", "value": 548291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626568, "uuid": "6f2a680f-1fa2-4453-9996-27b6c007fbca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626568, "uuid": "18ead302-d95c-4c27-84dd-611c44afb1cc", "value": "STATEMENT OF ACCOUNT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c351fff9-1bde-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688635406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635406, "uuid": "cc609a79-aef1-4ad9-977a-7928c84cb231", "comment": "Malware payload (AgentTesla)", "value": "56bbfb88c1760d8a6e94333580aac7a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635406, "uuid": "86934f20-d84e-4f8f-8137-01eea8068d10", "comment": "Malware payload (AgentTesla)", "value": "5d58cb6b96d6f3d62752e1526a3f7459b38a9a4b9dc73b31ac74e15e23b3127e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635406, "uuid": "62c4d8bf-8a05-489c-abfd-eb679e950601", "comment": "Malware payload (AgentTesla)", "value": "c76ad884f553ff036ad56065de0c82d9a9bf0607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635406, "uuid": "f16925a6-deda-43a9-87d3-af6f89e7799d", "comment": "Malware payload (AgentTesla)", "value": "6a269dee0534cd5cb42f0d07320daae303cd7bbc1a2be272a3def5593a45eece1f8d5b783a9c310d6eadd5b454215b99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635406, "uuid": "00863571-d2f8-46be-ad38-c6c01743f7a1", "value": "T1B4B423874A7418CC49A75198E7CE379B947A7EC075E8835CE007CA56DE9AF1848E3B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635406, "uuid": "392e54f5-771f-44db-b0a4-607cf664b2d3", "value": "12288:kj6FnVC4s3XmsaOPmYEQIJiEaOXvw1nryXRQjaQrhvaukkHsi7z:kgw4w2sNmL7fwdriRQ7rhWkHsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688635406, "uuid": "c74011a4-6786-41a8-bae2-dc32aa82d1ee", "value": 534472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688635406, "uuid": "a4504f8e-a4ab-4872-aaed-65d7573b2e09", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635406, "uuid": "4ee3b997-a98b-49f5-9657-582291bff376", "value": "bank Slip SOA 2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dbd7c3-1c03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688651193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651193, "uuid": "2858a8d7-97dc-424a-816e-186d11376baa", "comment": "Malware payload (Loki)", "value": "0ad7d869e1ecca38b1acb443c4511602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651193, "uuid": "3740ead4-0a89-428d-a2b8-9e1e3e3ccdfb", "comment": "Malware payload (Loki)", "value": "5d961d6c0a4a89cced23dd8b7de5adde334379d0bfe1df4aa40c4b16e208e3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651193, "uuid": "1bc5de79-741d-4e2a-b745-2ba98074439c", "comment": "Malware payload (Loki)", "value": "165d6ed8f35c41c3378ff6b06cb8123d1c86aa73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651193, "uuid": "b4edfd47-6d14-42ba-afb6-6e36b67c079c", "comment": "Malware payload (Loki)", "value": "ef8120125760dedbbc365c8a71187616f8980d1d81a1bc49724c4b073a8d06f47c52ecc96aeacce165d476541ed97bd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651193, "uuid": "350a19a5-9cda-4e9f-9415-0de1edf6ad87", "value": "T169E4F10A72B75F2BD43A6BFC0A141171C3F859293033E6561ED369EFAD60F940B90A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651193, "uuid": "6e7594f2-0c16-45a5-b896-a9199333422b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651193, "uuid": "48973b51-310f-4f73-98d0-e5424667adea", "value": "12288:rF2iNyOe42KMu/N3mWhQmwmJCMpUEPKCcGlzfKqRbxyAeiuq3JwhyHUaBTriISC:B1wOV/NOanFf/vihyHTTrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651193, "uuid": "ce629af4-cab1-4346-a3c7-16dcb1ac89cf", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651193, "uuid": "5c287cfb-c09f-4a4c-989e-2c1680d570b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651193, "uuid": "8d63a223-db14-4ca9-826d-30b42aa5a601", "value": "5d961d6c0a4a89cced23dd8b7de5adde334379d0bfe1df4aa40c4b16e208e3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abea43c-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624440, "uuid": "93749ca6-df6a-45b8-ab00-66b148377b87", "comment": "Malware payload (AgentTesla)", "value": "43e3ad606d69b8361a2943ec013c435d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624440, "uuid": "f68399f3-66bd-4d25-af8c-3a024c830122", "comment": "Malware payload (AgentTesla)", "value": "5d9b4040ddbe244b25286a81045c02f81f9ba9995f9583405eb11211ad3554c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624440, "uuid": "4d72172c-787d-4b09-9434-d5038575b2a7", "comment": "Malware payload (AgentTesla)", "value": "ba78e9fc7039d64c302e7fbea19b2b87c829b851", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624440, "uuid": "dc842076-6ea7-4fac-a573-9511352937a8", "comment": "Malware payload (AgentTesla)", "value": "76f003b6f8219f8dadb3bb4505bf69150e37aaab68d433fe954575cfba7a570526945ed4b9719bc2271f8b4a137e438f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624440, "uuid": "2f98b307-8e0b-4560-a31d-5cf9c750b2cc", "value": "T180D324426AFA2008B5B2BF445AB955B54F27B9C96C7DD50E01CC960D4BF3E80CD60BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624440, "uuid": "22a1c2e9-df71-4b94-b4fd-3c382b36e72d", "value": "1536:PPm5FjaXGxbMN75ro6BHB1ZFqvKHNrnXy2u0L3JaKPm5FjaXGxbMN75ro6BHB1ZN:XKQ5xNj5aSKQ5xNj5aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624440, "uuid": "b4f900c2-9a7a-40a5-8076-4ce649f1bbe4", "value": 142228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624440, "uuid": "bd30a807-304d-436b-acbe-cea476cc76d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624440, "uuid": "43ee15a3-ec6c-444b-a689-310621539c9a", "value": "nuevo pedidoO06708..PDF.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af4f2ba-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677000, "uuid": "4e8b6328-b583-4c08-a53a-32175c8b0bcb", "comment": "Malware payload (Mirai)", "value": "b0af17441fae40e45cde8807201bfaa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677000, "uuid": "e809a8ed-7e1a-4b3f-ae6c-b5ba6d86741c", "comment": "Malware payload (Mirai)", "value": "5e0af65a6eaefaaef535bb65d097888ea0606451f0aaee230d22ac981c8de3bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677000, "uuid": "68905dfc-c386-4447-b20b-1c18c077e2fa", "comment": "Malware payload (Mirai)", "value": "9855c526de8dd84cc9f728140de71d6f90db441a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677000, "uuid": "90f0ecb6-0037-41ea-bc3a-d7dc5d03f2d3", "comment": "Malware payload (Mirai)", "value": "c848bcce0a92c425a4f38d83722496cf5f1d2ec8cf97ffc7181b71e2e28e60ba73795f2953e52b1b6a551f420269550c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677000, "uuid": "01ffa7f9-3f93-4205-8e2a-ea96f175719b", "value": "T1F053AFA5C5ADAE68DE504174F614C8398323E008A5A73EF6DA47C7969007EFCF058BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677000, "uuid": "2fbdb1c0-4d59-4c19-8cc1-c076b063c038", "value": "1536:laGlNSkg/Uqh11kYRCpeC1afbV1/QAy4cn8rHCj:lRlNjgcqJoApx1YA7cn8rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677000, "uuid": "92d761b7-7afd-4095-9ecd-16f5718c6548", "value": 64436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677000, "uuid": "72f4107d-4956-44d9-ac52-a478d6d11efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677000, "uuid": "ca0a3832-326e-4a47-bc6f-389b3590ff08", "value": "b0af17441fae40e45cde8807201bfaa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72e7e93-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620434, "uuid": "87940197-5e0f-4e44-84fa-a6fe6e1f9f01", "comment": "Malware payload (Mirai)", "value": "9da5218ba138777e8344441837406fc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620434, "uuid": "ee3fb16a-27b2-4b1c-92ef-43d44592fc11", "comment": "Malware payload (Mirai)", "value": "5efea3f240a1479a0f370cec82f960861810c6de6294d58230692b496a43f259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620434, "uuid": "51a2a5b6-0893-4e8f-b6d9-d2ddc15b2017", "comment": "Malware payload (Mirai)", "value": "b6d12e0506a188a62f43e3a0d89e7b4f5060fb16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620434, "uuid": "c15cd0a4-40a3-4bfd-bd03-674a9c592d6c", "comment": "Malware payload (Mirai)", "value": "53ddfdaa8d9097f45085136135973c48237c491b20d850d9172d353429dd15662877bef11658c1d2fc70dbd089fd2702", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620434, "uuid": "8fc418c1-1ddd-4817-b79d-67c24d7d9f19", "value": "T1AB247321586BE263C4A7FFB8EFE676968369F6474E898203F2E4105D49F5D58201FCC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620434, "uuid": "e70a86ec-dde7-4ab6-92d6-0c990e49f8d9", "value": "3072:rd1WJSr5PDRQ68iSAI8ZUhncUksLcCRYCy5CHkNXKvn5gE:x1HXm6Uk4YC2CHkNXKvn5gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620434, "uuid": "81c5fb71-1fbf-4a52-8360-7e12b0bb5b48", "value": 218244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620434, "uuid": "620376d7-09da-44fa-b0d2-8e1ff8a5f53b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620434, "uuid": "dd62cecc-a14e-4034-b6f7-85ed4ea33ece", "value": "9da5218ba138777e8344441837406fc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a680c6b8-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624191, "uuid": "fcab3cb6-75eb-42c5-9d42-c9b3ededc439", "comment": "Malware payload (RedLineStealer)", "value": "d70e708d956604b0609f2d8f38cf9a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624191, "uuid": "554f5146-8710-4297-ae21-c37e413c085a", "comment": "Malware payload (RedLineStealer)", "value": "5f012ad4ecd9f9afcc262dda16a30156f20bf432d12d98b66f19116d535213a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624191, "uuid": "892b1148-cf9a-4199-a30a-9ee40f644a73", "comment": "Malware payload (RedLineStealer)", "value": "7a2bc1710e7eeebd66991562c28ec59284eba1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624191, "uuid": "2889bfc0-5d19-418b-96e7-c14348df0b85", "comment": "Malware payload (RedLineStealer)", "value": "c6b22e194179cf056d26a2adf62521c07ea1590fc7e039ec14692233c38a34b0b8e99fcaf1614d8321f32575d8d16fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624191, "uuid": "5f1883b4-0e85-441d-8c9d-5b9e43a22d02", "value": "T14755AD05A09D1D5CC671E3B2BADC23523DBC85742A1DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624191, "uuid": "202d0525-cb26-4677-81f2-06e7374be4f1", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624191, "uuid": "aa444e55-b7d8-40c7-85c0-f03bafa4e9ea", "value": "24576:1/x1buwUS/lk5g+OsFK1TpQZRCodm9g02QKGYQkD8:1/7KVS/lySsFSTpQZRCodmG02QdYQkD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624191, "uuid": "ae78fd83-c12e-4a4f-9aa6-7c01f16d8933", "value": 1344333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624191, "uuid": "6a837fd5-0893-464a-b795-5558489cb7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624191, "uuid": "e41d89a4-72c0-4fe4-9c57-b7eb3faff25d", "value": "d70e708d956604b0609f2d8f38cf9a13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8641a1f6-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661503, "uuid": "512f1058-0526-4583-a4b8-7b0da93a8c24", "comment": "Malware payload", "value": "da82434127322b7d4d04889ed9cb68a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661503, "uuid": "a4a45ae2-84f2-4745-b8af-1d9f79c07c26", "comment": "Malware payload", "value": "5f64160e7d65fc38bc4135dc9668dd75cd94d13a1dbae2fe13413a803b968258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661503, "uuid": "34ecf83e-bb09-40b1-adc8-894533fc6d7d", "comment": "Malware payload", "value": "feed2f11e35e543b8172ad22f0075ab502f1c69e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661503, "uuid": "2cc91dae-2368-47d8-aed0-2f698f7d3cac", "comment": "Malware payload", "value": "31083a9f977a56a4b9ece8d7447a2230878fc5a48f7ca382e8c213b83534102620f85b341561b49c732bcdd1da798441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661503, "uuid": "525150c9-4d6b-471f-8923-97c475270e4f", "value": "T1C87412853BE4C855E8D3993094325975EB77EC17FB429A5B0B803C0A3A33ADA55063F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661503, "uuid": "f5b76db2-8200-48f7-8b1d-983440270c09", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661503, "uuid": "3e509588-ae99-4887-9b0e-ae1334c96fb1", "value": "6144:3GC7W7BUGjHePWMK5gxLMh4LyBnFXux9Bh7HJV8hbxA8xDTzlFOw34Fxnc:ta7brePhK4LE48Mfn4lrxjT44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661503, "uuid": "c8ff1e78-413e-46e0-ab05-a914767ec2bf", "value": 338222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661503, "uuid": "19bc2f7f-05ee-4c22-a9a3-3a6e34d9bcb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661503, "uuid": "e224517d-c3ec-4b2e-9357-01a99647efa6", "value": "NEW ORDER#06910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f60b45-1bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688641909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641909, "uuid": "13cbabd3-c3ce-43a0-aeeb-e1b0ede2fcfc", "comment": "Malware payload (Formbook)", "value": "949a56401d66cb35a043a3b89652d7e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641909, "uuid": "21419839-e429-4dcb-82da-a87705055f0e", "comment": "Malware payload (Formbook)", "value": "5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641909, "uuid": "c34c0dea-e71b-44eb-908a-6ef515d2f4c8", "comment": "Malware payload (Formbook)", "value": "72c00d769b8a610ef9e508cdc9caf4c1652b06f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641909, "uuid": "94233741-057e-4fa7-8ac2-cb625a25992c", "comment": "Malware payload (Formbook)", "value": "f27e920b2667e98ddb1dc6dd4db5cd9177ef66d37ab638e7c2b9fbdcd624d6abc8bac1d2edea820bec988876c15a01eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641909, "uuid": "d16af8de-8143-4e6f-b56c-be0ef941019f", "value": "T1C725D0D423214D8BC4803B7C9F82EB389BB45EB56A01D116B6E22D7FBD7DB55AC42312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641909, "uuid": "c5241369-34b9-42bd-97d5-74f18fd904b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641909, "uuid": "6a8087ca-9814-4fef-9109-c92f65b02084", "value": "24576:0OyqGUL8dX6zTwayLvWW79nnv0DPeq+8my:0NqGo8dXKTwlLeW79n7q+8my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641909, "uuid": "8683bb39-ddc1-4432-8214-6a4aff163736", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641909, "uuid": "6b27837d-adbe-40da-abf9-5d794bb8379f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641909, "uuid": "80a67c7f-639c-4d61-86fb-9551838410ff", "value": "5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca4d482-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677030, "uuid": "92d6020e-7265-4e84-81fc-066821a289b1", "comment": "Malware payload (Mirai)", "value": "e40cf39b4f6138d7b2edeaa01034c6a6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677030, "uuid": "a1ea9d8a-44f1-4d9d-b0dd-77e5a51257a0", "comment": "Malware payload (Mirai)", "value": "5fb921a1c5de40b8a1ccc386b15ef2a4b2c104a87649da90522678ef039049bc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677030, "uuid": "df653be6-5b29-432f-9c8b-3dec0624f4ee", "comment": "Malware payload (Mirai)", "value": "9408312972527f1cf287f0e4f503d490e06c9fea", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677030, "uuid": "56318a94-8658-4383-b499-2256b102c772", "comment": "Malware payload (Mirai)", "value": "73499afdd166319d2660252e5921d82ae72c7f5a5c60b1b32a661c67d1efbd4bb36126a804c89a178784c19267cdab79", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677030, "uuid": "f4071925-29ad-4ead-9db1-d769c51f3947", "value": "T194D2D0EB6173F671D0E3EDF024311690E8797522DB1A266F007D2E3F49922E956F0EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677030, "uuid": "bd375775-9252-4717-86e0-eb7a3a4c321f", "value": "768:bYSoXdJZZ2PuiXcX8y6KpYMJg7F+8KSx0se:bYJdJZjiXcMynpAFZNte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677030, "uuid": "46ab27e0-0d6d-422d-81f8-9d59d15bb1ee", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677030, "uuid": "3d67ab47-2a87-4588-9957-cedad685a2b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677030, "uuid": "299739e8-922d-45b5-af2f-b39b6b2b0edf", "value": "e40cf39b4f6138d7b2edeaa01034c6a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08c58e2-1c26-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688666379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688666379, "uuid": "22ae11d3-1684-40bc-9302-bce426d92118", "comment": "Malware payload", "value": "bd72ad59337e7e4eda422f54f5681e09", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688666379, "uuid": "d1fdee64-e771-42b7-9740-874f50526eb7", "comment": "Malware payload", "value": "5fe4002079302b5d0568cd3e1f58f506ef98f57e4004eefd712479c685c73e6b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688666379, "uuid": "b46a6225-0d7c-4658-9c6e-e0565cb0e4ee", "comment": "Malware payload", "value": "d24e866f34e06c429b45d736b57f8e616bc04d1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688666379, "uuid": "72941fe4-08f1-4099-9abf-a9620531104c", "comment": "Malware payload", "value": "d07c82003257f57ac84d9da41c00d8d514823221b06cdff3b4b8a00ce34cc64bf2b6900a55213166a643fc28864ac0c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688666379, "uuid": "7bbfc10a-b43c-42d0-af0f-72bba4d1bcbb", "value": "T199049AD822C6D41757CE1A93BF6A3BED5237A53368CCB24792B47A8C14BC507C2A4DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688666379, "uuid": "e4e26799-1531-4a6b-bcaa-4d9df4681f79", "value": "3072:cofCXwNPscW28/rlA18uBB72E1z8t78xo2s:cofCgtruePP2e4t7x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688666379, "uuid": "1a3921ea-f618-4cb5-9d19-6f5bbaeaa02c", "value": 189922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688666379, "uuid": "97a3243f-614f-4729-823a-887ec2ddd8dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688666379, "uuid": "420f3bb5-e8c5-4753-8951-698744bc5d5a", "value": "Document FXNRuW-9600.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4c1e22-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623929, "uuid": "5456d7ae-a4be-43af-a006-844e176fd5fc", "comment": "Malware payload (Amadey)", "value": "aa9e80416f6cdec303848136e91cb59c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623929, "uuid": "7786bb92-d480-4c80-9d79-49a4c41b919c", "comment": "Malware payload (Amadey)", "value": "5fe4235b3baddacddba761414c601f3345ebac0b3d5e1d6211d1da552063f12c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623929, "uuid": "0c3f1361-1589-4262-b89a-6d25f3b9e10f", "comment": "Malware payload (Amadey)", "value": "de32eb7252ebe57cd43399212a9edb57ea563ddc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623929, "uuid": "ba5398db-c1cc-4abc-8a8a-1afb8313cecf", "comment": "Malware payload (Amadey)", "value": "c145f8cb7c127363b86babafac8d8de5b9c4b0cc6a81eea6eed4b62cea2de64c3bd49d75a13caa9f13ac684101e865f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623929, "uuid": "755154d2-4c44-4706-a0f5-14e2754e90a0", "value": "T163060141245C5E6FE43A397527CC1553F82C9471DB1E0D4A22E1AEEFC99DE83FAA248C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623929, "uuid": "8fada344-3e19-4ec6-83d3-4f6364f08d6c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623929, "uuid": "525116fb-928a-4699-9e69-45cc04a91d1f", "value": "49152:GJDu9tTr/R2cJftzzSFkmpAKh7azsF3szYaCU4Wuvi/L3rFcDw8MoOpli43thQex:jSFH1sku22RcixfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623929, "uuid": "3b834be2-cd75-4014-9d42-f815d173d072", "value": 3791688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623929, "uuid": "cfd2dff9-2ab9-4060-b6e7-ffe05aac4d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623929, "uuid": "f6660c3b-2718-441f-b100-d5219a761cab", "value": "aa9e80416f6cdec303848136e91cb59c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a2419f-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688652615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652615, "uuid": "698f0390-07a8-4e20-b4b2-83367b81aa62", "comment": "Malware payload (AgentTesla)", "value": "1e972b5e1deae36bdd383b3032aef861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652615, "uuid": "0477732d-9e35-4b21-9f2e-b1426b4c2a51", "comment": "Malware payload (AgentTesla)", "value": "6070763bd3942f8cb308e6561170235571b99861e5c1d57ef480c36b85ae9e22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652615, "uuid": "af6ebe2a-c26c-4594-afec-d6129f9079b0", "comment": "Malware payload (AgentTesla)", "value": "71aaa6dd29e837da47f3b8411037f0fd2f380071", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652615, "uuid": "c5aa8e58-e6a9-4cd4-b77f-e4887eae26de", "comment": "Malware payload (AgentTesla)", "value": "d7ba8205dbfd132f49c7993f086a75279c1e1448495a8cb608e5a15dcc3844f2738740a9c97a39d42de83d6746396fd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652615, "uuid": "41805031-91c6-4462-a75b-311a9a14a38a", "value": "T10305021422A4CF1AC43F0BF9495025314776632BF577DB2B0DC2B1FA1A62BD2259BB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652615, "uuid": "7da7eff0-057d-4710-8338-d17a887b8932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652615, "uuid": "eebf5033-db0b-4261-9687-6c009691109b", "value": "12288:YNIgsa2iNx5LbzIu9+r9/LqNDPJli7r5GbHO62EUltQd7av4qmE/WEi/+Xe/d:vNa1j5LA9zwlStCOjpoRagqmPEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652615, "uuid": "a77e5cc2-9195-45b1-b63d-db02b3adf244", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652615, "uuid": "1b0ad42d-2f2e-4b82-a0c1-6c79722b5b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652615, "uuid": "14256338-59b1-4765-b05d-b26991510101", "value": "6070763bd3942f8cb308e6561170235571b99861e5c1d57ef480c36b85ae9e22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8ed2eb-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648305, "uuid": "ac3caf8e-c4c6-4a03-8076-d6aec3157262", "comment": "Malware payload", "value": "141aeffcf6dea09cf0dcfa46cfeefd31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648305, "uuid": "933cd692-6dcf-4f7c-bde3-188b4348e048", "comment": "Malware payload", "value": "60b4c6b15a3481826b46e9450358d7dc4ff34cfd96e72e91fde2cd9bcb5c208b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648305, "uuid": "0be4db9d-b141-42b0-8844-2117d15cd429", "comment": "Malware payload", "value": "ca58d060bd82fb13a4d487f6cb1a78eaa7397b5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648305, "uuid": "fdf5e009-e595-47a0-a75e-13494e0cc3cc", "comment": "Malware payload", "value": "8dc33d7818d9b933319a3d794a5ab731e816198736b28bbf4cc26c2eab16a863907752a3ea9e072da32b52d829882a81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648305, "uuid": "6a22f316-58d6-4c37-b916-58331113d3a4", "value": "T1B7B30887EF523EB7D8CBDFB796F6D60020DE580217A6272274B4DC64A21E8CE14D3568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648305, "uuid": "fa958451-bdac-4cf2-bfa5-176ab83b9556", "value": "3072:SsIWdBtgPpferPJvqfvZ8t4Q8Nx+aG5Fp:XjdBtI+Jvq58t4Q8Nx+V5Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648305, "uuid": "17e51da6-0c3a-4a1b-9b01-a19862231fc7", "value": 113573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648305, "uuid": "78689710-71f2-4be9-8192-0c0cf8501d13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648305, "uuid": "49330b74-8e4d-4e39-b338-8d1b790cf9f1", "value": "mipsel-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c8ef40-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638442, "uuid": "a087de98-e0bc-4555-badd-e404a3da0423", "comment": "Malware payload (RedLineStealer)", "value": "e12119930b5ebd7bec1faf62074df10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638442, "uuid": "a29fc2a1-ec47-4aa4-a355-f4294d559ae4", "comment": "Malware payload (RedLineStealer)", "value": "60b517138c7c67a6306e9bd41898b58db226f5e6a29b83064d27fe479f7b38a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638442, "uuid": "ce83fd8c-eea2-4f95-b8da-b57e3658f9a1", "comment": "Malware payload (RedLineStealer)", "value": "6e0c9c01835e516bc48ca084b5ab011de73aacbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638442, "uuid": "d55762d8-13a0-409d-b851-ca071f3b23e5", "comment": "Malware payload (RedLineStealer)", "value": "7359ad3e63d2a088ef323ed9a88477c6cdff1777246f26557240f9030b7087a89abffbfd41116d806f33b5ba3c25e3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638442, "uuid": "23d24c87-2c56-42c5-9b1d-d0cc838a733f", "value": "T12A160108516E5E9FE57534B42BDC0983F9ACA471675F0E1022C2EDEFD8ACD81F6A188D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638442, "uuid": "52eb6b7f-059d-4f24-8beb-7b20944b195e", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638442, "uuid": "6b68889c-dcc9-4fea-81b6-f0a31be93b84", "value": "49152:zDyOrjcXVG8GbzDsJn0YVC+o6W3QwTynVKFhnAWCN33+1Ah8MNhoq+fqS+l4bO77:HyOjyFGQkoVU1GEQqiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638442, "uuid": "48920063-3e53-4c8b-8b5f-868f87f6463b", "value": 4060488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638442, "uuid": "5df25198-aa21-4b32-b611-a54f2a028b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638442, "uuid": "dd74c5a9-83ab-412f-a7c5-350fdb044758", "value": "60b517138c7c67a6306e9bd41898b58db226f5e6a29b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d89b07-1bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688648884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648884, "uuid": "95053619-692a-48f4-bb73-963e7408d9b0", "comment": "Malware payload (GuLoader)", "value": "aa6798bab6b67adeb9221a7d0ce07c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648884, "uuid": "94c5d261-d1fd-4a95-b4ec-4537b8d60b72", "comment": "Malware payload (GuLoader)", "value": "60f19fd3075165e172d7c02404a0dc6ffc6eb9a8b637427e40ab9c6d6c18aff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648884, "uuid": "a3e325e7-9306-408e-9ea9-295d8f9cce4f", "comment": "Malware payload (GuLoader)", "value": "d684324ee60fe925a1a0e421ed386f09258dbfea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648884, "uuid": "d80c3294-a5d7-4c9c-8d26-71a4339023f2", "comment": "Malware payload (GuLoader)", "value": "9737d6e39ead453abebfb11bc0aa06f09ec81f20f6b92c2d4d7111cdf2be6b22e93cac93ebc7cba2e5eed623608d35aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648884, "uuid": "64931629-6ab2-4ad5-a3a3-57605fc163eb", "value": "T13D741248633AC097ECA286710DFAA7379E78ED156C70870B73E47F2D6D72610821D76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648884, "uuid": "9877e82a-9579-49a7-ab29-581fff1faf73", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648884, "uuid": "a7fa22dd-39ff-411a-a346-a2eb0a38eb22", "value": "6144:8wq3NpOT6IYPjAXG6uA0EuwSZSfFrSs3Y91RfF8JqaZX7JfOnOqBA:8zqTxYEW6B0HtZmFrSV1D8JL1Dqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648884, "uuid": "2a59d3f3-122f-43d2-a4f7-9837eb5cfe8b", "value": 367136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648884, "uuid": "81b559f9-1f94-43f4-bdee-d90ab27c1658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648884, "uuid": "24a75f62-9fde-4a60-9684-cda485c84a16", "value": "60f19fd3075165e172d7c02404a0dc6ffc6eb9a8b637427e40ab9c6d6c18aff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb516a5-1bb9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688619588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619588, "uuid": "cd956d5b-b893-48e5-84fb-810e6f539e14", "comment": "Malware payload (Loki)", "value": "27b71dc0199fb8b28f5639d2e1a71fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619588, "uuid": "25222977-4d9a-431f-a889-147d6ba36656", "comment": "Malware payload (Loki)", "value": "611a803aec6b5689e31f10c210feef21fccbf9843d7224d01a65065f2e93ed26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619588, "uuid": "6328698c-bade-448b-85c2-e63d9cd48ce4", "comment": "Malware payload (Loki)", "value": "f690facdd3f867945db045ed47a0c5fadc95a5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619588, "uuid": "0db4b7bd-365d-41b7-b79a-4f77cac48c0c", "comment": "Malware payload (Loki)", "value": "2f99aed4fbe8bd8258aa76ced2d42dee74cc14f74d3364ad4dde08c1b447623488dc1e0e42afdc19bcb6366f2558f646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619588, "uuid": "c0af5989-0f20-40de-bdd7-26c7de761d60", "value": "T153E46B3C1CBC7623C174F2F68F9CC461F65094AA3E61CE2769D39899461EA0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619588, "uuid": "fc81eb21-f4d0-4e68-bfb6-fe59ea6bddba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619588, "uuid": "7e0c6b9f-dfb4-49af-8535-5f246f9c39c1", "value": "12288:Lzi3jhnjhOpi8974/993+hfqf3PNarcCvhmNt6JF:LzkNnNe9G9PPNWRhmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688619588, "uuid": "ef1c9370-a93a-4586-9979-6d15b2bda3dd", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688619588, "uuid": "eba03a97-b501-4ded-af92-68bc0c59c4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619588, "uuid": "fc7988dc-c8d3-443a-a6bb-fd3dcc3e02ba", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23630.15424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002399b3-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688642810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642810, "uuid": "d9102201-a16c-40e6-b444-b1c71e3dbb5a", "comment": "Malware payload (AgentTesla)", "value": "c9408b0016f6807f51d8c40cfddb15b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642810, "uuid": "4ba97806-380d-4cd5-9054-db1cec6a1d81", "comment": "Malware payload (AgentTesla)", "value": "611dad2e5706b08c8c13bf36b1b343258f4ff4182da5755de5f690d51a84bbb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642810, "uuid": "f24df0f6-9dc9-475d-a469-a88d28054cb3", "comment": "Malware payload (AgentTesla)", "value": "569a57424058a4c1320f2fad76c304e2446d6f1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642810, "uuid": "facd5c1a-b049-45f2-801e-11a52afd6d19", "comment": "Malware payload (AgentTesla)", "value": "af7359086f267c20eb613d01273037e047b41823827edf93c72f97dc439bd47a619b09a68b0d6e8d177781166fdd1cf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642810, "uuid": "cce4c054-86e5-464a-96fc-65093e168c21", "value": "T18C25126933E7515ECDAD7FBD0C5902B9C9F8560A3112D68B8EE3748EEC5CF8A4600663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642810, "uuid": "a7cb31d8-ce06-4094-a65b-2abfb430f8fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642810, "uuid": "2b533152-7e73-4b52-b4fd-f9a83edd860f", "value": "24576:eOyqGUL80ulKkE/mwYV7mzo3hjEGjze6iF:eNqGo80uxGmwqmMj1ze6iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642810, "uuid": "ee1d5c71-341f-444b-b11f-d52d36395585", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642810, "uuid": "bbca77ce-bcfa-4a08-83fe-442184acef51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642810, "uuid": "fea2a7eb-1116-40eb-962d-dadd54507ab3", "value": "611dad2e5706b08c8c13bf36b1b343258f4ff4182da5755de5f690d51a84bbb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dea2c0e-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623613, "uuid": "ba9c5c9d-30f0-4792-a029-fafcf0cecf3a", "comment": "Malware payload (RedLineStealer)", "value": "96572fa46a7250b83e29cef1319821c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623613, "uuid": "6b5fa1c5-e191-4104-9cdd-8bc7d1db48b8", "comment": "Malware payload (RedLineStealer)", "value": "61767fe24458d480459c57604a2032258910a37acb6c50906fb10c39759d636a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623613, "uuid": "9cb29f49-41cb-4d3b-baf0-db974f06f5d7", "comment": "Malware payload (RedLineStealer)", "value": "c48f34dd9b5bf0729249b6b817f58dd90c6f9590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623613, "uuid": "1715849b-03cf-4c81-998c-9eeb7703b963", "comment": "Malware payload (RedLineStealer)", "value": "20ac3b3b1a9b9bec63217ef5fde44e2bef071c78f8593e3c4cb803228f87062598c5e45fe2b922bf8bbb497c73f2fae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623613, "uuid": "e431af51-e0a0-435e-80e0-d99a46a17ed8", "value": "T115060102255C5E6FE03A397537DC0657F86C91B0DB1A0D9522D26CEFC89DE83FAA648C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623613, "uuid": "a3ae8d35-b84a-4673-be0a-32c9531c8b33", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623613, "uuid": "54bcd2da-ebfa-4cb0-83fd-cbd5585f80e7", "value": "49152:jnPO8/F7EZuU7gQ/kvC5JxcRB5V7xI09Jsq15TJJChIR+eIDyGYH5KQ8ZSyRWfZJ:z+QRbV7xIEvaY4qiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623613, "uuid": "ac0adafd-e6ef-4a63-b479-999affc7f1d2", "value": 3784520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623613, "uuid": "268652a3-c4a4-4557-91fb-d39cd641098e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623613, "uuid": "51d633f5-74e1-4c28-a8ce-f4388a2e6f32", "value": "96572fa46a7250b83e29cef1319821c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14c4840-1be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688639322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639322, "uuid": "662e2062-0a6a-47ec-8b8d-0ddabeb7866d", "comment": "Malware payload (Amadey)", "value": "f20eb0954818563d1d16afb64b9b44ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639322, "uuid": "ffa8d856-67b8-4a43-b309-dad58cfa36a8", "comment": "Malware payload (Amadey)", "value": "6206fb794cf52d2cf046fa7e2abbb878f3d86d5c121d00b52a78f7f437d5f087", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639322, "uuid": "076b6d19-2c1f-4269-aac3-2857b12c2bfa", "comment": "Malware payload (Amadey)", "value": "98d2dd04eab106dc951133a850db9d339cdb183d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639322, "uuid": "bfc58b6f-d9cf-4890-8279-efcf530cdb7d", "comment": "Malware payload (Amadey)", "value": "414f900db90f12c51301166edd0215c770e37bd4c5e9bdb510163bd7bf39ba286a8672ceb780120d06af06a459b27b92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639322, "uuid": "a671de5d-b8fa-4120-a960-224ca173cd84", "value": "T1F4060102259D9E6FE03A393537DC0543F86CA174EB1A1D4521D26CEFC98EE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639322, "uuid": "7edbcebe-e949-4959-bf5d-327225f07f75", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639322, "uuid": "a3e37011-b9bb-4f9f-9a46-611c7cb77d88", "value": "49152:Sez5dqfvrTALMGMmMnJhzH86RTchoFlDvbCjUKNMFTH9mJc/A3/Xq4i+qEB9H6OE:6nXkhoFl3b19mJc5nOvnXqQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639322, "uuid": "bdba134e-de2a-45bf-8225-b4f86635cc6c", "value": 3784520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639322, "uuid": "51bae3ff-3730-4a9e-8598-a2e36266b7dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639322, "uuid": "bf29a901-f129-467b-94dc-e1ce9d04c5bb", "value": "6206fb794cf52d2cf046fa7e2abbb878f3d86d5c121d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36150d2-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688648667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648667, "uuid": "e4cb8a34-1d95-4854-ad81-2f94e9b7e9e3", "comment": "Malware payload (RedLineStealer)", "value": "c19f2e7d281c5b754b1878da56cf3388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648667, "uuid": "5950d7ad-b393-4549-aa5b-9ffb810c3956", "comment": "Malware payload (RedLineStealer)", "value": "622f16562811a002395e2139567050430b62bd09ca5cd5967a129f6594e76875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648667, "uuid": "7d1b1146-5819-48fd-a3de-68f9f873b674", "comment": "Malware payload (RedLineStealer)", "value": "2f9e11195673af6d372c693b043b4bc2e577750f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648667, "uuid": "cdb61dad-1e3e-4c73-b4fd-a657a07a649c", "comment": "Malware payload (RedLineStealer)", "value": "dc5e4c2411edbef79c959deec3a6425ad1e12e6b8fd526c0454c2b7dd7127609c768cbcbc9835885873fb0ba53c6b23a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648667, "uuid": "c0764c36-7dbe-4fb3-b341-6d9993d9e56a", "value": "T17816011A606E5E9FD47430B427DC0583F8ADA8752B1F4E4022C6EDEFD9ACD80F69198D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648667, "uuid": "16eea33d-b76b-4487-a427-eb2ae66abaeb", "value": "056ba4e32aea7a3acd31e9441a8c2fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648667, "uuid": "f1ae3c03-1738-405e-bb14-bf44d6247a3a", "value": "49152:MPf6d/CJbWe8HyAletpj3VD5vOrBZbIPVH4rRaq7ShsUi+vQgln0krtzIaK44y8b:MPY819Wh7SHvXVFeyj3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648667, "uuid": "71bfe4d1-d055-40aa-8bcf-40e8d5312258", "value": 4049736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648667, "uuid": "c6735178-894b-4845-aced-a53758a547e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648667, "uuid": "abe98423-38d5-42ea-975e-4fad921fe33b", "value": "c19f2e7d281c5b754b1878da56cf3388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281d29cf-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688623120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623120, "uuid": "7fc46e50-b65f-4481-8b23-c425c96c13b2", "comment": "Malware payload (Mirai)", "value": "e070efab41486e6ea64484b6236a9730", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623120, "uuid": "6bd96f2d-05ed-4993-b528-e2339efe45f6", "comment": "Malware payload (Mirai)", "value": "62747bf69607366e99ef6bd5acbf8871e45df59777e1ae6f66e38b447be64308", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623120, "uuid": "986f7fb2-8bb9-4c9d-b9d0-09d463f90f77", "comment": "Malware payload (Mirai)", "value": "9fc0c31e0eb8ce2757832eb7726b44d10202c8ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623120, "uuid": "44978878-8e90-4ce2-af65-93f33cd7884c", "comment": "Malware payload (Mirai)", "value": "760cfee0301194ac881fc2cb6238a62498dc826632e88c2bd421310cd28b1536b9565ce39ae316adf0bdcdad32043979", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623120, "uuid": "6557987b-ab57-4f08-b0f9-595324a9132e", "value": "T114632A85BDC19A12CAD413B7FB6E01CD372663A8D2DE32179E256F1133C686F0E67612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623120, "uuid": "5b88d962-6767-4f89-aec1-f4717790d1a6", "value": "1536:dPVqDbVVqAd6xitp6oR+t+aCeBCRobF5wsWUvD/9N:dPVqDJL6xCApuoAjUhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623120, "uuid": "37dd34a3-efbb-44e3-9757-88b589abcf9d", "value": 71080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623120, "uuid": "71e5e359-60d7-4b01-89aa-1a048dcc01c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623120, "uuid": "8717369e-9c2d-4568-ab1b-7e02b7fb4b99", "value": "arm5-20230706-0558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b283e3c7-1bea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688640532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640532, "uuid": "772c97ea-8f59-4247-b5a2-48924e1094fa", "comment": "Malware payload (Formbook)", "value": "14cf36dfee03af7a349b1ba713dd3319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640532, "uuid": "f13c795c-c9a3-4d6f-b9b1-f1961395061d", "comment": "Malware payload (Formbook)", "value": "62ed901f438fc72b696fd6fafaa0d7fa8b1d5a6b96a281844effc456de3ada1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640532, "uuid": "115cc046-46d5-4b21-a4c3-0bea08c3baf6", "comment": "Malware payload (Formbook)", "value": "06729ed5f1ecffe874066b7a05588606dd5bac76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640532, "uuid": "afc47f75-a3e5-4412-b759-a92606d43c49", "comment": "Malware payload (Formbook)", "value": "1d19f9e730a207f12424a68f6cfe918b5b38ca8666a8a401efd35ef623be0fec57cf9d4b71e7e8908d447e4d49b5358e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640532, "uuid": "f51c992e-6671-4ee4-8cc1-4e8086ffdaae", "value": "T1F4F4126822B7461DC08B7F7D0D006671C7FEA985B423D21B9FA3B8C8CD15B150ED5ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640532, "uuid": "e3782bd5-f70e-4c8b-8510-85c367f3343c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640532, "uuid": "dcfb5db1-cdba-4fc3-a34b-0fe0c0326f32", "value": "12288:ud+J/M+Jhewx/NscEQ+vgXK1HsaPUmhZ574ZgYUjczSyx1WewCSH5+I+Ux+UUl6s:R/thewlqB6pBokZgm2yxw3CI1+mUl6cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688640532, "uuid": "ebf57733-9a27-4eee-9e24-bce3c01f2c44", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688640532, "uuid": "b8aa3346-3ac1-4a04-9ea8-555a75e40b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640532, "uuid": "b21b8ffb-2b94-4dc4-95fe-19625cf2e6b8", "value": "62ed901f438fc72b696fd6fafaa0d7fa8b1d5a6b96a281844effc456de3ada1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361c35e8-1c03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688651061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651061, "uuid": "29f175f1-4f97-4747-aeab-33539ecc33e8", "comment": "Malware payload (RedLineStealer)", "value": "281162dc58748816f1bb320280a3bf9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651061, "uuid": "eeb280f3-bc88-421e-8df9-53dd7a09e4a6", "comment": "Malware payload (RedLineStealer)", "value": "6312b952f2be0652baf9de1a6b6cf3a755688498aa59312c44cada1f6e0fd3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651061, "uuid": "3354795f-e070-41ec-8b5e-b15e9e7c7d42", "comment": "Malware payload (RedLineStealer)", "value": "579cb764ae120b884eb2dc3d58db8700494d1680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651061, "uuid": "4ebca85c-2caa-4b04-919f-02cd326baa9d", "comment": "Malware payload (RedLineStealer)", "value": "d67ec419e71ae340cf45d741ca888776a0405dd62cddc635222c13b800e27b9bd0e7ae88cdb242d45f31ceb82096b12a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651061, "uuid": "88a4de9b-ae65-4425-9157-d646e4a18d03", "value": "T198B401333A609A67F049DA30956765D0FB79F3A43AB641DA765CE03A1F076D1C32823E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651061, "uuid": "1ef396fd-3939-4709-8a04-e5898f6eef49", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651061, "uuid": "5dca72e4-49a7-48f9-ae92-4bc5757cba50", "value": "6144:AnfR1apxfvSCAFbmaklCdnQgMTk2H/ZHn41cr2SQOnOb0IYDfhPmWt9F5yJS:AnfRGfvVaRdnQgGvZ41cKS/I0I2Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651061, "uuid": "bb302df5-2173-41f9-adb2-566dc26eb162", "value": 514376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651061, "uuid": "7daf7697-54fe-48da-b4f9-2aeaa3b3cb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651061, "uuid": "7a31ba97-3995-46ce-9595-e05de73e17e2", "value": "281162dc58748816f1bb320280a3bf9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a83c2af-1bd0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688629244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629244, "uuid": "391ebf91-07ee-4510-a299-94692a491426", "comment": "Malware payload", "value": "a64ba8c7ec7c28c31e2c7710284f49ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629244, "uuid": "c5b22767-2e32-41c1-b326-8adee737a5dc", "comment": "Malware payload", "value": "63246b9720b1af6279aa42eeff7865564be6912e98f82119e8ee675d377afed0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629244, "uuid": "722787e4-e770-402d-86cd-cadf32cf9ced", "comment": "Malware payload", "value": "b58aa35ea9e175b7ab4a9901246f2d221d899a1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629244, "uuid": "87f889c1-a4b1-4ef7-8d6b-2ec4a42beb6b", "comment": "Malware payload", "value": "b61b28b6d096da12cdf8fec6a08924f0afe703ceaee05dbaf7956fa405325442f2c22d61f5c4780c6dce7fbfa9e2fe5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629244, "uuid": "52c61061-2392-465e-89ea-afd98ed83eb5", "value": "T176448C5078C0C472D57A2C345674D6B10E7EB8311DE0DA8FABD8197A8F326C2E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629244, "uuid": "99cdee58-5d6b-4674-9aea-ad93c81965f3", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629244, "uuid": "bc4a5992-b711-4fdc-b0c1-2545ec750572", "value": "6144:TwEmDpM6FAWMVF7WZOWfU+BPBdmJJgZY6/RRuFLQbo7jJE:TbmDC6FAWMVFyZOWUAPBdmkY+uFLEoPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629244, "uuid": "68a48591-8dfc-4ee7-a0ea-6c466e63eedd", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629244, "uuid": "85784cb7-5305-4a3d-9044-8b2a8cc058e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629244, "uuid": "63d65bc5-22b0-4e4a-aa44-bd84e18feed3", "value": "SecuriteInfo.com.Variant.Zusy.475489.17388.13419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d411ac-1c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665022, "uuid": "f921e21f-0a5d-4108-bbfe-235c354d16f5", "comment": "Malware payload", "value": "482901a46c1c3bd5806cfb3624870641", "object_relation": "md5", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665022, "uuid": "4882f4d2-18bc-425a-8e66-77b9be7af010", "comment": "Malware payload", "value": "638c313209189f54848aa0ae0a1d58039975e0200e21ce28401234e7d2a3913a", "object_relation": "sha256", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665022, "uuid": "8fada847-cb3a-416a-8744-e5b21f800359", "comment": "Malware payload", "value": "c668021ccc4ce1129e5869f6893254808a2b6e09", "object_relation": "sha1", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665022, "uuid": "f86c9342-168c-4d08-b933-cabf29c83998", "comment": "Malware payload", "value": "375a31f0635eacbf2bdcff835e7d77de9ea8003414f48d46843152fc0b2533d197e6497c97731f3c21ae3e11d3d4db6b", "object_relation": "sha3-384", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665022, "uuid": "95080569-c2f4-4dc6-8672-19a96071fe11", "value": "T1BE76334C97A9CC08CDECC53D7C60CDEC9BA48A6F15325BC6ED2A3726561EF85E5100AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665022, "uuid": "70cd63a9-325d-4d29-b2f6-7cf4705fbdb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665022, "uuid": "ef14335d-d5bc-40e6-910c-91249fa1bdd0", "value": "196608:pQG9W41kWuOEh0NAP3YlOnDZ+lbPGtndZJ0VuqGJGp5KUyN3jn2Hg:pb/ju50NAPoEnt+KbCVuqGJSC3jnIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665022, "uuid": "5e4365a0-9d2b-4870-b356-e9bedc08f126", "value": 7166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665022, "uuid": "a1abe95b-7600-435a-bca3-25cdbe78828f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665022, "uuid": "840297a9-c5f4-43ad-abb4-c52f68a872f1", "value": "gakljeqwkfqw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543c30c3-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688651970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651970, "uuid": "084c30c3-4cf5-4bbc-bb5c-a01d2665fc9a", "comment": "Malware payload (Loki)", "value": "56efcebdc381f1111900d3795fb3b2de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651970, "uuid": "38c20e73-56b2-4343-be6c-fb062c0dda8a", "comment": "Malware payload (Loki)", "value": "63d4b43106467f00ae798fe56ee9f6e0f62d27d4e7c73e853a6191af79650a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651970, "uuid": "6633764f-9f58-4d81-9698-e79d628a15f2", "comment": "Malware payload (Loki)", "value": "17a7ad659102ba5460449c7bb2111d89275c649a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651970, "uuid": "e6c6db89-7216-4e91-82bd-d07359028c80", "comment": "Malware payload (Loki)", "value": "7a546ef6262387f96f86f5c58165d945fff7d911e2207465bcec9f35351ba36e0c08b855031e50fe5f978e68f57cc0de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651970, "uuid": "3b32f3d7-bdd8-42a3-b559-b5c2e4157b14", "value": "T167F4DF81713E2A67EAB9CBF9025051B087F62E1FA25DF7E44CC6B0DB62F5F404641A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651970, "uuid": "20e01a02-8071-4d29-988d-b90cdd6e1b8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651970, "uuid": "e38715e0-26de-4828-92d5-6f29b7671910", "value": "12288:LlKnuXBFEXqXdVzwVkWYvoWzIf56uSUWKgztBuUqGs7d08+wa:g24qXdVT/zIf5dNhKjVqGsB08+wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651970, "uuid": "111d8b80-be83-4f51-a17b-eb1bd00208e0", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651970, "uuid": "24d9aa6e-a41e-4f60-9a00-fc804cc947f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651970, "uuid": "c11d5bad-585d-42db-a0ff-ad96dd4b4308", "value": "63d4b43106467f00ae798fe56ee9f6e0f62d27d4e7c73e853a6191af79650a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c4fb2f-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688652345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652345, "uuid": "d00fd692-fde6-4000-9393-e6af435c6227", "comment": "Malware payload (DCRat)", "value": "b30f061d4c331f4bc76b0c86b0daea65", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652345, "uuid": "e77a1718-b0a4-44fe-a694-ce2113988f13", "comment": "Malware payload (DCRat)", "value": "6401bca6e6e4f5e3850d480c4a6f616b32c1fe0e3f1b0e26323aff3547f8394f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652345, "uuid": "7f876581-3642-4135-aae0-c1b9aba59416", "comment": "Malware payload (DCRat)", "value": "119ac79f0279fd7c46c555cb238311f587394b09", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652345, "uuid": "8fa24389-9a8f-4d3c-b663-077e447cf3ae", "comment": "Malware payload (DCRat)", "value": "50837fc951e84a2b42cfa0f161c00a82c1bf73cc83e3917347dd9dd9404604c3e7ee2866a1e61fd0809c883c0c576975", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652345, "uuid": "5560988a-7b22-4e0e-a1e6-a67b581e1c44", "value": "T1EC06D642E9C70D9AC9D627791DC71235572CFD628A2B7AAF5A58C2313C236C0BF1AF44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652345, "uuid": "bda30b92-f0bd-4ce0-acd3-19825845aa7f", "value": "77b15ecd8e584dc77fc9e421a3ea6e0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652345, "uuid": "83b51de3-bd10-4b81-8980-473a4c6579c1", "value": "49152:eRVyPj/BGnAlhFTOxkWxK0DxTnidZ91hVb:KUWxTnidZ91hVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652345, "uuid": "7a9ba781-36d2-4fdb-a8e9-820d9bf30647", "value": 3850887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652345, "uuid": "f8d64dfb-7faf-4848-a43d-31bc43183aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652345, "uuid": "4e399def-94c0-4757-a0cc-69d86549b748", "value": "76C9D4FF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce93facf-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638432, "uuid": "b598786d-f4d8-45ab-9318-8cbd402d1f8f", "comment": "Malware payload (Amadey)", "value": "f142d2f04898057a4825285a5aecfbd4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638432, "uuid": "92a42110-6428-44ca-9055-b35767eb1985", "comment": "Malware payload (Amadey)", "value": "642b1c2877174f04febef9416ebd44cf2d63f9af0a88c1437b236b8733f84830", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638432, "uuid": "130fbe5b-df71-4e89-b537-fca58fe1e8b0", "comment": "Malware payload (Amadey)", "value": "f6332f4e124cacf759e837ba1cf8aef87b438eeb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638432, "uuid": "aafb1958-a579-4c9e-9fda-72197d270270", "comment": "Malware payload (Amadey)", "value": "6a875ace423cfe69ea19c6506992b2a7fc8ebdc10d86c2757b5180c75a3e0546813628fe4710963653ba55aff3524d99", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638432, "uuid": "a8b5c7b8-f35d-4510-b228-22dafdd82cbd", "value": "T1C6560112680D5D5FA2B634211FDC408368AD63785B170D9232D6EDEFEBACD84FA8572C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638432, "uuid": "e2025561-0a8d-4a75-95b0-e791043350df", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638432, "uuid": "5d830055-720b-453f-91b6-4ef40b00168a", "value": "98304:1b5mgKr4nkMNk2iLB8+znT0ea/XEnkaBdnVz:R5mgW4JiLB8+fYUn3BhVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638432, "uuid": "61204edf-cbe2-44b7-9bf3-721feb82e1d5", "value": 5985096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638432, "uuid": "eb126bab-1e83-4fe0-a50c-ecb3d028394c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638432, "uuid": "c0f11d21-8ad7-4093-b376-3efc340e012a", "value": "f142d2f04898057a4825285a5aecfbd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6154027a-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688627511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627511, "uuid": "35c2ec78-f3cb-4cdd-8769-a70cdc7a3ddc", "comment": "Malware payload", "value": "d2ab1f3ec994f99a530faae7a6466507", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627511, "uuid": "7ca1698b-78e6-4a31-90ab-c3064a1f1084", "comment": "Malware payload", "value": "648419e87cd350f67e60cdb1050adb1772216d43b73e02a27987e85b9949b0e1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627511, "uuid": "99b5b22c-a72a-4eaa-a66c-b249d7c21afa", "comment": "Malware payload", "value": "5ae3a261ec576656454e392f320e59f93742cb12", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627511, "uuid": "c0f86247-69c6-424e-b46c-b0b739e9c655", "comment": "Malware payload", "value": "c2202f1c8631b56c6ea510fe9d4e64d98bae2c33e4f94143d8b83c1b4f7e8231a3049f541de005587da4026d1387748e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627511, "uuid": "30284822-17c8-4b32-bc60-5e8c01763758", "value": "T1E3E423C48CEF51D971D0652FBD204924E113ECA25428846C78623F798FEBA877F986F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627511, "uuid": "df0734ec-1822-40a9-9c51-58b069708e5c", "value": "12288:nS1vS9c9DgsfAu22TQGDpm8kA0Mt/QGSKpSGSDU5ATGmQsh1pW2:nS4c9PmW0M6KlSDU51mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627511, "uuid": "ecc26632-ff59-4dac-8285-6709d2735838", "value": 658976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627511, "uuid": "c06eded5-c890-45e8-96db-dcfbfefd6a46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627511, "uuid": "60014156-9ed9-4337-b337-abea26c96ca7", "value": "Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f26c68-1c08-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688653337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653337, "uuid": "4b78f5ff-1298-4232-8259-19293a88054a", "comment": "Malware payload", "value": "e68c36c4c6f28b6cdd3fce0675aca192", "object_relation": "md5", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653337, "uuid": "11d817dc-01b9-4c92-a34c-d202c48b6b1b", "comment": "Malware payload", "value": "64fec4bcd85b3e2129c0e1f3a0201f6effb5667f52067caeba21cade08cd7b94", "object_relation": "sha256", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653337, "uuid": "7bef39c6-2d83-4cfc-9ed0-57158c8e71f5", "comment": "Malware payload", "value": "cfa229d13bb8f1f61e1ef8a7b2f2ae1698ecf3ed", "object_relation": "sha1", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653337, "uuid": "5da87836-e27c-4f75-9a80-8e18f0a63f8a", "comment": "Malware payload", "value": "8ce3800c63bb40a28b0c9542b475c7c50e6079518454192b9c659ee27d67d0fdbf428166a0ac38cebe475e4f70ffb442", "object_relation": "sha3-384", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653337, "uuid": "04632870-85fc-42bb-98c2-bb10e5dcd32f", "value": "T132352335BF7EEA02DD3BDE7190A5CEA44621DE963169BB0B1E511832DB7F0F14A61308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653337, "uuid": "9ebac44f-c936-4a25-a61c-dabc9eb9d086", "value": "24576:nLsvd25j65ZyXLdg2PDQRVeSufUhG5YKcZHy/gWdDV+zBQ6WWrj8eX:nLa6RgyERVqKSoWdB+zDBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688653337, "uuid": "24be4488-9a94-4620-b639-62f2156ef213", "value": 1115743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688653337, "uuid": "92eef631-7e08-4621-980d-155ac33fb4c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653337, "uuid": "bb5ea2f5-a556-471e-9d84-e6929c4333d4", "value": "library.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1da3d1a-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623807, "uuid": "949330ae-042e-45b5-ac82-fb6e15fb82aa", "comment": "Malware payload (Amadey)", "value": "c942bc2334709b47eef3e5a8cab5db2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623807, "uuid": "f7ae8316-21fe-4a17-92a2-dc1bce77ce0d", "comment": "Malware payload (Amadey)", "value": "65733e362aaaf851b4a824873ca8114cf969aca1544c9dc062070a9fce964867", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623807, "uuid": "d06c2b9f-bae6-4a17-aa40-79e153ed661d", "comment": "Malware payload (Amadey)", "value": "46c02a295cdee3b4401ce1bd284b546901f4f74c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623807, "uuid": "6d925da8-a86b-4f24-86c8-2dcd08317b3e", "comment": "Malware payload (Amadey)", "value": "ec44e6d1258178a50d54d0bece429c2c40aff61e557bf5f231896123503a4c503bdb7d18e69fccfd14e33cd609812a35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623807, "uuid": "979f5cbc-47fb-4849-b7a2-9e8f37859f48", "value": "T167060102244CAE6FD436397563DC15A3F96C9471DB1A1D4522D2AEEFC88CE83F6A24DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623807, "uuid": "8105c6f2-03c1-4fd5-8c09-540b931b4c64", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623807, "uuid": "2358bdf6-e61a-44cf-88bb-8f745e98e274", "value": "49152:HkduHGxAUu1QMjFetdnWIW45wRBfu73HGYeRqhZxpwzGdnHysIVT+4mA1zew4Cit:KAmdSu7FdH0VTVlE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623807, "uuid": "8659b759-6634-4c3d-bbad-ec3a6ac3a6ee", "value": 3791688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623807, "uuid": "391e686d-4907-4a4f-beb2-1099267d913d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623807, "uuid": "57b7147f-779d-44e7-87bb-08b808558bbf", "value": "c942bc2334709b47eef3e5a8cab5db2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade34038-1be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688636229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636229, "uuid": "dbf70e26-2140-4116-9438-54d43a254e29", "comment": "Malware payload (RedLineStealer)", "value": "3a7bc6879489e4af4337ecb6a6ebe5f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636229, "uuid": "6d1f8ce3-293a-4ad8-bb0f-1f0dc7d84f3d", "comment": "Malware payload (RedLineStealer)", "value": "658f2bb2946acf4f42fa891eee87c105c13d6b7818151fbef969f161fffd084a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636229, "uuid": "e6de7719-4f97-4317-ac28-ce93481b19a3", "comment": "Malware payload (RedLineStealer)", "value": "207b51b26bc156dd23255c9e49ec0a9423907a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636229, "uuid": "2caeaefc-3871-444d-aaa1-7dbb26768abf", "comment": "Malware payload (RedLineStealer)", "value": "755d804571969a6278e90625bc0a41bf2b61b36d6bed5e1cd44ab4f6ed30b757b6157138d7ed4d489d6df5d205ccc9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636229, "uuid": "fc535936-f399-48bd-9afe-ae9fe4a3e5a6", "value": "T1845549203D804D61D9F36379D6FCB124992EA4A0335649CF1ACF16FED6101CE6E36A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636229, "uuid": "697ea734-56de-404e-a0d6-c1de39ec2a0e", "value": "95efca35ace17089d4d21f38582f355c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636229, "uuid": "7c6af5de-813c-4f9f-853a-0289ed6a3bc8", "value": "12288:8lKDfwno19Il4Y3vfZcewuOut5YzjCB61qhJaGH2a:rS3vfPpcm616fH2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636229, "uuid": "5fc39986-224a-4fae-a7e4-772b4c2b77ad", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636229, "uuid": "8f6bf097-3bb1-47ec-916f-dc5c42d1fafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636229, "uuid": "162d2267-6404-42cc-a785-fa17254cfe2c", "value": "skittleswork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf4ede7-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624308, "uuid": "845082e6-1f66-45a0-9445-c1e5fcccb9e9", "comment": "Malware payload (RedLineStealer)", "value": "b0048095dc7423896f0cb16411f4dad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624308, "uuid": "99eb61c9-4431-43ee-9fa5-2cf68d78fdde", "comment": "Malware payload (RedLineStealer)", "value": "667af5fd5083037d87b0532326c9d4989efbe4deca4dc9a0b45422279de618a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624308, "uuid": "7a68a80f-966d-440b-97ee-177fbda56283", "comment": "Malware payload (RedLineStealer)", "value": "f636437dec094148e158f05c2ca61b855b3841fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624308, "uuid": "674dfb50-ad43-4866-af02-70d5762b8c52", "comment": "Malware payload (RedLineStealer)", "value": "9afc1f8449a56b1e7151f4c8a776ab344afa6d70bfa2b07a9746e42bc68c7070a2953e408fb6d442c8d8ce6e7e2d2251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624308, "uuid": "775128a4-53be-40de-a944-992cdce90b16", "value": "T10E060112608C8E5FE436393977CC8457F9AD9470EB090D8521C62DEFC9ADE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624308, "uuid": "4a8c6486-7ed7-429f-aa4c-82db142771c3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624308, "uuid": "5e9fe5c7-b0e2-4a8d-a656-a948656b17ec", "value": "49152:mBKDmj0l7lsILg9lULSo2271iHND+9JHuARpecp5woF3cuKbJoNyz4bf58UO/3j9:Yj0t10NDjomwyZKDa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624308, "uuid": "6daaa8b9-243f-4e14-a15b-beeb35b1ab01", "value": 3773768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624308, "uuid": "970d32b6-e4cb-4dc5-be7a-cb7f39274abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624308, "uuid": "600ae217-3865-49d4-88cd-2e7831f278cf", "value": "b0048095dc7423896f0cb16411f4dad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a492881-1c11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688657108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657108, "uuid": "cacdf530-1776-4091-80fa-c44bb0ee9630", "comment": "Malware payload (Loki)", "value": "637985d77758ae5d69c8990dffe15339", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657108, "uuid": "b488d5a1-736c-4869-9752-51b3e870077c", "comment": "Malware payload (Loki)", "value": "670e3595a0d84f046f839aab8e5b316e8f9c6a8f7edf3f39388442863025bca9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657108, "uuid": "023b0427-a3ea-4743-a5ad-f346d0382c01", "comment": "Malware payload (Loki)", "value": "77a260f8117d464c8b6ec4d6d79464dc89b2d7e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657108, "uuid": "ad34e1b6-5915-42c4-ac91-25e2f64e9e1d", "comment": "Malware payload (Loki)", "value": "e8578da77f29e3541557c8c5a5be5c92c15ee5ddfa0c75005ba861fd6a640fa1b6c41569733a7d231f2494b4aef9357b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657108, "uuid": "da00d80c-8d88-4c93-ae2b-b2c073c3678f", "value": "T11FC20B6AFB9913BC8F460190395E1FC9AB29B53DA3909451387CA3342786C764377AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657108, "uuid": "59b4db24-7e94-40af-b417-839e77f5cdcf", "value": "768:jFx0XaIsnPRIa4fwJMkXYhO4WRyKHMq26Enb3xwWGd/jmw:jf0Xvx3EMkX3yKDWb3xA6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688657108, "uuid": "30c0e08b-5905-4a34-9248-9872f768b3cd", "value": 28000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688657108, "uuid": "630276f9-9342-46d1-b371-99fdfea7bc1e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657108, "uuid": "b892297d-0f65-4ce5-a56f-79f3968c64e0", "value": "637985d77758ae5d69c8990dffe15339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c677c4cb-1c02-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688650874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650874, "uuid": "b9f4cd6b-d0e6-45b6-8fcd-2964ad232a48", "comment": "Malware payload (Formbook)", "value": "64273b56a78b2ba729ca0d023f06b51b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650874, "uuid": "1d18f132-99a7-429e-b31b-6d9ba78e10fc", "comment": "Malware payload (Formbook)", "value": "677d8f0356d1a1afde7e90e35a132cc47eb2c1568648c1c90c237921df11a15a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650874, "uuid": "b7883ebc-18aa-499f-a952-66435900c0f4", "comment": "Malware payload (Formbook)", "value": "55b45b4acefe1d95bb2c46fd3b8d0667326d7685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650874, "uuid": "40584b06-501a-4b05-a764-21ec6ec282a3", "comment": "Malware payload (Formbook)", "value": "6f19dd40882c397e858354e7ce4631c801c8d5e7229ec5b8d78f4498e745d34b5a3ff0c2dc490f2f84ae00b2be702fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650874, "uuid": "2a301c77-fcff-4843-b5ba-098ce43efa88", "value": "T11F84121972E8E572D0511B310DBAEAFD9F6ABC0A5C25620B37E07F8FBD34642D518362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650874, "uuid": "48e92d65-f999-4584-bafd-c9038c966704", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650874, "uuid": "ea9cee5b-47bc-4ac4-8735-c7543d991557", "value": "6144:AYa6+F0rM1jS2lyhCCTPvpL8ZfHZx1gBN4kvqxRAHfOEZ78Y+I:AYEF0rWjP+C8p45DaN4kxTCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650874, "uuid": "1139d21a-1b3a-4803-8942-7559b5a85554", "value": 379105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650874, "uuid": "1441c2bd-5b45-4b9e-b158-1a4f7bc0f52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650874, "uuid": "781e660d-e662-48ad-8bc0-1803f6949006", "value": "berrashok2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6097363e-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622356, "uuid": "55fd5f5b-4b9d-4c49-8de8-cec367b64fad", "comment": "Malware payload (RedLineStealer)", "value": "35afa4bac91886de41405f783bdefae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622356, "uuid": "e4427e38-85c9-4d06-8e54-c760b2b428b9", "comment": "Malware payload (RedLineStealer)", "value": "67ff1455b940686d970894186239d75173976363b93b1a802223d74bf10669ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622356, "uuid": "73a78569-1960-4707-8fe2-3ae3911cf2ba", "comment": "Malware payload (RedLineStealer)", "value": "b215760c21735dc88008ce1f3a6f4572a7c2ba14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622356, "uuid": "80838f26-f94c-45b1-80be-a3ca9a5c6036", "comment": "Malware payload (RedLineStealer)", "value": "5f4d7ae2d1834ae0415ca4bc27c8d2f5ba9f537dd1f4a7434ef857d9627705939c4b8f5f1ae272ce4f96cae9e9a20434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622356, "uuid": "f98e464c-00e2-44cd-b027-40a29f2a9af0", "value": "T1F8160129606D9E9FC43034B52BED1993F9AD94316B1B0E0126C2EDEFD8ACD80F6D159C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622356, "uuid": "fa4e7512-7b45-4f07-9a8b-ec505df6cf9a", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622356, "uuid": "b5f3235b-0327-4281-a4cd-23a823e9f598", "value": "49152:oKa7UzHpVlq5ySNPT+o6a+jyo4FTDyA28TfCVkyoeJpCmNNrTy3VY9N8OUNGoQ3b:o6wNN4Gy8yoaCmNdTA7Wh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622356, "uuid": "51fb66e7-9df4-49f8-913e-299e1cfa1b0d", "value": 4078920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622356, "uuid": "0479bd7a-b395-4db1-bb86-cfb945e690c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622356, "uuid": "6d5c684d-392c-4de2-a473-77e1b49875c8", "value": "35afa4bac91886de41405f783bdefae8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5970fa3-1c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688655570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655570, "uuid": "0ca98819-9f6a-4a5c-b544-13cbc1871aec", "comment": "Malware payload (Amadey)", "value": "93a11634439b3013b532660424ed76a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655570, "uuid": "cf8425c9-99cd-4012-a100-1d66d2f9191d", "comment": "Malware payload (Amadey)", "value": "68da54a5b7276d3f073abf02e25a97490b8f7b28cd300540777f6c5df4f3a6fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655570, "uuid": "7e6d8ca0-152d-4a43-b25a-feff0f8952a9", "comment": "Malware payload (Amadey)", "value": "26ad961f3cc09af9f99f0672793e009704ba133a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655570, "uuid": "451761db-63b1-4ba2-b4c3-a61a6db0a538", "comment": "Malware payload (Amadey)", "value": "714b31477c340df0af0b55340d197e574fc1b2af4cb57c4e201abb0d7cb1c21e4c3a5e0ed0d12031cf26f514ce62ffaf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655570, "uuid": "0eb38d97-d5b4-4f5b-8b47-b4bb1fd2e9f0", "value": "T1E4B40133366099A3F48ADD3065AB95C0FBA5E3F93E7281C7792DD03A5B671D0D324229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655570, "uuid": "2f12e90b-1c89-47ac-bda1-49c0bec8a301", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655570, "uuid": "92f06744-7e21-4956-8530-e7979349168d", "value": "12288:cjiL8fv7aRdnQgmv7i/8/9OfM+L1t98OtBBZW28sc:cjiLWv782gmW/kOb98OjrW2xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655570, "uuid": "7b6b189a-ff8b-4999-8eba-8dfaaab09d0f", "value": 524104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655570, "uuid": "76750f12-94ec-423d-8faa-997f3713952a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655570, "uuid": "8a122154-5258-4ef7-98bf-15ff66a84660", "value": "93a11634439b3013b532660424ed76a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66985b9e-1bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688648995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648995, "uuid": "fd10f519-7064-422d-b169-847930fb808c", "comment": "Malware payload (Formbook)", "value": "fbf1d7e369612e8da9daaaa11fe2ff45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648995, "uuid": "520a6c07-af02-425a-9903-9abb3cf53d23", "comment": "Malware payload (Formbook)", "value": "68ddd295e62084245133f0faa9600fa47b984826ef10ca6b724614a5bfa13366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648995, "uuid": "1c1db8b3-5e6d-49a2-abd8-e9c11f60cd96", "comment": "Malware payload (Formbook)", "value": "68ee206f35a09c32356a8f19daf628c40c5d497b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648995, "uuid": "a1853e85-de6b-4821-a399-5b2ca4298453", "comment": "Malware payload (Formbook)", "value": "079000678a1526eb52e8b01b814764c3e21de5688a5a3e7871f6c5a1d7c75a87ffd78b88f8e84704ba1fffcdbf634e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648995, "uuid": "6f9ab46c-2c3d-4034-a568-43a9dc33a192", "value": "T1DB057C3C18BC7223C174F6F69F9CC421F66085AA3E61DE3765C3989A461EA0265C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648995, "uuid": "624b63da-e111-49d6-a58a-bc7a8721ba8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648995, "uuid": "8520b662-e1b5-4b55-b8d6-86036412b6ee", "value": "12288:KzeUKjhnjh07ifIqOnRzGTrcaw+OScO2T+oKlbVuatdoJ3x1:KzKNnN03nF42krvtdo5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648995, "uuid": "70fea52b-49da-414b-8fc3-d45b900ce3cf", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648995, "uuid": "5fcb297b-8879-41ce-b4ca-e0123c9c91c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648995, "uuid": "195f713b-af0f-4ca9-be8e-f26dd93989c7", "value": "7054083214567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6353c30c-1bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648989, "uuid": "9f94aba6-5052-4fe3-8f76-044975bdbbd1", "comment": "Malware payload (AgentTesla)", "value": "3215dd1d87ccaaa1ec1d07f711554df8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648989, "uuid": "8e3a7e11-4345-4c1e-9d55-d2ba74dfcee8", "comment": "Malware payload (AgentTesla)", "value": "69630d1a9a263eb01442eda82db24fba3b5570fe73fc43d0d8245e81b5b1b3b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648989, "uuid": "5bc3186b-cbd7-4df8-a149-5510f408b270", "comment": "Malware payload (AgentTesla)", "value": "2a3c8ba155a7394ee846c466dbead6c1f4f12513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648989, "uuid": "d31e063c-5406-4ba9-87d5-f29b288b637f", "comment": "Malware payload (AgentTesla)", "value": "c1c4158158c5ccfa7ea4bfbbd21ca9dc6638681b30c45b10d67ec8a0b58182fc89d0d922bd2abe62d0ad68cdcc08144f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648989, "uuid": "3454e0ea-90f7-41be-a2ad-0f5948d1053e", "value": "T17605F12C22E6AB4BC5BA7BFD4C14A631C3F96D563033E30A0ED338E99D65B1449E1593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648989, "uuid": "9b1ca1b5-1d31-4a2a-90e8-ad3a399408a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648989, "uuid": "7e6d31e6-87bd-4aa7-83f5-2bb07760909a", "value": "24576:is71mOV/NOa6Uz7ayOVnWh20A1iLY1r1hTMrLM:/7UOV/NOa9GdZ+jLOZhTM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648989, "uuid": "67710c3d-0c2b-45cb-8a7c-01ea4e872ff4", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648989, "uuid": "c0a433d0-5769-428f-b212-8c4bbfebbd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648989, "uuid": "06c7e82a-05ce-4b42-960f-fc9d0dba60fb", "value": "69630d1a9a263eb01442eda82db24fba3b5570fe73fc43d0d8245e81b5b1b3b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871dbc60-1bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688641748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641748, "uuid": "bfc3c499-9f4b-4e3d-89d6-c6b62cb6cc97", "comment": "Malware payload (Loki)", "value": "5d293fa222d20d92ef52a12aa0c4a3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641748, "uuid": "5fa3995a-55da-4132-ad3c-834e9a15bb33", "comment": "Malware payload (Loki)", "value": "6a0ce1aeb67fe005151417bf367bdba06bb72f128ddd6dbb00ba207c013324ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641748, "uuid": "51d78f95-0426-4fdb-941e-ffb85b53a80c", "comment": "Malware payload (Loki)", "value": "c44a2bc99f3233ce4cee95056cffdb37d97ddc0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641748, "uuid": "87100723-b7a3-41b9-a59c-af70966cd0c5", "comment": "Malware payload (Loki)", "value": "5736119cfc96ae951da0eb6cace94be3f2192db4c7e75a8be4c0f6608790a2543141ad204fbe3bd3cc8472cce552f6d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641748, "uuid": "18024356-8f0d-4998-8435-e991c61c5fc6", "value": "T14FE4025523E7200ECE6E7FBC1C9606B8CAF9BA473502C2479ED7689DED68F454A10363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641748, "uuid": "a126b8c9-b083-4c3f-a09f-772fe0061918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641748, "uuid": "818472fb-75d5-4f90-8e1a-b6758c13f23f", "value": "12288:bd6L7PVTfiiVbhaDnLMzIL2q+RTdOL8J+sy3YKeHnDo2ksK7IA2kuO9QN4gC:+OyqGUL8lyIKe6sEnmNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641748, "uuid": "eadcaa5c-4bc3-4204-a6e1-b3960baedbe6", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641748, "uuid": "556abc52-b8fb-490d-b87d-aa44da6e773a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641748, "uuid": "118e1d6b-5b30-4752-8a6b-55278dad6cc7", "value": "6a0ce1aeb67fe005151417bf367bdba06bb72f128ddd6dbb00ba207c013324ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53c3a23-1c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663810, "uuid": "b256123f-aa2d-4a7b-adf3-da81958f2a66", "comment": "Malware payload", "value": "dd9f3e29ea5c2d60fa0405a6212d25c8", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663810, "uuid": "2a989455-84f0-47a8-874b-6e208682537a", "comment": "Malware payload", "value": "6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663810, "uuid": "8cd64d72-5c88-49ad-8951-56fffed051c6", "comment": "Malware payload", "value": "383a12a90e3601636c47936d79ca60288e4ce120", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663810, "uuid": "416ea0e0-75b0-4fec-8753-e63568c96bdd", "comment": "Malware payload", "value": "a11ac3c5f16485b7faab0b1e038a43262e3540859fb934404e22014e55b9e2e858e1000838a2727a01e8818b2dad904f", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663810, "uuid": "3df7e775-6352-48f7-a3cc-fb46ba53debb", "value": "T16E17331A9ED5EC9ED9DAEACB8CBC2CEC354F6C087075DABE20049750966476311E4CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663810, "uuid": "64040ff2-fc64-449b-ae7f-2217483cc759", "value": "393216:g2EJXPMuGsFOTXH5yFyDYV2mis6HesitrrE562r0MoFk+fPdH1eS:g2EhhGsFOTXL0VoyrEk2r0MyPdVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663810, "uuid": "b5303fa7-715a-400f-acae-b2ea192d9189", "value": 19176798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663810, "uuid": "5251450a-0fa4-4661-a9ef-218e7a07876f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663810, "uuid": "ad06b12f-61b5-4417-b282-d0a59b8b734b", "value": "Evolion.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6694f717-1c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688665745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665745, "uuid": "124cd18c-2891-48e6-af0d-78ca2b830ac2", "comment": "Malware payload (AgentTesla)", "value": "e434392e7b0d0b702c6d462389359a3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665745, "uuid": "a1d6316c-dc24-496c-84eb-5c5d800576ba", "comment": "Malware payload (AgentTesla)", "value": "6b115b2943a8882e1ea5a8df973a30a7aa9edf64fe8715be8126ee54b9ad8dd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665745, "uuid": "74dcd796-6243-46a3-b676-aafd7d0d142e", "comment": "Malware payload (AgentTesla)", "value": "f6b69b0e754058c6e8f0c0b22649e3b59f24092c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665745, "uuid": "7eb54aaa-8412-4b76-9fb4-338935858227", "comment": "Malware payload (AgentTesla)", "value": "9becf90ac79066e762cd99d676c174f38562803b296658f8bd746f88eff424a32a22b4c2e2053a75fa645a2cf4ebdaa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665745, "uuid": "a0388b7c-f9f3-4b26-a470-ef59c50667f6", "value": "T1B1E402263937C347E525E3F6183420C063398254A8BAC66C1CCFA1F5AD7BF151A6BB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665745, "uuid": "6bb76126-f419-4a92-8884-ceb5135e5c4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665745, "uuid": "f0b4ff1c-4bb1-4110-b21d-5be388c3ba27", "value": "12288:a3C6DCqEdoBvJPDM3zQ9ctnV5o/EfBM1/eZyM3y3ta:M9EdQxADQcVS/EcEH38ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665745, "uuid": "e1b820ce-5eff-4910-8f1b-72d07f06367f", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665745, "uuid": "5e3e255a-0c92-4060-8053-d08b7f2d0070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665745, "uuid": "3d02cc6f-a472-48c6-bab6-f8967ea83601", "value": "rOrderRequest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d7e2e0-1c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665230, "uuid": "76070dcd-f1df-4f61-b1ab-803e7c93bda8", "comment": "Malware payload", "value": "9fa3180810afbbb9f999e5239027fdec", "object_relation": "md5", "Tag": [ { "name": "DawnLand", "colour": "#289E0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeSaleblazers", "colour": "#DAE436", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665230, "uuid": "9195643a-7642-4739-b685-43314579143a", "comment": "Malware payload", "value": "6b937ac8b7f889100cf86a34f74ff2fbdba7b072822026ab275d2a5ee6b7b650", "object_relation": "sha256", "Tag": [ { "name": "DawnLand", "colour": "#289E0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeSaleblazers", "colour": "#DAE436", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665230, "uuid": "b52b7219-1eeb-4f83-8def-9ea7bcd994f0", "comment": "Malware payload", "value": "3c3610842d1bb832cf8a422714da529708a8e6ec", "object_relation": "sha1", "Tag": [ { "name": "DawnLand", "colour": "#289E0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeSaleblazers", "colour": "#DAE436", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665230, "uuid": "ae252c8d-ff81-4a8d-b0e4-54967b3e0173", "comment": "Malware payload", "value": "141d3a959b815c977a244ae35f732c817bd896aa46b1d4ace5b68cc761a12dd519d354e7acbf8cb9884d3ce54c5f029b", "object_relation": "sha3-384", "Tag": [ { "name": "DawnLand", "colour": "#289E0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeSaleblazers", "colour": "#DAE436", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665230, "uuid": "8325fc5b-e882-43f1-b730-1f89a87a9f16", "value": "T129B69E417A8A4133E2731E3904B5F574D3EAE6014EB58947AF1DCFBA6B36092410AF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665230, "uuid": "c57be8e3-d842-4c1b-9c25-6e7f69a65232", "value": "f2f92ca9953c2ec9ac27b0eee8cb0d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665230, "uuid": "04086b07-995e-41e5-b73a-9e7630151898", "value": "3072:hca9VP4bW3TRHuTMGidsptIGT31qrIf//3x5cJKy9g/kdLUVgKuOiyb:hxP44Huwc31qrw/fx5uRdLAgKu58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665230, "uuid": "71762f0c-b1b2-4385-9ee2-fb07d7ffa37c", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665230, "uuid": "803fd3d9-da20-4d63-9fa9-d699513e0d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665230, "uuid": "241d3231-8d3c-4edc-aa98-29bb6eeff0d0", "value": "DawnLand6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168735e4-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638123, "uuid": "5c2522af-84ff-47f6-983f-c41ce35c44ee", "comment": "Malware payload (RedLineStealer)", "value": "ce7090564eefa4915bccdecc0f4f3205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638123, "uuid": "3fccc2ff-2d7b-4623-9234-66dc7972fe23", "comment": "Malware payload (RedLineStealer)", "value": "6b9418112dd6fde51230e4ecfe3e04c62f0ba73d56b0afef16a3255b5041f246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638123, "uuid": "57669c6c-bbb7-44d3-aba3-7457a69ae976", "comment": "Malware payload (RedLineStealer)", "value": "e6ae6fbb91370097466587b292aacb7a107f0d0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638123, "uuid": "7a12567a-6411-4460-990c-d9bd2c05f995", "comment": "Malware payload (RedLineStealer)", "value": "a529fd2da737ab082214eda470f4f2ea78305eb8be04d8379f355777a34a80dc0b3342678e66cd9b0b26d0f1c06a42b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638123, "uuid": "aa4712ea-8182-4266-980d-f1af178a1059", "value": "T1C9060111658C4E6FE03A787A7BDD4417F92D95B4DB080D4622C22CEFC89DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638123, "uuid": "36a953d7-da74-4532-a928-243b0d12f9bc", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638123, "uuid": "ad0348a9-c49c-4f31-bb26-46d0183b5a24", "value": "49152:wfqFLnwq9JIHW8ezhhC/KuD1ZbCZva+Ipnq2vbRLZWB6flR9fFuC8iZ2C0jKXY13:OqFJ8hDvbhvbRUUf5wHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638123, "uuid": "51378ba4-ed7e-4220-8649-4ab1288f24eb", "value": 3763528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638123, "uuid": "77568e21-2db9-4153-88f9-c283fcfbdd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638123, "uuid": "f1f0a3b8-ca09-4dff-82e6-018f7f407152", "value": "ce7090564eefa4915bccdecc0f4f3205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5a9074-1bd1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688629808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629808, "uuid": "2faa3a10-8ab3-45bd-a35e-dabe07cb4f94", "comment": "Malware payload (Mirai)", "value": "953054677d3b6cae86a15766ab7c0f81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629808, "uuid": "0ee9cdac-93fb-4cb6-ab5d-07ed2dce3e2f", "comment": "Malware payload (Mirai)", "value": "6bf91199af8a4109c12618622a512d60eae7ed3bb1a7918582a3f41e048ce75b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629808, "uuid": "f7efe066-7c0f-412a-83e9-50150dd50a12", "comment": "Malware payload (Mirai)", "value": "0b3fe8846bc607743fb5144ceea73a307b7b71bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629808, "uuid": "3b7f602b-d8bc-4a8f-8cba-cb934844e8e7", "comment": "Malware payload (Mirai)", "value": "701f2d38a5f8fa5094d025660a6e6ddc95ff9a2d3441b85a0424079d0adb61e0bd29cfbe9ad79785c1346cf1cb647cac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629808, "uuid": "080173c9-862e-4903-932c-e0f342efcb20", "value": "T126A2E01172A32D96F3ED2C3CC96A8317FDA71BFC90F6327579415520C94D20A2E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629808, "uuid": "054cf099-d4d5-4be4-b171-89dbffde5e8a", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjoohymdGUop5h5:vvQn4j+ZO5fKAlxZs3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629808, "uuid": "66764512-6cab-4b93-bb12-444b609b8e08", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629808, "uuid": "09324d0c-f34a-406f-906d-d4cdedb54ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629808, "uuid": "9b75eaa7-5220-430d-8142-a7d3f4eca8a7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25923d8a-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688637719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637719, "uuid": "7b9ab54c-8a3c-49ba-87ab-3184ed72e201", "comment": "Malware payload (AgentTesla)", "value": "323ca6cf32c62685f1e3813544ca69f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637719, "uuid": "2d8ff558-d42f-41e7-9cbe-dfc3ed6ec0d1", "comment": "Malware payload (AgentTesla)", "value": "6d2a00d71cfe1ac88de75df0150145f8800668afd66cec2c73b0eeae2e4d4b5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637719, "uuid": "af732d41-4a92-4845-b743-19dbadceb5cf", "comment": "Malware payload (AgentTesla)", "value": "0650a727cf27d2291918d564952bf9da99576c06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637719, "uuid": "3ac28f1b-4842-4595-8064-1efb73757a2a", "comment": "Malware payload (AgentTesla)", "value": "dc3f8e94bf9cf27e9918013dd804e680158b5eec3f0d259a3d53bac1950200c3e6abaad66acd17dcab7697d7395fdf1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637719, "uuid": "5181d3e4-6c99-4b82-af80-89242efef3e7", "value": "T1A505126956F7854CD0A23F7C1C9006F1C7E8AA44B433C20F9F63AD6CAE0AF165AC1997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637719, "uuid": "192243da-d4b6-44ab-ba0d-a166bd3bbb87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637719, "uuid": "6e422297-ddf9-473b-97e5-4f91a4b077f0", "value": "12288:eewx/NscEQ+vgXK1HsaJ0jkaV8pZsDae0HKM0aXLvSUgbDLPEOaqb0Rb5UPNQAzw:eewlqB6pS0jx8pZgaec0aXLvMDon5Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637719, "uuid": "c2bb5c6f-3c81-45cc-bb7d-09c5eb693982", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637719, "uuid": "f2118268-7ead-4230-9a97-1b22c9075aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637719, "uuid": "cd22179f-cb61-43d5-9c57-ec8badf61264", "value": "6d2a00d71cfe1ac88de75df0150145f8800668afd66cec2c73b0eeae2e4d4b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233db593-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622682, "uuid": "acc759cb-ede3-4cbd-873c-3170f60a3469", "comment": "Malware payload (RedLineStealer)", "value": "4a4c531af3a689a93a8fcf71e4311367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622682, "uuid": "4be9c71f-4bd0-4dc8-b101-69da381ccd04", "comment": "Malware payload (RedLineStealer)", "value": "6d4a38c32796ea5b1ec6a5e36e60c1be80e5d21691474ca2e190f7570773c723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622682, "uuid": "1d50e6ff-5b8b-4400-b3cf-ad81d0aaa6a9", "comment": "Malware payload (RedLineStealer)", "value": "cac372088f212668f9cdc618b1827c010033c953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622682, "uuid": "29889e7b-906f-4807-841d-0c0372b86928", "comment": "Malware payload (RedLineStealer)", "value": "e4843c9396642a61d03e48f6dbb8270d8f12ee2cb9338dd10d4c58a780da83a2883c3a968ceae8d2bd47599bf2fbbe23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622682, "uuid": "88868ea9-580f-4bf1-b3a9-f4550ca42335", "value": "T14055AE05A09D1D5CC671E3B2BADC23527DBC84742A1DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622682, "uuid": "136576e1-640e-47ad-b14d-66d1a5913ac0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622682, "uuid": "784146cc-1b79-4de2-ac91-d068c58fd658", "value": "24576:OjM+rNnoph+ZdD2kr6VejBmfA+GjcKdhaVQ2lWfNM:OY+ZnG8Z4N4jBmf4gKdhaW2lWfNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622682, "uuid": "4f7c96ae-d026-41d7-aaa0-8a4c45d3924a", "value": 1344331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622682, "uuid": "9f7572df-4e26-4fda-bdd4-f831301bee53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622682, "uuid": "aa8b06f1-c618-4336-855e-78910c094fba", "value": "4a4c531af3a689a93a8fcf71e4311367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b30784a-1bc7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688625300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625300, "uuid": "ff659a84-0908-494e-85c0-6cf5f0493e7e", "comment": "Malware payload", "value": "b859733dc24b222f9ff112d28d0a404f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625300, "uuid": "bcf77b81-7092-4941-8834-84839deb66d7", "comment": "Malware payload", "value": "6d819223053196e48f089de4e4458e36a15d109d7c33baf2c9bc9c7fff0175be", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625300, "uuid": "5681d33b-0fdd-4708-ab82-3b304467dbc3", "comment": "Malware payload", "value": "e3d35fb242c4c2030889a41f7a443a3c0d916bf1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625300, "uuid": "70a7588f-3380-409c-8e58-3bcc3443261f", "comment": "Malware payload", "value": "c4f5d7574d20d553fe698a46d90ca6762dc2e117dae3c0f4f34b4d01df2fd5d6e68a06f15471ff078aff552780befc7b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625300, "uuid": "85f9153a-3eb4-42e6-9f2b-9872d014fd62", "value": "T1E3C3120E98A923E902B8F7F58C423B7FAEF413C163C4D95941D16EC3552A3D3BD902A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625300, "uuid": "8572ad4c-2255-4bfe-b48e-83f3d3634623", "value": "1536:2hZBTbTbWnP/C5MjWI61s85fum3JAwpPO4pxnVsXBb+UdQtoZ1Jl/D:2bBnTbuPqp1s4FnpG4TVs1LWtIThD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625300, "uuid": "0fa28bea-0f0e-4387-af92-605593946244", "value": 119197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625300, "uuid": "7073159a-7151-4578-99f5-9eda87881283", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625300, "uuid": "ba5766fe-6b70-47a0-accd-958d6575a922", "value": "9070071d176ca6bc6823d353b80e7637260f28929ea205dcdd1302885ff74e92.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5313a288-1c0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688654975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654975, "uuid": "8c9563fc-538a-4ef1-8434-c2362b457971", "comment": "Malware payload (RedLineStealer)", "value": "c2e7833c4fb84eb68ed64bf0267ad121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654975, "uuid": "9497f209-419d-4526-82a9-3c3e589b3218", "comment": "Malware payload (RedLineStealer)", "value": "6e0dbcda0de3e7a0c5abd12b7bf198254092e0209fb1262564b3c83bd9e7c8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654975, "uuid": "bc214ab5-9d7b-4488-a4e9-f8ca02441d12", "comment": "Malware payload (RedLineStealer)", "value": "e9cb302eee29a931593fea73ddd47c31dd262235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654975, "uuid": "bbf9a251-f464-4b7e-abdb-5da708aba28b", "comment": "Malware payload (RedLineStealer)", "value": "03fc96ade54398c32bd3ace5d6316ca4c083fe57436555fdc782a3c6f28d3db4eb2c1a83626a118898bd346685b68932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654975, "uuid": "819eca9f-bf46-4a0d-ad0a-c0890e3ba73b", "value": "T1064449123C92497BCC29E73BE90A8E46FB15E10F512DCB64EB31D5B6AA43F451271E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654975, "uuid": "b94476db-1986-4f7a-9dca-c31802983378", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654975, "uuid": "ec02e931-ab1c-4419-a3f2-adcc50f0f1ba", "value": "6144:H3EW8Mp+ly2WtzH7NrIrBJjvft5LZFL92hUPEI/U:H3EW7IYR0vfjZZ92hUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654975, "uuid": "dc3d0e9b-25d0-42ed-8b56-e269e9aa64ca", "value": 261449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654975, "uuid": "d939dcd1-b538-45fe-b6ed-5624bb36800a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654975, "uuid": "f0813f30-2529-4b7d-9b0d-f8bce99cfc2a", "value": "c2e7833c4fb84eb68ed64bf0267ad121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f7e44e-1c0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688654971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654971, "uuid": "8387baf6-0e16-495c-95e2-44fd232a6929", "comment": "Malware payload (RedLineStealer)", "value": "2ab537531014ac99d608136a63a45b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654971, "uuid": "1eab136a-4bee-4556-90ea-c97d1ad812a9", "comment": "Malware payload (RedLineStealer)", "value": "6e2ab083535444547f114a8eaede891f849d6094a516f0c5b03710e7694827dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654971, "uuid": "ea7c063e-c320-4a47-b689-fa349cc4079c", "comment": "Malware payload (RedLineStealer)", "value": "677c3d8136b1921b4508bfc44ba19e41591445f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654971, "uuid": "26144e20-459a-491d-8e4e-fdc0bc94c8b2", "comment": "Malware payload (RedLineStealer)", "value": "b2d53d185173b4541e4af5bc954ddcecbb0b4852a7751b2354d3ac5aba029e379a9ad48bdd751715648544c3c4ea34cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654971, "uuid": "7264c7fe-0841-4736-8f5b-f2461582c891", "value": "T13FB401333960AD93F889D9319A7755C0FB69E3A43B76518B762CE0396F072D1D33422A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654971, "uuid": "db23afd3-cb9b-46ad-b993-be1ee9d47764", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654971, "uuid": "96a70407-973d-4b7b-a766-312db8568aab", "value": "12288:l3b/+fvXaRdnQgXP7hd8dFlR6g4Ndsyf4s:l3bMvX82gTHOFlASo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654971, "uuid": "5dd8a2df-793e-489e-af68-5357aa37e289", "value": 524104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654971, "uuid": "330b7b3c-45e0-4b16-8f92-ae25f8b2b59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654971, "uuid": "5067e6bb-06db-4ffb-b749-fa67cf4f0bb9", "value": "6e2ab083535444547f114a8eaede891f849d6094a516f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae68258a-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623775, "uuid": "f9c5219f-1c30-4cd0-8ea8-b0a924cc92b1", "comment": "Malware payload (RedLineStealer)", "value": "9dd2ca45a52c03f775cbf829bd8e4a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623775, "uuid": "09a9170b-3b4d-4985-876e-cdf2fc3bd08e", "comment": "Malware payload (RedLineStealer)", "value": "6e37c085b75aa18065e128a85f0883e7bb75422db67b8c6f200d4458fee94f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623775, "uuid": "3505203f-9a8d-4281-96fb-3b58596180af", "comment": "Malware payload (RedLineStealer)", "value": "4c55da68369b048af8a7319ade0cb09d1eaaed8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623775, "uuid": "b905dbc6-f049-4b5a-9524-175a706d6ba0", "comment": "Malware payload (RedLineStealer)", "value": "55dfe60f5726d6c27ca57466fa617ebd2410eef73b20c95e104aad8dc81eb1a93928863b9e4a1487f302c49b88c92394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623775, "uuid": "afe2e4d0-1149-492e-9253-8250e34088f3", "value": "T194560112290D4C1F957634200FDC5493A9AC6B786B070D9631D2EDEFEBACD84FA85B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623775, "uuid": "bb50ad52-28bb-44ac-97db-91467aa020e1", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623775, "uuid": "a2cdde40-3f8f-48b7-9920-8a5b5112590f", "value": "98304:HXfhT/9LbkoSDyUa0nxuzf/9ki3v0iC4aW:HXfhr9nkGUaSuzf/WaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623775, "uuid": "6db3a5a3-cd95-4e5f-bc23-33af26828771", "value": 5988680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623775, "uuid": "9187b20f-b0de-42dd-bb49-925f3d9cd186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623775, "uuid": "db1db441-dcb9-4dac-8586-3ebe854752b2", "value": "9dd2ca45a52c03f775cbf829bd8e4a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bff1f87-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638105, "uuid": "ab3be575-406e-4f34-b2cc-4fa479153667", "comment": "Malware payload (Amadey)", "value": "96bae62fe136faa49c199557332f4cd1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638105, "uuid": "6221fc47-353f-4d42-a6da-42d9780bff7f", "comment": "Malware payload (Amadey)", "value": "6e9b8948d12a4b7030937b4111768dca744ba036696b57c4c22681675a25a3ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638105, "uuid": "ecdd07c7-a3cc-45a3-8bc5-5803f1b140a5", "comment": "Malware payload (Amadey)", "value": "f17ea454724e27c1aa6190179a90bcfcc3c4b178", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638105, "uuid": "2dd01add-4bad-4e3d-9f0f-b7105bdc818e", "comment": "Malware payload (Amadey)", "value": "e13165950772d5f8475997c69cf073f15c5ca558b256a5ad5a14fbb9dfa5847b9a8782f5b347837c312973e87593811e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638105, "uuid": "ce99eba3-7f32-432c-8d30-e5adfdcbc6ac", "value": "T1F9060111258C9E9FD5363A3537CC4827F96CA470DB0A0E8521D62CEFD99DE83F6A618C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638105, "uuid": "ca9765a6-4970-4954-a177-dcd67d406eca", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638105, "uuid": "cc592bf9-8e40-4cee-9b98-171bb072ff01", "value": "49152:lZ6/dKF51VvfboJR8XWX9kflJiPQ5GwgOPaJrJ4exoBegN6iDTts73iWaw5ZnKxQ:TXXb0sBgOPKrHJiDT+YuRrDWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638105, "uuid": "3a0aff4d-808c-4944-b700-2971ce263a5d", "value": 3777864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638105, "uuid": "261ea585-e144-4bdf-9b9d-f0d42eed22d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638105, "uuid": "94ad62d0-bc48-4bad-9860-b81caa1af634", "value": "96bae62fe136faa49c199557332f4cd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71edd995-1c24-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665335, "uuid": "c898b57e-e72d-4a75-9c74-8d4275c3b01d", "comment": "Malware payload", "value": "184d9d57bd86a97a2beb5e69d2c25a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665335, "uuid": "78ecafaf-ed29-4382-b258-7c3c8c9d3e2e", "comment": "Malware payload", "value": "6ef2d9276b57e028763894984b80014581d61f9c4a1659f83f1bb38b87f12436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665335, "uuid": "abcb408c-09b5-4e85-868c-f1ac1cd83fa8", "comment": "Malware payload", "value": "17f2dddb2681a2f5e75ac6417ef4864b9849470a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665335, "uuid": "feb7eeef-f9e5-4db6-ba6c-651b7580df13", "comment": "Malware payload", "value": "09c211f04cef00bc42f68af24604e02931f70f5ddb7b7931fc1a3aaab9aaee73739442eb0ab9afb71ecfb55a44a9a4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaveWorld", "colour": "#19E299", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WildWorld", "colour": "#1AB9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665335, "uuid": "8a77657d-672c-4ed9-bee0-abca84fd808b", "value": "T1BBB65C157F4A99ADC0AAC470C2464AB65E3134CB1B35BAFF44C496383E7AAF51F39318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665335, "uuid": "d7a62b24-315b-49e3-a720-d3a6066af45f", "value": "7f080fed612c27be7870afda48c17324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665335, "uuid": "71d957a1-ca09-47c2-b8ed-0bea1ba51a76", "value": "98304:GpbBkQ2bKfUn/FueymqxpQ9Q8y4a1b2Bnlhpf7Y9hLMIwJl8bH:GhBk1Tn0Q9Q+aEnl3789wJl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665335, "uuid": "f38cb3ed-51fc-424f-b8a8-f04cb1dbb3fd", "value": 10616320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665335, "uuid": "6eb6bf68-01b8-4eaa-bb99-73a050ba7fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665335, "uuid": "00683aaf-9d78-43d2-9f15-938ace5fe5ed", "value": "WildWorld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed915df-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688637788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637788, "uuid": "eb3fd9f3-bede-4fbd-a909-907979027d3d", "comment": "Malware payload (RedLineStealer)", "value": "0408c18f81ff4b91da8b1646321b355d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637788, "uuid": "c7abcc14-badd-4fce-9b00-5c00f516ef9e", "comment": "Malware payload (RedLineStealer)", "value": "6f06a9e99258a9cff89aef67d593c2f6ad2f7569b6c29e53b1b9f718ea01f012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637788, "uuid": "51c1cb92-96a4-4c16-9a2e-69768000d802", "comment": "Malware payload (RedLineStealer)", "value": "c54de2f113fe4d9765f2245b63e33210ada4fdfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637788, "uuid": "43f282c1-fadf-4226-96e1-dfdba7b49488", "comment": "Malware payload (RedLineStealer)", "value": "5b69a232decd98433b31f1560b8e4f9fb7daa499cd183ad7be51e9aeb1dd63341599285cd26c52557c75b0f1f1345394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637788, "uuid": "51f4990e-9d6f-4e3c-a8b4-bd9bc6ce344c", "value": "T19D061111604C4E2FD43A78B933EC5543F96CA4B4DB090D4621D22DEFD99ED83F6A6A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637788, "uuid": "375de650-559e-4f18-9d25-9736fbf3679b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637788, "uuid": "4a0eb458-83b6-4cd8-a659-3283003ef2e0", "value": "49152:WGPxXox9O8xdfYhsDD4QuFDYL9NqlqNd3pCKt0kIZhuY9BCBcFv32M263IBBKpz6:WoxXBDcH8uOXCBgu/zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637788, "uuid": "19190a2d-4900-4eee-8108-ee760c0e8a81", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637788, "uuid": "381d367e-eca7-4723-8c8b-3c4e5f87800e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637788, "uuid": "9e56c1bc-7d6b-418c-8b19-301ec6bee6c3", "value": "0408c18f81ff4b91da8b1646321b355d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f0a03b-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688622343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "52cf3ca5-6ef9-4eac-b397-a22397ebd1e2", "comment": "Malware payload (AgentTesla)", "value": "b4d2192d55d08d85dff7f0f4ff2bd10d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "405fba7c-e50a-463e-b1a4-ff99344f409a", "comment": "Malware payload (AgentTesla)", "value": "6f318b17e3352750abfd307e5e9f2b633205bb01cbd1639a05282170a6436932", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "e3808210-f5aa-4129-914b-d37fa26fa4d0", "comment": "Malware payload (AgentTesla)", "value": "d5e49bb9a3039a6b9a82ddcafd3e5f27827241c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622343, "uuid": "b7652e02-f146-40e4-8cb8-982dd6bd83e2", "comment": "Malware payload (AgentTesla)", "value": "0ed22f10f810dd82f099bd4e2f8cae952923c2abb3d5b55ff4506611ade8d8091bb06db42a882badc8986096cc3e23bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "5990f16e-6c61-4b16-b2f8-174f6ad2583a", "value": "T1422512263681C2B3E8A7047048E9D3395D3AB5A147B6D9DB739D0B756F112C1633A3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "edcf837a-e079-4694-8095-b3d3196d8e6a", "value": "24576:6k70TrcFS0Xcfa9sh6yxVUeLNSCDzBIjUIp07RtPP4Zt:6kQTAc0XB9fNwUUIp07fPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622343, "uuid": "1aea12bd-49eb-41ce-bbab-ac8292a1e3bd", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622343, "uuid": "fb5b931a-d3e8-4ccc-a37c-d4cfade7b6b2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622343, "uuid": "ec484645-dbef-4222-a30b-6d1bb5d7225f", "value": "Sat\u0131nalma Sipari\u015fi 20230331,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8107be-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688626964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626964, "uuid": "58cca507-6afe-4410-9a9f-635a76ccebe9", "comment": "Malware payload (AgentTesla)", "value": "3441b94e3d3af6ce37f141bd94dd8cf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626964, "uuid": "95114350-a857-40d1-962f-173220b74337", "comment": "Malware payload (AgentTesla)", "value": "6f342ff07554f4429ebf2ac252d5659b1c0e65469eecaf1aab5cb316d872f962", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626964, "uuid": "20c1944c-20d2-4102-ae71-d4be573c6517", "comment": "Malware payload (AgentTesla)", "value": "e62d24aefccfe15ba1f871413dcfc9090326e489", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626964, "uuid": "f76f7b45-32f3-4bbe-8367-93b4bcdd966b", "comment": "Malware payload (AgentTesla)", "value": "9fa28461b6ab3103053c9d5cef10e1d8dea4d8209278bf2736164bf01e8572d9420def26fadc58f736e47dbf63dcc50a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626964, "uuid": "886df0fd-e18e-4094-92fc-46f9dc298585", "value": "T1051512216580C2B7C8B7153840F6CB7AAB7430A74B6AA1DB72DD577A6F103E1A3361CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626964, "uuid": "6648b8f5-1b3a-47a1-8ffa-370517a343c0", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626964, "uuid": "e0f79d1b-ef33-4924-830c-34561d9f6da6", "value": "24576:Lk70TrcftfSrWQuwLTDi56oxi9wl3BGluvuwLlNN/:LkQTA1f+owLnToyE30sxLlNN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626964, "uuid": "36398909-1a33-4b5e-8367-ef0aa20dbaea", "value": 934464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626964, "uuid": "42370e0d-1480-44a5-8d4b-a61a8824f10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626964, "uuid": "e8755a10-4ac2-487e-aa29-208062736998", "value": "T06-07-2023-TBEYANNAMEYENIBASIM - ANTREPO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539831a8-1bd6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688631783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631783, "uuid": "e1d74de0-3120-4aff-b8de-9382a003c55c", "comment": "Malware payload (RedLineStealer)", "value": "8f63761d8e539119ba3110913cfc07ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631783, "uuid": "44d4cd4c-8c98-47f4-aa3f-41151729d774", "comment": "Malware payload (RedLineStealer)", "value": "7014e9b26fb00c8335c7ea6409601d0a564af33339ea2673500f5af6011be46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631783, "uuid": "cf154814-7fe8-4b50-bda7-b0ff0d421950", "comment": "Malware payload (RedLineStealer)", "value": "a8d10a5708041f1e884bdea085f920c2ff05a57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631783, "uuid": "05c10724-fe35-433d-8c0f-8d19b905238b", "comment": "Malware payload (RedLineStealer)", "value": "5198356e8d52eec7f0a01e8c8276b2d2ae491bd135ad016ca151270f4c1a9c09fb0c02f498ccd19c70378eef5b2ce13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631783, "uuid": "2b98e2db-2399-41b8-b02c-610576660f0a", "value": "T104160129506E5E9FC47139B127DD1953FDACA474A71B0E4222C2EDEFD89CE80F29498C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631783, "uuid": "3ab347df-918c-420a-aea9-966d8c0a3dfe", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631783, "uuid": "9028b5b1-01fc-4e7f-b457-ec78888a34b0", "value": "49152:NN0yqx4ajhjslQTPiFE6kB29yRaX6jJPFU+ZNIVMyC/Gv+JgG4ETRT55j8ejnGp2:QXslOiwRRaO9jr34zb+mO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631783, "uuid": "f96e5e0c-d70b-4a20-bc24-0cce776f41a6", "value": 4075336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631783, "uuid": "0b1d2c83-206c-4494-8d58-9d2925ccc377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631783, "uuid": "e6e1bd09-ec22-4d18-af26-2908a91bad2f", "value": "7014e9b26fb00c8335c7ea6409601d0a564af33339ea2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7df5538-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648299, "uuid": "79c54103-c649-40e7-8c4f-4bd26dbf0c37", "comment": "Malware payload", "value": "61cacda1c82055046a3db20dc27c4b75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648299, "uuid": "fdcd94df-4b51-47e7-80d1-65a2909948bd", "comment": "Malware payload", "value": "70ca7d462f92340bfdc8c89512a2471750d04a6fd70bac6d919dd3b409b96b67", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648299, "uuid": "c9e736c9-232c-45b6-a747-9644ee115256", "comment": "Malware payload", "value": "7c36841a6705481c0f2034f190b75b1e0405ff75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648299, "uuid": "f48b3fd7-2ece-4c98-909b-40040c287b39", "comment": "Malware payload", "value": "601c3267a4c64e4a8c7282b833e5dd9251e30e55578a09f12f0be930924b7b1ec37e71b4828508c23a7fec230279acfb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648299, "uuid": "af6cb1eb-b88d-4cf7-b6e1-f8922aee20b5", "value": "T164B3B79A6E227FFEF3DED67087F3D62056DA659127928281F1DCDD404E252CC281E368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648299, "uuid": "ce08476e-25f6-4566-bc17-89b217497a90", "value": "1536:AfShD+cEeAxfzoLhNCUe5YbgNBOl1lS4Q8NxuPaG5Fp:Aah/EeAZzoLhNCGbg/aS4Q8Nx+aG5Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648299, "uuid": "6f525b33-62bb-4f7a-9734-fce3774afbe0", "value": 113573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648299, "uuid": "ffc72cdf-961d-4fef-85b4-e6f5432d1092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648299, "uuid": "e7548ec2-1f69-43cb-b9d3-3ec321f8e417", "value": "mips-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67213f5d-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623655, "uuid": "c4489357-81c7-429f-8618-08ab1d7ffc2d", "comment": "Malware payload (RedLineStealer)", "value": "a76766ef76527bab14c046041cb57156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623655, "uuid": "19582e10-e54c-4a3c-929c-5883778b6ac3", "comment": "Malware payload (RedLineStealer)", "value": "711357bf333e1d516a7965bf345b9b9a9149f4083bef2d9a052fcb06aa0e60f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623655, "uuid": "311d7f38-92a6-4ed9-98bc-1eaf4e16693c", "comment": "Malware payload (RedLineStealer)", "value": "77a97702b7c03a443b04151f04027d6cbb677bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623655, "uuid": "fbb63b1d-909d-4276-b05a-d9e6e7579988", "comment": "Malware payload (RedLineStealer)", "value": "3a1314412db4e15b96b0c5f31c5e63e5de4739758dcee695abb34338d0cdcfa9144b8871e9946519e308a9860b6e0025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623655, "uuid": "f2734dbc-96af-4b40-aff3-b452e0e4a306", "value": "T125160109506E9E6FD57534B227DC0993FAACA4B5270F0E1022C6EDEFD89CD81F29199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623655, "uuid": "7ec97ebd-13a8-4f2f-a738-21b5df79468f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623655, "uuid": "5e91b182-dcff-4e5d-ab55-7ee4a1cfe0ca", "value": "49152:E6+laT1Oa4YU7yK+buSCMAc6p69XnQnT8ollSiLZo31cMDgcgU0MD/21WTm790ny:EUk7yb1KoXEggm3yUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623655, "uuid": "79ff2e95-3949-4337-a3cf-78b6c4c4b8c4", "value": 4064072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623655, "uuid": "51e9d689-5d08-4872-8eb9-8c6cf512d18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623655, "uuid": "0623eab2-bd3f-4073-8d4a-31f3c84e7b43", "value": "a76766ef76527bab14c046041cb57156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f09d656-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688648526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648526, "uuid": "cf7eab81-c140-477a-a423-18724e654f82", "comment": "Malware payload (Mirai)", "value": "45fbc75b59c772a06fcc4427f88685f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648526, "uuid": "4418bd88-33f7-43f4-8d0a-610107a1f80f", "comment": "Malware payload (Mirai)", "value": "719c541b82ab45e7c40799547357b852f2fa74feb9c11b0b36f67f1828b99402", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648526, "uuid": "3d84c4cb-9186-4e81-9644-0a992e9bd789", "comment": "Malware payload (Mirai)", "value": "e2a477e13dc897368b4d3c525451e8f833f82741", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648526, "uuid": "01e31034-8385-408a-b2fc-9fcf05a2f6a7", "comment": "Malware payload (Mirai)", "value": "bb54bb7168e136a89ba5dcec8dbe7ffd0decbcef85d1bcf01518dab09b0e104985f0310ba73c6a37d5249c8d98f55fee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648526, "uuid": "a4019343-56ed-4681-866d-8b296655d528", "value": "T1B253F8827C81AA26C7C05777FE5F018E33196798E0EA73438C191BA17ACED1F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648526, "uuid": "7363e376-f5b2-4bdd-9278-e657f9b3f360", "value": "1536:U6k0ZVGJU1kcxukAw738OYceZWzF8xnx:zk0ZYk1z8Jcww8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648526, "uuid": "d4a3960e-6d75-43c4-9139-2048a468d1c9", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648526, "uuid": "76efa29b-3981-47d3-884c-6c3039e554a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648526, "uuid": "3f8b78e9-a2a7-49f1-ad33-5eebf51958ee", "value": "45fbc75b59c772a06fcc4427f88685f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2c8547-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688641144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641144, "uuid": "8e3fe71e-5df0-4857-ac46-ea0516ebaeab", "comment": "Malware payload (Amadey)", "value": "917d79fb865b696a2540a50ac59730c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641144, "uuid": "8787c0a1-d22e-47cd-bd63-0a4e957e2f61", "comment": "Malware payload (Amadey)", "value": "71a5bed69aa92c48333d67be168c24c0368a245d4bbf57c4a5932fad775f5af8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641144, "uuid": "0e4de79b-36f3-4002-ba6f-ba0193960c35", "comment": "Malware payload (Amadey)", "value": "1b88a539d162414756279ddd49c18f180a5789e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641144, "uuid": "eb28d40c-22a7-4024-90de-faf07cff8793", "comment": "Malware payload (Amadey)", "value": "ac2fcafce6835aa68b762c8cfb8beb73459d91d9d0d0a7f32eb956e1e3cb2da93dd41aafa8dbfe48d9f954ef5d3a19a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641144, "uuid": "9ed8eb30-e194-44f8-9c49-68b2145732c6", "value": "T153160109246E9DAFD475347227DC1993F9ACA4B46B1F0E0022C2EDEFD8ADD81F68159C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641144, "uuid": "ec184e30-fe05-4142-a827-40def0db8fb4", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641144, "uuid": "a089126e-007a-41c8-a3f9-a859399ad68a", "value": "49152:QRfM2gnLnZQVQicHxTw415DDGkLv7My+sPDsyleMvq7V35wnlIimtErFYeuT7ckt:xKeJwQSkXpOyVCh5wlZwgQi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641144, "uuid": "c426e177-d9dd-4f77-abe7-986d0535a543", "value": 4067656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641144, "uuid": "a88def87-f425-4972-a3e2-31c0b8b606bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641144, "uuid": "ff584e19-4414-4b9c-bb72-84b06033144a", "value": "917d79fb865b696a2540a50ac59730c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114c65b4-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688627377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627377, "uuid": "f1c11cbd-6fe2-41ab-91a1-13b19e7e8646", "comment": "Malware payload (Loki)", "value": "ffddf51b37d399062dc958a9edc5768c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627377, "uuid": "89be2de3-30b0-46d9-80d2-9c57dba1efa5", "comment": "Malware payload (Loki)", "value": "71f4fe8216968fa2ed52b407e09f024353128de231c69001938b828d283a2b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627377, "uuid": "63960c34-6b0c-4c4e-87f9-f08cc421b261", "comment": "Malware payload (Loki)", "value": "548e5e85997f4fdff561a4cc15a90cf0e8a08cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627377, "uuid": "a4a00812-eb8b-4561-9ac7-77aa1618489d", "comment": "Malware payload (Loki)", "value": "1ba8f20d4b711d74adcad43816878f27e9e8c3b03864962576d3ba47ada551fe6b24b0ac1533d98ac3eaeb8e4d2ea94a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627377, "uuid": "3ebca890-ba3e-4c9a-bf38-ec1da696392e", "value": "T1CCE46B3C1CBC7622C174E2F68F9DC421F290996B3E61CE3765C39899461EA0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627377, "uuid": "963f37b0-722a-4f30-8bbf-f9fcb98650da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627377, "uuid": "0a2b4926-f54d-483d-8bad-399a1e9608b0", "value": "12288:gz5xjhnjhuOpO+ynEvFzE+i8RKxc2cqXSr1bGqSJ:gzPNnNQ27J27SRbpSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627377, "uuid": "bba46af5-8745-4334-8fa7-865340a94b6e", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627377, "uuid": "0d7e6a7d-8c19-4bdd-9552-e7e09ffc9fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627377, "uuid": "43453bfa-f7cd-4c94-95e0-11631f392275", "value": "ffddf51b37d399062dc958a9edc5768c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f347bb-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688636567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636567, "uuid": "23fc0c10-6cd6-498e-ba5a-70dc4cc19646", "comment": "Malware payload (AgentTesla)", "value": "b34937d54def969976168cddfa8b2331", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636567, "uuid": "aa3ba2a5-9235-46f6-a4ae-5b277e5bf613", "comment": "Malware payload (AgentTesla)", "value": "7236fc69e12d0425451f4e7277b68a1bbff4a78cdde01a4c624aaf556a3358a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636567, "uuid": "f0666730-fa8d-49ec-ac6a-0ae6a40e2826", "comment": "Malware payload (AgentTesla)", "value": "b86c5800510b1e5fa647a0770427805fa6de5870", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636567, "uuid": "ad71491b-b8e4-45ee-a6a7-d915d9f50e62", "comment": "Malware payload (AgentTesla)", "value": "2d2721f7087064980d82b181447d2f884a79b23e76530ffb38936cdd918b393dc52f4dd2bc4023b7c0b96d2df1e53f31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636567, "uuid": "14c5b93b-dd46-4159-a479-e6184ca6d662", "value": "T1EA7423EA8CF306B8483719A05E671EB0EC3CD76ACBB6B0465A9D271374E607706D58B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636567, "uuid": "635cfece-0348-4cb5-8ae2-f25dca8070b7", "value": "6144:ypU8PLk88TmZMVdAlLzEnntq1g7QxQtXia6MYlpuvWz4kew0fSbfQl6n6Wu562:MPLk8m7VaZz5WXOflpFXUabfQ8n6J5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636567, "uuid": "ad0803be-f834-4c39-a94e-a5a7a1e472fb", "value": 368477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636567, "uuid": "4d3aafc2-99d4-4a16-a02d-828a0d2f89e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636567, "uuid": "519a1e9b-df2c-4491-9e44-3c0bec83d672", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8849cef0-1c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664513, "uuid": "f9d34e64-d616-4a4c-b426-510d87aee568", "comment": "Malware payload", "value": "700c0f173a3ddab6d62b94f86d50404c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664513, "uuid": "fd7e27bb-278e-4d84-a346-c84d8423ce80", "comment": "Malware payload", "value": "725d1eba223411dcfa236897d059edb6d19f863a827c28ad4c6430285b7a0362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664513, "uuid": "5bd1ba01-9647-4045-a9f6-ac5894b9f417", "comment": "Malware payload", "value": "8c44e2ee49a2ac8c5475e818ebd8657d7eefff33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664513, "uuid": "07a9357b-2bef-41d2-9c06-6e4e51304016", "comment": "Malware payload", "value": "c3215c13b7333affe548897b3673f098efa17674d95981e9f3965ad765cb4ddff76ff9b4701df28888c62a02a9ab2d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664513, "uuid": "adb7a79a-97fc-4ce5-ac94-74cb36f4468a", "value": "T1E0B4E015F3EB0E62EB6B1739C9E012685B789998415AD35F004F08F47C8A3ECF5D6A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664513, "uuid": "1aafc958-a5f4-481d-92aa-84d8b2d9011e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664513, "uuid": "f6bc28b1-6295-4569-9f1a-bda9f6712c75", "value": "6144:ZD3ZAdMviWiuTFHymR5ZDRfrYCCi0rH0oG1xbAysz5VlRkUv+E4HPHufhygqy4ND:ZDbvVfryi0b0oFZ5Vlb4HPHfgS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664513, "uuid": "b6af6552-778f-4a46-898c-525b0c81cbc7", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664513, "uuid": "ae86c0b8-04f3-48a1-830a-6fd5eea22050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664513, "uuid": "d919c4da-b0ee-431e-a180-2f80ef7dda7a", "value": "OlympOfReptilesGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2276f2d-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688648665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648665, "uuid": "dc630866-14c8-470d-88f1-79e3f529e264", "comment": "Malware payload (RedLineStealer)", "value": "55757c741b8489d0ec2e1a7d020aab42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648665, "uuid": "d6876c80-043c-4ae1-9862-f58431d9a17b", "comment": "Malware payload (RedLineStealer)", "value": "73a232f3b97846b0cda9708eb7781ca10f00c32c7137b97e84be70ce9f3c750a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648665, "uuid": "2e506c62-7335-4f75-9ef2-69d638aa416d", "comment": "Malware payload (RedLineStealer)", "value": "b9a396f00940dea9a0a2e8c52c53042940347b2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648665, "uuid": "aae35e0d-9a1f-4761-a8dc-5aa23e30d3e0", "comment": "Malware payload (RedLineStealer)", "value": "dba38a367263b9a5a0dd25dbcda1ab47d31027ac60cb41b095b37d721c5c6d6fdeadda2ba233966e175ef1f2a7c28d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648665, "uuid": "60fb1c39-3512-4efd-988a-b93e27b11ef6", "value": "T183160119606D9EAFC93534B42BDC0593F9ADA435271F0C5122C2EDEFD9ACD81F6A088D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648665, "uuid": "e7868203-8195-4217-b699-068a4e8d49d2", "value": "056ba4e32aea7a3acd31e9441a8c2fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648665, "uuid": "aa98223a-8219-46d7-a2fa-0c74be42edc8", "value": "49152:SbZJKYDpEcSCi1D7vX1nK4i1FOMbDFEt1P6L6/fw346M/eAy/0qmIOCgtXsYWWDl:BE884prmFY9IO+I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648665, "uuid": "3b1d105a-0735-4228-95e1-82f5ab92df1f", "value": 4053320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648665, "uuid": "c32b1ca2-831e-45f1-a25f-908864bd72ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648665, "uuid": "3f2e89ae-f9df-45ec-bd1e-1e0d4bd43252", "value": "55757c741b8489d0ec2e1a7d020aab42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ac6df1-1bd7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1688632298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632298, "uuid": "d82cca7d-81cd-4b16-be7c-85d7a56ab84d", "comment": "Malware payload (Cobalt Strike)", "value": "7391de649e6ce3adfce0ec67dac21ae1", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632298, "uuid": "3c20fba1-0fbd-4d12-b6c8-65c39eeaef0e", "comment": "Malware payload (Cobalt Strike)", "value": "73e5ae0c85b89a79d76a050e7bc659ba519cb784ea431cd1d0c399436c4031cf", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632298, "uuid": "f2d286e4-ded1-46e6-b39b-abeff1c9f35f", "comment": "Malware payload (Cobalt Strike)", "value": "a4ff7e367af4f8e4b5cedd24d45a7a67884da9d1", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632298, "uuid": "35da98b8-2766-4179-841f-5a0b98737368", "comment": "Malware payload (Cobalt Strike)", "value": "ab7ab2df8a6660269e2a9eff38e5e07b43d1e3fed6932175f591e9c458ee627b57137995c492869aa3b2069e1a9aadfa", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632298, "uuid": "d87a4a79-1428-4342-a950-7a26f10a920c", "value": "T14636BF7225827CB9DAAE6D7084142E502D787C8B1B2053C77B4976FB367A2D48E3CB74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632298, "uuid": "9932a31b-2925-443f-8976-138f4c93f2c9", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632298, "uuid": "5fe69179-7f6d-4a65-9310-9591081f27c0", "value": "49152:18J5vMicrb/T5vO90d7HjmAFd4A64nsfJM/bkHSqWesvi/B76Gsm5jYkZggRRYM9:pi8cGqxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688632298, "uuid": "55614883-b6ef-4805-a2b1-0f886ca614ba", "value": 5231104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688632298, "uuid": "7a5fed1e-ce47-45e8-b436-b39218a49150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632298, "uuid": "6ec1cc3c-c0d2-4a0d-a7eb-8943890cb821", "value": "4BD63F4A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b29a37-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1688647329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647329, "uuid": "9b2c18a0-8ee6-4b00-a551-337c656265d3", "comment": "Malware payload (Rhadamanthys)", "value": "6c15224e84db96edc2d327f4d3bdd0c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647329, "uuid": "a7699635-5384-465c-9c03-17fd4d3a5670", "comment": "Malware payload (Rhadamanthys)", "value": "73e8b7f7ff4e8cf3bb270bc8bcaccd204c104ada52e968ebd4b27fac81b401d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647329, "uuid": "68b4eab4-91c5-48ce-8de8-21933c6128f9", "comment": "Malware payload (Rhadamanthys)", "value": "ba4176d873f9c0e7b86781b68f595355551754aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647329, "uuid": "364f91f0-b0f4-41fa-8fdf-b4873d679351", "comment": "Malware payload (Rhadamanthys)", "value": "851a114bdc7c10640ccbfc5343838047ec34a4a8cbc1e3bf09cede76ed5a9f1267974c70076680de5c644a8415ef2b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647329, "uuid": "668f52a3-fa76-4abe-9ca3-af90f591167f", "value": "T180A4E003B5D0FCB0D9614B328D2EC2E8375EB952CE197B5676A47F2B29701A2E273741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647329, "uuid": "6e5211d2-cea8-4cb1-98af-29f107dca817", "value": "7b189a1ea318a56844e63d62f67d17ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647329, "uuid": "a15e4e2a-866e-4558-a7f1-bdf45e937922", "value": "6144:5+FLa3vrRstbQ9TNmyQqAx84qW1KLuS+TWhUALXQdvEs3mpAfVoli+TI:5G2/eu284qW1KYTWhUkgdvVIIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647329, "uuid": "0b67fdd9-7859-4340-b103-e730cb553f28", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647329, "uuid": "2ae87e56-4a76-4cfa-b079-2ae9b9241782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647329, "uuid": "badf5862-a887-4064-b1c3-eb8f13c7a294", "value": "scan doc 202307068398726639392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2f7d1f-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623798, "uuid": "a82a43b4-dd81-497d-8686-93ee65a1399f", "comment": "Malware payload (RedLineStealer)", "value": "a617bbb706aef4fa8c3871a7c65c5577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623798, "uuid": "97ffe71b-5285-405a-8e4e-baf6274e4b4e", "comment": "Malware payload (RedLineStealer)", "value": "741a454e5719beb4eedbe53865683bd4d5bd2ab526db30f31db8644ed91eadc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623798, "uuid": "7b797358-6e09-4ab8-930c-cc6077437355", "comment": "Malware payload (RedLineStealer)", "value": "5434cab324ace961097045e048f7db6d6a91d3b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623798, "uuid": "40a8de3a-5333-4203-8320-a480e7ef8d69", "comment": "Malware payload (RedLineStealer)", "value": "5eb9ff76749965de000d5d9bdaefc3606b0b439a6745b8fa575569169734d2fae79afa25c2c26757e9204f9e2be47fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623798, "uuid": "607e448e-db5f-42eb-92e0-cae7927cd166", "value": "T19B060102259C5E6FE036393573DC4A57F92DA5B4DB1A0D4121D22CEFC89EE83F6A648C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623798, "uuid": "c3650189-d5d1-4bbd-b6fd-44ab5cbba198", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623798, "uuid": "a7b03a86-4417-460e-9288-077d654a3dc3", "value": "49152:5+fTFKjn4XZvdYBHDxEgLO5n15wVAevJLTVeYP8V623Irp+Njuq/JI/uVnCNmEbG:wEA0Jfz+7DYzEodD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623798, "uuid": "1e8daf67-c29c-4e18-bf3f-b9bce77e0629", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623798, "uuid": "23df3214-cbf0-4194-a4e2-93e61eb233a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623798, "uuid": "4d1068e5-1f38-4753-93b9-14b045a722a6", "value": "a617bbb706aef4fa8c3871a7c65c5577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9853a1-1bf8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688646320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646320, "uuid": "ac13a72d-21c7-4f4c-8ce0-41bbb9fbe6ce", "comment": "Malware payload", "value": "ec496d6daa64f91fa7aabe451465f67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646320, "uuid": "80fa29a4-1a93-45da-ba2e-630229492cc3", "comment": "Malware payload", "value": "7455ccd962f510e99c56a155ebc82192ec0f1a0858125b98166be405b06bee59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646320, "uuid": "5f5b82a5-317a-4686-a76f-a1b33f28b46a", "comment": "Malware payload", "value": "697d57d988a5ffbbf3a69861393c0653609fdf9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646320, "uuid": "5f5e1a89-062d-414b-aa52-e12fd5b91766", "comment": "Malware payload", "value": "8408f461ceb9c173eb715e2c673d4de34271c7b4c9c6d1975ff644441517e587ac6ae8ecc06c455c003de350d5bbe6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646320, "uuid": "33810242-50da-4db7-b901-48c72b581eed", "value": "T1B5057D53B3D7D0B2DFA626F3D6B49376193AB834173C89CB7390282DE8906C16A35359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646320, "uuid": "b94bea5f-b88b-45c5-9440-94314e70517d", "value": "153aa0db686aff28745c696da6ec7574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646320, "uuid": "1f7db7b6-07f9-4990-9ccc-65db480dd965", "value": "24576:uG2s/vZn2WTiFYCcQj/unPKa6oyzqxjvZJl:Bp26yVzqBvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688646320, "uuid": "d3239417-d792-4c8c-958e-d173be68fe87", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688646320, "uuid": "561e7963-9aec-4a42-8d23-44676735d2c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646320, "uuid": "5255398c-27bf-451e-a725-53b7c8ba42f1", "value": "7455ccd962f510e99c56a155ebc82192ec0f1a0858125b98166be405b06bee59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec53178-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622326, "uuid": "b9ebd92f-596b-43eb-a23f-1c6a875189b9", "comment": "Malware payload (RedLineStealer)", "value": "080429a128b9b4932db518ecbe0ce4f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622326, "uuid": "a73914ea-18b5-450e-ba73-f97c45b80f64", "comment": "Malware payload (RedLineStealer)", "value": "7478a5017b98b9b3cfa5dbf141d89f83eb9798a2c6fdfc7fea031208c1d21b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622326, "uuid": "b6a9f7da-af93-4608-a5ec-7a5b52498971", "comment": "Malware payload (RedLineStealer)", "value": "6944f754f5cd2c9fa560f8081916a68645a2fc7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622326, "uuid": "87092a5d-b0fc-4b60-b296-624ea72f212f", "comment": "Malware payload (RedLineStealer)", "value": "179d0ff50ac6fa6ab3dec7b945dd2b906d7f63d3a6fd016561bc9e00743141f5463a0b043137e00d59515890ef4124e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622326, "uuid": "3e4070e0-0504-4e69-867b-18d9c1bd25ed", "value": "T117160129601E8D9FD435357527DD1A83F9ADA431672B0E4126C2ECEFD8ACD81F2D1A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622326, "uuid": "674aa19a-10c5-4320-9f74-17daa1628972", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622326, "uuid": "59ffff4f-cdb2-4b71-8650-535c36ef8d68", "value": "49152:S/qGRfUea/pNRV0ZKCeBT8ply6ZhgoQDrCMTrqybnoqSGANoRnsnPB4V6XjRkEyg:SfoUVKNnCM3zoihE3hvHAaN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622326, "uuid": "0f02ba93-7395-42e4-aef8-58882da3baea", "value": 4078408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622326, "uuid": "38b4ba2e-ea94-4958-964c-750b84aa1e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622326, "uuid": "4b83c34d-8c12-462c-8553-6f6da0a84500", "value": "080429a128b9b4932db518ecbe0ce4f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f2156e-1bcf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628779, "uuid": "0672aed3-c054-4798-9ba8-030b5b554bfd", "comment": "Malware payload (RedLineStealer)", "value": "6c9803f99699683fd0f32da3267e0153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628779, "uuid": "2c94878c-05f7-4585-a24a-ff0d59a52ed2", "comment": "Malware payload (RedLineStealer)", "value": "74a5b7094eb425fa61330607414ba758f6102ebc60e14473c2d2de2ab138744e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628779, "uuid": "4461f45e-dcb2-450f-9763-22377f11cb33", "comment": "Malware payload (RedLineStealer)", "value": "79ebf07001efcc173ae51a3b4b5f35f17cd302e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628779, "uuid": "b7e59bad-ae1a-42b3-b02d-f9bc4b3a8e41", "comment": "Malware payload (RedLineStealer)", "value": "c12422fd0fc3c3c5998873c718f01c77b1047ec06bab70ee8ed9725b2e21fafcc8a9a6a1ebcaf92181f3d3dfd0f0aa04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628779, "uuid": "9cc57098-7524-4234-bee1-a51632b02836", "value": "T12255BD05E09D1D5CC572E7B2BADC23523EAC8874291D613952E21DEF95F9C0E72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628779, "uuid": "fb8e1fdc-f2d5-438a-bef9-855df2236aab", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628779, "uuid": "7301b43f-7ba3-4a96-a26e-731c5caf0c28", "value": "24576:fASFKRmxaSBggiyQSpXQJnuJvH4IEPxxZmASI:fZF8IggiypGWvFAZmASI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628779, "uuid": "70f0aeb7-8a3a-4d00-a20e-ead293a5227d", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628779, "uuid": "d2e43b35-5e30-4c2a-9866-f43a37dc9387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628779, "uuid": "dcaaa563-9f49-4c8e-91bf-883933181682", "value": "6c9803f99699683fd0f32da3267e0153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ce64f8-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623700, "uuid": "0d449eca-adc5-43bf-8e1c-e88897ba9783", "comment": "Malware payload (RedLineStealer)", "value": "b77c1e05abc7d64edf99dbdeead3d36c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623700, "uuid": "b4d3a3d6-d66e-40b9-adea-147f28faed5d", "comment": "Malware payload (RedLineStealer)", "value": "74f3e739c8713664654839409c6a6eb3d90b5b5f6cf54ff4543dc02c56fa0209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623700, "uuid": "6bbd7414-9b92-460a-af4c-09aa7d00522f", "comment": "Malware payload (RedLineStealer)", "value": "6a192fb6d9c60f5d30c99ad070ef7d536ea46baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623700, "uuid": "b2afefaf-4f8c-49ea-91b2-fe60335a8562", "comment": "Malware payload (RedLineStealer)", "value": "56d687914c6fe35e22aab27b074977fa906563f75b6a3c8634487d1cc9e7ee1725dd7e5f997674b4984f368b63161339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623700, "uuid": "4ea9485c-c50e-4f67-9545-6671dd2ea9cb", "value": "T1B3060102658C9E6FE03A397673EC0957F96C9874DB091D8121D22DEFC49DE83F2A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623700, "uuid": "3e735322-a45d-4441-8ea3-37ee57b63d29", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623700, "uuid": "a98401e7-3a86-452c-b696-460944e33173", "value": "49152:lhs1inR4OQDb+Ap7HNwHtTZaUgfGPOLT5E8rdSOIE5kEpZGITHqTCCINgcy6nUHt:v5MSKRGPOX5xSrEpTqfiMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623700, "uuid": "da2ea32e-47e3-4006-a215-e4f4602c1cd3", "value": 3759944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623700, "uuid": "42a326ed-0801-43ec-b7ec-21a18f957dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623700, "uuid": "21ba4bab-4d78-4128-b898-4a9018a04d0b", "value": "b77c1e05abc7d64edf99dbdeead3d36c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8c9299-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623634, "uuid": "9a6b9125-2475-4256-829a-73c725aa9212", "comment": "Malware payload (RedLineStealer)", "value": "a63911285a3afd3a8e93aaf71baba623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623634, "uuid": "bcd2a5f9-822e-4c8f-9d02-6c242febf2ba", "comment": "Malware payload (RedLineStealer)", "value": "74f6e71a63686d8dd896a94b010605ffcf0c247ad1dcf74e06b199e776a238b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623634, "uuid": "46daf183-b6f1-4044-819a-59f38f54a909", "comment": "Malware payload (RedLineStealer)", "value": "d04d6bea6f45b71c88b11d208fc558cbdb7395d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623634, "uuid": "0fb1c554-49d5-4de3-b3ce-774438adcaa7", "comment": "Malware payload (RedLineStealer)", "value": "c1d9e2250d4d295c7c284d30b031eeca8d519eeaab5bcde754719d9fe257491ec4082a12ba9fc170e8a681052450d5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623634, "uuid": "1a4abcd3-6650-4e88-8011-6c7af13c43c4", "value": "T137060101619C8E6FE436363933DC5553F86CA5B8DB090D8221D66CEFD88DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623634, "uuid": "20c92619-253b-4c9f-ae3e-cced3af0b230", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623634, "uuid": "ad9bf031-779d-4b12-bc6c-eddb1b955e35", "value": "49152:4sHyft1FZib/UcvgD/U5m8TZw8ERx4vd0sK95eOfhrkTcWcdV/E7gmI2+nsSmidd:VQqvdioAV/hhfswB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623634, "uuid": "7b3fe965-7267-4acc-9414-dde1ecb83251", "value": 3770696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623634, "uuid": "d35e2c9e-3600-48e6-82fd-805be2ec4e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623634, "uuid": "8e3b83f4-935a-432b-a410-2c4ec1c694d2", "value": "a63911285a3afd3a8e93aaf71baba623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d9287a-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688622336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622336, "uuid": "060a6469-31c1-4f69-a6a7-fbff4e1ff354", "comment": "Malware payload (AgentTesla)", "value": "1ca97b277f12cd92dde0dbfe99e03dee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622336, "uuid": "82d6dec8-1144-456b-aa83-bf3422fd2e4f", "comment": "Malware payload (AgentTesla)", "value": "750361a8039bd9876939ca3ee37312821f8cd019eabe123ef884b30433757677", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622336, "uuid": "3752ee9c-fa69-41ed-8ec2-0c3ee7ff1c95", "comment": "Malware payload (AgentTesla)", "value": "2b5a76c34ed53e8c459851c977f80f6d1c1feb94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622336, "uuid": "eb173c73-cd4e-4e50-8917-033f433614cd", "comment": "Malware payload (AgentTesla)", "value": "0df4c8d7db73366bfe6d9669bd92cb0bbac218eb43c331ab83a7f1ca7b1c66c6741daae9c3ab1ef1a5172312532f4e9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622336, "uuid": "86213bdf-aaa9-4ce0-8020-c8daf8276178", "value": "T14E1512263681C2F3E8A7047048E9C3796D3AB5A147A6D9D777990B756F102C1B33E2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622336, "uuid": "b7461d37-2f74-4470-970f-fbb5328e6430", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622336, "uuid": "02c4239d-013b-4d45-bb69-0e71024e3153", "value": "24576:uk70TrcFS0Xcfa9sh6yxVUeLNSCDzBIjUIp07RtPP4Ztq:ukQTAc0XB9fNwUUIp07fPwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622336, "uuid": "ecc3da78-80aa-4140-808d-2baf90e4dce5", "value": 904768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622336, "uuid": "5ddb4fde-96ea-4b34-87ae-f1c948da9666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622336, "uuid": "3077fe25-4911-4141-bed1-bbb36058822f", "value": "Sat\u0131nalma Sipari\u015fi 20230331,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c187f657-1c42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688678353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678353, "uuid": "d7e9e330-c7bb-49d7-9a72-131245d48df5", "comment": "Malware payload (AgentTesla)", "value": "f2271e5fad4972000edb98406ac16296", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678353, "uuid": "7158fee5-93e7-4686-90fd-e406c7e247f8", "comment": "Malware payload (AgentTesla)", "value": "750899c839d771db1fa926991742dcc08e9afb03af983d646876e173789fb4ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678353, "uuid": "29779c3b-c1a8-44d6-b9a8-b60b0d2b732a", "comment": "Malware payload (AgentTesla)", "value": "b84e64c0630a4f15fee8b083277c925d39933d9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678353, "uuid": "41be84a4-4555-4d90-a492-773b35ad3190", "comment": "Malware payload (AgentTesla)", "value": "df506169d3e23bcc5d5d87d31ce687aa2cdcc842dfc40ec4ed3e5648a0a8d583e4af8de8e1086dd7aad234efce9bf9ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678353, "uuid": "d4b1a630-5e6a-4104-8295-8771958a8034", "value": "T128F3186D93DA4D11D33D01BBC5BF91180AB2D173526BE69D0DB1ACFA3D06783323A8A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678353, "uuid": "54896653-519d-42f3-a425-553f8923ca44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678353, "uuid": "e747de9b-7597-4849-950e-8be8a884bbf3", "value": "3072:PdUqXE6vzeJW/hnMWYOsfmhgN7VsMCN2EXdXX:JE6vYW/hnMWYND7u3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678353, "uuid": "a407ede2-b805-46b1-9d0c-97d26ab92d48", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678353, "uuid": "25b0e63b-7a83-42fb-9b34-716a17d5a6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678353, "uuid": "7c314e3f-c0d9-48e0-93be-db45b4847726", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92a8b57-1bd1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688629806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629806, "uuid": "b664e952-8eea-4aad-a18e-0574e3a544b4", "comment": "Malware payload (Mirai)", "value": "e5d98a995fc62215226186a13b9236f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629806, "uuid": "15a2f943-2a8f-463e-ab05-85eef03e176b", "comment": "Malware payload (Mirai)", "value": "751b24fa44b07c81955e8297a7c76ddea96faed118ce03eb1d1eebe4b6d37daf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629806, "uuid": "6063812b-002a-411d-bd43-3cf2a94fa483", "comment": "Malware payload (Mirai)", "value": "206877ce311e85a9d6875d147fb2a3708b83b81e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629806, "uuid": "60d38f56-363a-4b92-b7a6-07f8c608084b", "comment": "Malware payload (Mirai)", "value": "0001ee89923fa45bce7d57e1cae8914e1d7215e0da1595b1439cc6809be8d6a356037c63fc4aa1aefaa2d61f6626b907", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629806, "uuid": "be3a0745-76ac-4d95-8e24-4432713668fb", "value": "T197A2E019BF28818BC836297551D9E5D21397FC61F29DCC096940C12FB5A33A92830F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629806, "uuid": "d2911c8b-269d-4524-9373-3da607ebd82c", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTV:O98o08kxofBE+ZkXaITbp2F2TWul0c5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629806, "uuid": "59d6dd21-7488-4db1-bf46-b07380c1518b", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629806, "uuid": "fcb75008-466e-4afd-9a5f-6597a3a96c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629806, "uuid": "2bc533af-7f3a-4a8f-81cd-206d7d91481f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7dd517-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622643, "uuid": "c92a8d8c-fbec-4def-af0a-048bc826ab77", "comment": "Malware payload (RedLineStealer)", "value": "2c33e56009e701ee674d407ccb2436ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622643, "uuid": "599cbc5d-bcb4-4174-974f-476e60103651", "comment": "Malware payload (RedLineStealer)", "value": "751cee955bdb193113b5c0919fb17e7a4c55df6afa2ff3e98e94b121b224e74d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622643, "uuid": "2d746ce2-2b8c-4d75-b273-66eb7d108778", "comment": "Malware payload (RedLineStealer)", "value": "c4e0241df8d6b0143897bb3a93cef51cc9e06781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622643, "uuid": "2dc0d029-e122-45b7-91ba-a58806ae8fff", "comment": "Malware payload (RedLineStealer)", "value": "36b725fcf80921f95bb0a3e83a06c1fbea5b6183ad8152048900d6a22b6465617eecd22f2d16a5518f37b9e6d9d6c91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622643, "uuid": "1d71e596-cffe-4f96-9129-0ef0c194218c", "value": "T1F116015A506D4D5FC53138712BED1993FAACA470272F4E0222C2EDEFD4ACD80F6A599C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622643, "uuid": "f16bba38-795b-4816-b3fb-eaae01bbe922", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622643, "uuid": "c5915f92-b537-42be-ba3c-665ba51b5bc4", "value": "49152:Fa1Gk95eyK7b4u7mOFkb7G2vm6FDgROSHl+5kpXLWbcZVFIg9kt09Xpsr15Li4O7:Fj7LIWOs+5Uj7Ip2XUHin3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622643, "uuid": "e8e7b8a4-2eed-4197-97a8-6e4bbd916fbd", "value": 4089160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622643, "uuid": "473c1282-220e-46c6-9e8b-3853e64e82a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622643, "uuid": "d025a61f-c72d-4f50-b9ac-f9cc8f7b3f3e", "value": "2c33e56009e701ee674d407ccb2436ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f14538-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648757, "uuid": "5bca1ed9-d963-4e80-bede-5108dc85ced4", "comment": "Malware payload (AgentTesla)", "value": "80249066296d37bcdcabd4d2ca287bfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648757, "uuid": "f7c1cfc8-b03b-4e1e-9449-58093bba3b10", "comment": "Malware payload (AgentTesla)", "value": "756c7451de448539f72d545a1e46225ea56089517539d430ea33e487d03687ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648757, "uuid": "57586d90-9595-4095-bbd4-c056127f1194", "comment": "Malware payload (AgentTesla)", "value": "629b06a1c40a6426aa98beb53a50d4fda352f56f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648757, "uuid": "974ab588-e26c-43df-92b6-8a13317ba667", "comment": "Malware payload (AgentTesla)", "value": "8dd237e055a2feaa1251f263299c828a5f2d11f173833cd9262c97b4904ef1471af4e02d95ab8091ed67b0a35d09f46b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648757, "uuid": "f0f9be8d-cb5c-4117-9580-0d7288d592d8", "value": "T18C05025E16FB461AD95B7F7D0D200172E7EE4A96B427C6078FAFA8D8EF127044A502C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648757, "uuid": "13f544f9-c3f4-4bdb-a7ce-96057264ef4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648757, "uuid": "ee6d9859-e55c-4ac3-a2f9-c1b179aeff5f", "value": "24576:i0biRoSErVxIE5H+GhpxX8E34NRwsHZgEPU1B:iy4oRrjIwRVHoEs5hs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648757, "uuid": "3281b9ea-2a3b-4168-b80c-a87af558cd32", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648757, "uuid": "b20f97a1-2e6d-4cc0-8c67-7a2d9b76a52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648757, "uuid": "e9385780-f56d-4e7b-b596-783ab0442ba1", "value": "756c7451de448539f72d545a1e46225ea56089517539d430ea33e487d03687ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be877488-1bc9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688626379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626379, "uuid": "e0586736-19d7-4e83-a6c5-cb70391d1f8e", "comment": "Malware payload (Formbook)", "value": "abc9035ade55efd3730ea1e31c8ee489", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626379, "uuid": "05f85a8a-eb79-4840-b6bd-dabe58c3473f", "comment": "Malware payload (Formbook)", "value": "7577e3f2bc332cdb59411ea237512a16465445125f7b8485bdb63ec03824c511", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626379, "uuid": "aea1da47-92fa-47e4-99a7-bd6d0d58a791", "comment": "Malware payload (Formbook)", "value": "10a29f41df106984007f1773dad505707e240e78", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626379, "uuid": "6e9eed1b-81ae-414f-97f7-c0f727538f2c", "comment": "Malware payload (Formbook)", "value": "80958ed5d7c9bc1b3e0bf20fd2e5f80512546e3e97a38bb4cd2fc08b7534fae00fa7a247b4c8f01b4fcf0db7da55c2f2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626379, "uuid": "a3d21e7d-d430-4bb0-983a-59ac084483bb", "value": "T1F97423CE3B7A090AB00500F5BA78B47686F165146DFDD1D4C63C91A9EBD4E2836E273E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626379, "uuid": "f1a3a679-21b2-4a59-99a4-8019ff122bec", "value": "6144:FdwH7sn/WoVJnTmonR0ov+0KwQGKX+XGjz1RkONtFAhY8QNRD6SnjPE6RHfal:FdwbKWiJne2RKwfKVjznPNfAhoiwXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626379, "uuid": "ba4d880b-5b0a-406c-b8de-85b7203bab45", "value": 354297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626379, "uuid": "664dd554-482e-47ad-a718-e86de3644153", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626379, "uuid": "3da0094f-4a12-45c1-9ab6-ce1c7156622d", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb6ab7f-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1688642990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642990, "uuid": "c47b5134-9a70-4672-a477-38c8b8891ad6", "comment": "Malware payload (ArkeiStealer)", "value": "107c04590864856c6d7c4fbc9f9a3da9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642990, "uuid": "b7070676-12c0-41b5-a0c6-fb1e8fb9b171", "comment": "Malware payload (ArkeiStealer)", "value": "759edeee6e9ca27b5945680ba5ed35e3b8fc64542ab6ea52527480de4d5e7ba8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642990, "uuid": "f78f23f8-1a46-41b1-9bea-376440cfd204", "comment": "Malware payload (ArkeiStealer)", "value": "8653b5ed59fff0c98f645060d1787a83a4e9799e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642990, "uuid": "173d59e1-f085-404d-9e2e-c62e62c1fdfa", "comment": "Malware payload (ArkeiStealer)", "value": "a7c00af14adaff7bc7bd61591a800599532cbeeb9f0c5057b6fe70a9dc54f003d3eea0e83444ff0fcdcffc4b446145ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642990, "uuid": "16c040b8-c011-429d-9719-ae7e43127730", "value": "T1AED412253720D075E247643559A6D372C9BEBC304BB2E29767D80E5F3BF0B94AA38712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642990, "uuid": "309a2b50-418e-4e1b-a6a5-26bb3974e046", "value": "4187815841bc2ea783999b0bc5d86771", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642990, "uuid": "e86c3fe7-3e79-4ac2-95cd-6264a608d7f0", "value": "12288:GhG0jFMyLIYEKP/DN4yR2nFcXgHbqtVvAE:OGuG3KP/DunFYC8IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642990, "uuid": "014d6e1a-41e0-46dd-9a5c-0266839f7da6", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642990, "uuid": "0d86bac8-516e-47ea-b32b-23765958f314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642990, "uuid": "756c5031-524e-444e-b344-c53c1396d942", "value": "107c04590864856c6d7c4fbc9f9a3da9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72549d43-1c1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688661040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661040, "uuid": "b30d2605-3d06-42d3-9696-c361558c614a", "comment": "Malware payload (Formbook)", "value": "dc1ced16440c1685cfc2bfe7c9fda083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661040, "uuid": "5982ef5c-f8b2-4aa7-8d7c-f07337af2654", "comment": "Malware payload (Formbook)", "value": "75b39cc100daec7e9cb2d893a9f2f6b884686ae6eb68af1cead713f416764bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661040, "uuid": "819333cb-bd66-4810-9e34-a60812e0c9e6", "comment": "Malware payload (Formbook)", "value": "05622c2c2a58781a69bd62973d2ed2de5442567d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661040, "uuid": "f22885f4-cb37-403f-b135-d3a5af046be7", "comment": "Malware payload (Formbook)", "value": "5a85ec420e1d9d78b10eb6cb16baa52fd5738b868293928eced102f5de017eb796d47473ee1ced8fb8030d32c029a657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661040, "uuid": "07f6d68a-1b6e-4a30-ada9-aa8a7f186e71", "value": "T12F841205BBA0C0A7DD6616B05CEAE6F969A6BC118C29470773E07F6F3B311C1D2193B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661040, "uuid": "7aa70676-880b-47ef-85da-633c603ab154", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661040, "uuid": "5d070b54-26e7-4bf1-959c-908e42edd938", "value": "6144:gYa6MWtlljyUCysUFC3iWPzifvx/6ryKTz5+uukr3o8uGMpJZpCXS:gY+I3z0ZzSx/M13o8AncS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661040, "uuid": "b28e1546-a00d-4b56-842b-63b9502486d1", "value": 379423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661040, "uuid": "33ef0853-efb0-4f9e-aa4c-3ac991a4ecec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661040, "uuid": "7c913ab1-280c-4019-abf5-c17c85bc2278", "value": "enstomc2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d8430a-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1688622279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622279, "uuid": "1ad8c945-b941-49d9-b4c2-1a205f873009", "comment": "Malware payload (STRRAT)", "value": "70a0aefb832e99006ed06844554ff498", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622279, "uuid": "b121cefb-6cef-48fe-b17a-d334c0e38da2", "comment": "Malware payload (STRRAT)", "value": "760e559a3535b27d012b29e4c44767e7261e7a29f45b78189196d85b25876b5e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622279, "uuid": "c69264d1-45e1-40fc-87c9-0b0752561ec1", "comment": "Malware payload (STRRAT)", "value": "eefeee9919557f65474c7c01d11f900aba1c0f31", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622279, "uuid": "18cdccdc-30e3-4369-8040-447137d5201c", "comment": "Malware payload (STRRAT)", "value": "4fdb5f4e60d802d3576d386b1ff708c05a7ceccd5fa8e45c1d7549a3d6578650ad1e0022c0c8f696d648fc72db7bd50a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622279, "uuid": "eae199ca-75e3-4067-a629-5ff3f543c262", "value": "T16C63F1BC7E54C3B4F517D03CB0858F47A490C4EC76B6901706AF996A246AE4B1FABE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622279, "uuid": "94bca0b4-858c-4a76-8915-37075379c80d", "value": "1536:EUUaKBlG6NcFSsprgb4OZ8kUj0DTIQLChV/dEu:EDM6NcR8b4nCTIHPKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622279, "uuid": "71acdc23-e4f1-4dd3-b946-313016d867b0", "value": 72288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622279, "uuid": "b4fc384a-d9d2-42da-a1a9-1b79e97b1f38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622279, "uuid": "5af6afe9-8a04-465a-bfd2-489e51262184", "value": "Cotizaciones.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8386d8-1c55-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688686294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688686294, "uuid": "0e4005b0-b1be-40e1-8bc1-399a7b491b4a", "comment": "Malware payload (Mirai)", "value": "b700a5e2fcff4d7c311a01cd402c4440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688686294, "uuid": "615ed8bf-2290-41a4-bb72-7d77c61a6584", "comment": "Malware payload (Mirai)", "value": "761a823f2c1b717869062fe298782ce4f41a00bd131c3080bfecd55c3220c087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688686294, "uuid": "c9c232cc-0202-44bf-a34f-6c658b457fe3", "comment": "Malware payload (Mirai)", "value": "21109fc743fee60d9deaa460195ff97f6d09495d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688686294, "uuid": "08856df7-757d-415e-bac5-73593192ff27", "comment": "Malware payload (Mirai)", "value": "845b2236a5188d82c6e1d16a55a4ed788939d53ab3edbe6b9a2bb3e9753c379bfec1259104edb14e4e616fa7cf13f301", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688686294, "uuid": "9646b1ca-3d67-4050-bf51-5f5845830bb0", "value": "T14BD2E1CC3208DB9DE7A9C0B952F147643CE80EF29153CC87EA79A697CE174B458976C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688686294, "uuid": "dfb5b6ce-dd88-4675-974d-dbe4379b245c", "value": "768:oaF/cEtpE4PhjtYVPUfRjhn85ep+DzUuYDc6rBJgGlzDpbuR1J9f:7RKrPU0sVJuHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688686294, "uuid": "81d4d241-1837-4c72-91f0-b54269dd4087", "value": 29780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688686294, "uuid": "e9cf0cc2-522a-4350-873b-f1c1776a3627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688686294, "uuid": "198c04d6-ad80-4981-adcb-3f921bf6a25c", "value": "SecuriteInfo.com.Linux.Siggen.9999.7722.7621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec61239-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688642942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642942, "uuid": "ae7f70af-40a1-45c6-a14f-6648ee19e07c", "comment": "Malware payload (DCRat)", "value": "16489c0a78f9671c77a423bac9fd5e6d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642942, "uuid": "870239da-8f20-4176-b07c-cf5b525edeeb", "comment": "Malware payload (DCRat)", "value": "76677382ba8e545283738d07b6b5613bcc15ce13346a152764f93e2080ff2a58", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642942, "uuid": "36636153-ddde-43b4-94ee-ef99986e856d", "comment": "Malware payload (DCRat)", "value": "b27effe37df3698d1eb64f28edfdf299430ac405", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642942, "uuid": "26843c44-0c1b-442d-b93d-9717e84f3e54", "comment": "Malware payload (DCRat)", "value": "a8ada3d7e4076861ec8657755bb8afb9527977e98001eb492f45b6a5d186059ace95689591961bad9493b49be4682fd6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642942, "uuid": "505d0f62-30a1-4dae-9b71-72cb4d5264df", "value": "T1B695AE027E84CE62F0196537C3FB440887B09C5161A6FB2B7DBA336D59123A63D1D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642942, "uuid": "94771515-359d-4cb3-b575-dcec10106219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642942, "uuid": "279a029d-df12-4e1f-a3ad-1af23af5f81a", "value": "24576:Sg4AhK1eEOUVygN0gkuGdL4BgXMS3U2lEeWYRw7p6icMmoSF3w3ROMJw0CDfWVl:T43vVYhrEGxa7p695qh9JSDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642942, "uuid": "b1539a66-2077-4c85-9bba-fe9cd0ccf488", "value": 1992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642942, "uuid": "1e657ef9-306e-424f-8122-a0a9622ee987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642942, "uuid": "000d4c2a-00e8-4a4c-9e3e-f286be21a083", "value": "16489c0a78f9671c77a423bac9fd5e6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab97389-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674449, "uuid": "a247eb96-d5ec-48b8-b23a-b38e6926e994", "comment": "Malware payload", "value": "362fb59765ff1ad51e586b2f7879adad", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674449, "uuid": "06a5e0bd-b704-43f6-84db-09f35405a5a6", "comment": "Malware payload", "value": "7683b75939a2f8d6707b7b7493e6a444cd8a3f7305cbe92bbf27920388794018", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674449, "uuid": "2c4f000d-7e88-4df7-a4e4-6d030f66b052", "comment": "Malware payload", "value": "1aa48f75909fc26a2e77f4e92deba6a566319bf5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674449, "uuid": "a5fb35bc-7742-4d78-b9de-a4825fd86583", "comment": "Malware payload", "value": "944728a0f65f85507904412236fcead438a610f32a59a8e644a0e418105898151d8aa736d8722c27388064b4bafbe2af", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674449, "uuid": "97829421-2c0e-40fd-8313-f3d9c950bd20", "value": "T11CA3F7C2AD42BE33C2C2EBF5FBEBD24837F3561497DB3341A9995EB0461A9CC1919214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674449, "uuid": "ac83a161-d612-4ac6-ae5a-9edaca1daa5f", "value": "3072:m+YDhUl7hTFeboNzIcVQTXPPxp5AUCfyPh4Vj4:ZWSZ1FeboNzIEQTXr5AUCfy54Vj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674449, "uuid": "7a03725b-72d0-4d6a-9868-5ba493b52cab", "value": 99440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674449, "uuid": "bf254192-4f36-4cc1-81d9-826110e5c074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674449, "uuid": "37d15524-0199-43ee-814c-a2fcf973037b", "value": "armv5l-20230706-2014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cbe6a8-1c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665574, "uuid": "7e7b66de-d4b3-4ada-bc50-fedccaf05dbe", "comment": "Malware payload", "value": "c50a822bc6718343eec68d95b6afa016", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw Veonikdfkdks", "colour": "#0064FC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665574, "uuid": "72b5f120-c48d-4f93-a8a2-bf8179a3d0c9", "comment": "Malware payload", "value": "7695a29f94c9ab1075804d5b2682a45abf67f78260a6cdf74fb91eff5e92b847", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw Veonikdfkdks", "colour": "#0064FC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665574, "uuid": "1d997e1f-aecc-4418-aaa2-87b1966f40e2", "comment": "Malware payload", "value": "200f1860f77a2ae61ebb1ff6bac92aa0b8425098", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw Veonikdfkdks", "colour": "#0064FC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665574, "uuid": "87bfc393-ba3a-487f-a652-a694b9648452", "comment": "Malware payload", "value": "7453cf74f88456ff810305133474c9cc9e2174dde46ff03093a1ba881f7389bf6e0a016375721dee21c0a9732bed3f25", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw Veonikdfkdks", "colour": "#0064FC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665574, "uuid": "38773881-1673-4800-ab51-3b03975813ae", "value": "T17A7423E08079A099D8EF55F38EDF1563D683121782D8E93E3B549EB8960C3BB24434B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665574, "uuid": "1592313f-0451-40b9-9ecc-4271451324da", "value": "6144:4R3JLesg5iS9oGSFth55Qm4jX8fZKqV5kDVbiHjyiCK5iKYKTYg8l0rDSOy:a3JLeP5iS9oGSn+jMhrxW4i2Y0OOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665574, "uuid": "fa6a2cf1-10fc-487d-9810-70a944dc39a3", "value": 356066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665574, "uuid": "1e3a234e-ae9a-4729-b1df-433db4fe21f0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665574, "uuid": "7cbfef3e-7bc0-4eea-b802-5d8bbd29c39f", "value": "Veonikdfkdks.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b02b0d4-1bbe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688621380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688621380, "uuid": "02c95efd-a8b2-45b8-9e53-6574db9c6ee3", "comment": "Malware payload (AgentTesla)", "value": "bdb3bf93d494ecbac917008a8b4281a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688621380, "uuid": "47ab1bb3-10b8-45df-81f3-5ef57f80232c", "comment": "Malware payload (AgentTesla)", "value": "76d408f5bf2d502b7118d0af045f6a7cc9faf8316a304887298f011521badb32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688621380, "uuid": "3ac60476-830e-4c36-ac35-34411a0e238c", "comment": "Malware payload (AgentTesla)", "value": "08ed3edae4eac09c8e08663c48239da686d78963", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688621380, "uuid": "9c1fb62b-7cf0-4e26-8d51-da60cb0aea6f", "comment": "Malware payload (AgentTesla)", "value": "b24eee8cf2c271a664d45b6e69968054bd7d4a79ef10608a1ae2c5ef92c1b8adb3f50a7b18f8fa57aa06458c662e4207", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688621380, "uuid": "5bfdbfa0-bb53-403f-a957-103617631fa5", "value": "T12FF48C3C18BC7622C174F6F68F9CC425F690946A3E61CE3769C39899461EE0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688621380, "uuid": "7dd9cce2-54e7-461d-959e-a9181c635bd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688621380, "uuid": "15ac481e-19d1-4fc1-b515-c285c82fdc15", "value": "12288:+z+Ijhnjht249VGPSCWG0s8vpHQZ0SNLV9mbf2ky8p71zg5:+zTNnNtjODT8BH8Nh1LS1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688621380, "uuid": "b1ff2eb3-33ad-49de-8ea4-5f90fe22649a", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688621380, "uuid": "b8074026-2344-4ad1-83af-33efa2533399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688621380, "uuid": "6bdea520-4dee-4ac6-bcee-c3c44e4490fa", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29504.9518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b0c321-1bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688641804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641804, "uuid": "1987e9ae-50d8-45b2-b928-e687b7423a16", "comment": "Malware payload (Loki)", "value": "ef253953e0cc846f1e071dc650c7e5fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641804, "uuid": "35fd5ab3-a3f5-4936-b6e4-3cb2673a0d2c", "comment": "Malware payload (Loki)", "value": "7788dd0747429e590daeb3e7314c61a5cf831cf85a417494564152c69e7a429a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641804, "uuid": "3e520e59-33a8-4772-b1fc-a26221d9f453", "comment": "Malware payload (Loki)", "value": "d6c9b1de0cb5297e83e9c9172820b916a66cb4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641804, "uuid": "65eb3b0d-a582-4f1f-b655-3b0b8a306e87", "comment": "Malware payload (Loki)", "value": "0f7a7ff3e525a95433583507543704c926e5e330e95dc83ca4d00c0d142b022aa47fdf12ae497e2e68ed1ec3402d8624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641804, "uuid": "1ea5f939-2a2a-447d-ab9d-e2708939df3b", "value": "T103E4019933B7121ECDAE7FBD28560679CAF9A9123506C3479ED7389DDC18F4A8600393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641804, "uuid": "f5426315-d340-4449-a86d-b4d8ea646324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641804, "uuid": "14664ad1-199b-4b6c-896b-a8faf5f42e75", "value": "12288:Nd6L7PVZfuiubhaDnLMzIL2q+RTdOL8BVZGG5K3Y1JUR8szvd6eRkHd0wH5d:hOyqGUL83ZGZZSCVVRkHd0s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641804, "uuid": "9f19ef4c-69d2-4a59-8a9a-17ef4bd71d5d", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641804, "uuid": "90cae61d-675e-48a2-97c1-592b6107f0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641804, "uuid": "56b2b3c6-8229-435f-b2f3-27172970596b", "value": "7788dd0747429e590daeb3e7314c61a5cf831cf85a417494564152c69e7a429a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911b9c9f-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688647348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647348, "uuid": "e0416dfe-fe3b-4455-b479-a4e378131f27", "comment": "Malware payload", "value": "d63c0a558ae60ae055d8f2aae1d0a494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647348, "uuid": "2f818fe5-6988-41ad-a2e5-42c050d8b27a", "comment": "Malware payload", "value": "779411d073c1aaefc7df224c9e972fd3ea848944b7fa92412c5cd71da512a729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647348, "uuid": "c6309897-fd21-4529-9667-e99c95219548", "comment": "Malware payload", "value": "51ed78431c44402abcea6913ecf845e1662777ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647348, "uuid": "e4e6ff3d-7a1c-4922-baa4-7bf29885722c", "comment": "Malware payload", "value": "20234286849f855350d8d3e92f893560e982c8677ad731e44e5453122edc6adc0302c1210a16584a482364362d2719ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647348, "uuid": "63e2ef30-4e59-4334-aa7a-7b056b30abd4", "value": "T132B35B67671800FCD2A7E2FCD6A20A53D7B1B8450710A7CF13B0856A0F93BD56E7E6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647348, "uuid": "f0fac1e3-6c18-40c0-9df1-489d7b9b444b", "value": "b319f563dacb591a4bb27f0e4886a036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647348, "uuid": "ef0fcb48-af48-4f06-bc2a-4400dfcba298", "value": "3072:Yppjdz7eqQfZ8G7A5G390uDmJTQSaMm5/6lWOax9gg:YppjdPsZ8qqWlQWx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647348, "uuid": "78fb3d0e-2faa-4d4e-9b88-1dd261148f32", "value": 110080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647348, "uuid": "f6e31c07-4c19-401c-b3f8-4e606e0208b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647348, "uuid": "0bae3044-60da-4169-bb43-6eceff56e6f1", "value": "kdmapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62ef403-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623842, "uuid": "659e465b-2ffa-4292-ba01-fc42d5bcd111", "comment": "Malware payload (Amadey)", "value": "ce5c44ad546fa6b80945ee35b3023507", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623842, "uuid": "a80c3555-5508-4da5-a8b8-47804d73770b", "comment": "Malware payload (Amadey)", "value": "7829b0a81c18c27f3726dc63beccbfcfef17da764226a113abfdd84bad2f3906", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623842, "uuid": "c85a2ca9-c8a0-4a29-a59a-922129591f31", "comment": "Malware payload (Amadey)", "value": "d685010240de1f038aee77f4cb4b003ce2e112e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623842, "uuid": "1e95b6ca-bd39-42f6-a266-e342be26b7d8", "comment": "Malware payload (Amadey)", "value": "4c91724742a951ab7d898a79b3f6ae745a7d4bed7562d3db82069a7512409b78907cad4890e45bc6cee6f2892b3e60dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623842, "uuid": "672249e2-4545-4e13-a3f5-32e3597470e4", "value": "T14F060101249D9E5FE439397633CC4957F82CA4B0DB1A1D4522D62DEFC89EE83F6A648C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623842, "uuid": "c5f103e3-c970-4931-8911-f15cf4223b0c", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623842, "uuid": "b69fee9c-b8cf-4231-a280-e7d6939073be", "value": "49152:NrBTSVGJAsbDWsAJ0f/UlHoVQYix2M1fVVYfIsoYDL9/9HhRiL0dgmeRsNOP9lZh:6GiUXiJm7Q85e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623842, "uuid": "4d17d034-5ee2-43aa-8628-b82297eba339", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623842, "uuid": "526fd8c6-024a-4394-8f15-d9fc2df5df33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623842, "uuid": "abc9492a-4055-49a0-afca-4c227b0bf499", "value": "ce5c44ad546fa6b80945ee35b3023507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11e9cd4-1c0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688655186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655186, "uuid": "a26ef608-f3db-464d-b7d0-993d166392b0", "comment": "Malware payload", "value": "5e5b5feb334b03dd26f95f546e28b1af", "object_relation": "md5", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655186, "uuid": "370adcd6-7aee-42af-b23e-744aef756da7", "comment": "Malware payload", "value": "78b2fa0df9fba56ba6a773faa0d280977a1a830fce4f2427935f87de11cb9012", "object_relation": "sha256", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655186, "uuid": "b54c56a7-4bc3-4493-ac57-57a0ed72ff68", "comment": "Malware payload", "value": "277bf2d1c1e78ab309e67a0cff9af6018b68307e", "object_relation": "sha1", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655186, "uuid": "bc91732a-0f95-46b3-9db6-21dbd300cde7", "comment": "Malware payload", "value": "e674c11d27a44ccbc48fea4175919721d5f0cbf2f25b05d76cab5ef58f138fc45a213191b4d2e88b555ad16f4b6582ee", "object_relation": "sha3-384", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655186, "uuid": "3b36e9bb-0246-47b0-babd-b68286bce46e", "value": "T1FCE5334CCC6D9B0F6DA87170AA6AA19CF27702B4153FCD598097E433C5F9308B1E697A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655186, "uuid": "1c400e23-b226-43b4-a303-7c1b5780ccbc", "value": "49152:/j19X4zyVjJeT2IauAMpSAvJkzrMV70jjKw3dr4gM21qZnTwywODkP:/RMypoIxqcYgKwNr4PvREekP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655186, "uuid": "58d7302b-52ad-492e-883d-a99d521ac138", "value": 3030908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655186, "uuid": "013341b8-08ed-4c1f-80c2-9da53b9ebc8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655186, "uuid": "4631bff6-29d3-4073-a895-9ee619e5819c", "value": "MacBrawlEarth.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed06da59-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688628175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628175, "uuid": "66887b49-fc96-4b2b-b24a-db67e36cc4f7", "comment": "Malware payload (Amadey)", "value": "bd28ec39d760ee69278dc85ee206f125", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628175, "uuid": "7e940b95-33d1-40c8-995a-c383183188a5", "comment": "Malware payload (Amadey)", "value": "7903319e3f19f469b40102d5a56943bfa021d3be6674df07bf7e3ee669697103", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628175, "uuid": "56905170-bfa8-473b-a2b7-03a9f5f4c45a", "comment": "Malware payload (Amadey)", "value": "0bc43a8401505f915d80da8b9a4dee3209b38612", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628175, "uuid": "261210a9-6014-4630-aeee-9b38842dad8b", "comment": "Malware payload (Amadey)", "value": "5eb91f1f302adc128ce5ee2251ac200637403a6b38e1e51fcd3d08457a36eba46618cd0c7e53e60d74cf4896a44acc53", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628175, "uuid": "f19d09a6-51f7-4ada-8271-d1c98d01cfea", "value": "T193060112255D6EAFE536363523CC4553FC6C9430DB0A0E5522D2ADEFC99DE83FAA248C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628175, "uuid": "2f77c8b6-46f9-4f10-a1b3-410720ad6ae2", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628175, "uuid": "bf12d3fb-99a7-449f-ba7f-e0cda219dbb4", "value": "49152:JOHVOP2qBbZVW3Fa92O0bLcWcCpk2NUPUUD7hJfXMrrKUOhQySwdFgL2YQq36Edn:HP5WO2e37h+rhwg2LEV0c4N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628175, "uuid": "b8481971-400c-4de0-9362-34f1b83ab015", "value": 3795784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628175, "uuid": "aa1024ff-cf90-4026-9860-64298f38724c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628175, "uuid": "6bcd379d-eca4-4a0b-abb0-1206495a7bf4", "value": "bd28ec39d760ee69278dc85ee206f125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d46b46-1bae-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688614825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614825, "uuid": "95aef8f3-88c6-4c1c-b112-ba90535167e2", "comment": "Malware payload", "value": "830aee528f30782cc88cfa64e8134182", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614825, "uuid": "43831374-b369-4efb-a7f9-cadeb93269f0", "comment": "Malware payload", "value": "79884c574c9e3ce5a983d36ebe3fc7eefc7e21372d044d3c78102778c79a0456", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614825, "uuid": "e93147b0-8e0e-446d-afda-c7a8f60a06bf", "comment": "Malware payload", "value": "66029dab0838b3981f2dcdf6dec14663d03fa6b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614825, "uuid": "0c8d650a-a2be-409a-a534-40371dc638ba", "comment": "Malware payload", "value": "76780ca7fcfcc518cc1ec4bfeef99540b5caef42c909998e96eb09391d2df5431e11fcdb33104cdc95cf11201407a45e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614825, "uuid": "96ac2900-6db9-4ba0-ac49-dc9762a811df", "value": "T16B448C5078C0C472D57A2C345674D6B10EBEB8311DE0DA8FABD8197A8F326C2D625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614825, "uuid": "55416ee0-af2e-4ee9-aa49-e8b8d2a28a5f", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614825, "uuid": "884801bd-6259-4365-9a4a-43ceb5349124", "value": "6144:bwEmDpM6FAWMVF7WZOWfU+BPBdmJJgZY6/RRuFL/bo7jJE:bbmDC6FAWMVFyZOWUAPBdmkY+uFLToPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688614825, "uuid": "b1ca2fce-5456-4a8c-b697-6d42e6b6014e", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688614825, "uuid": "763580b6-4acc-45ed-8a2e-88614e585cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614825, "uuid": "2b6b6b93-c6ba-4cc5-89a0-43e173e5037c", "value": "SecuriteInfo.com.Variant.Zusy.475489.26432.28908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da36cc4c-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638451, "uuid": "6c42e82e-132a-4fcd-98b4-e4d77d6e90d4", "comment": "Malware payload (Amadey)", "value": "7d82f0d48fe8ac54845eb4b3907349aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638451, "uuid": "c68392b0-c402-4b3e-8ddb-cbe749b136d2", "comment": "Malware payload (Amadey)", "value": "79a19af8eee4732d5799d02eb58194fd72193d6b3d7cd4809ebf351cb518f164", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638451, "uuid": "6fb22f73-b22b-491f-be7e-a1256297db8a", "comment": "Malware payload (Amadey)", "value": "1fa5e1d41b4dfa43bfad8c6688bef460db059463", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638451, "uuid": "614ed049-00a5-41e5-9bfe-bd67ea8b7ad5", "comment": "Malware payload (Amadey)", "value": "5fe219360d8bb84d7928c38bc31ed7f6d1c72159057d2b3e30007be7f6ee30c8fd36d0c425e3072c9888ffab7f011a58", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638451, "uuid": "032a28db-c06e-4198-bdb5-e93089ba6140", "value": "T15E060001259C5E6FE13A3A3937DC0653F86C5570DB1A1D9521D2ACEFC89DE83F2AA48C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638451, "uuid": "fdec8d2e-0301-418f-b575-1744ec30b46d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638451, "uuid": "6255c494-e289-4be1-b46a-8a1ad8b00a0d", "value": "49152:6QagGRAAftoSmZHxUmj7znwv5HDedvhOSEjh5oMLj0aI5+kh6d2QGRfPR4CBriIX:S08OvKhKuQ+0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638451, "uuid": "f0423d91-1a62-436b-9ee8-2b2026f0ee41", "value": 3785032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638451, "uuid": "efd0bf0e-5a85-4480-8cd1-c2ce45e416c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638451, "uuid": "dde7dfdb-3ba0-48ed-8985-445dc20ae619", "value": "79a19af8eee4732d5799d02eb58194fd72193d6b3d7cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec678e4-1c22-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664336, "uuid": "bb6e956c-d8cd-48c9-99bd-8031f9bb6ace", "comment": "Malware payload", "value": "cc53b90f2680000a6da047cd316951e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664336, "uuid": "93887991-a703-48bb-bdeb-9280a0030653", "comment": "Malware payload", "value": "7a03645778fdb4669f2b568982a722d19bf2a386bba16399d9a681242b2dbc4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664336, "uuid": "e1bf0396-7519-41d6-bc97-5f1d3e7e71e2", "comment": "Malware payload", "value": "e08e6cee632ca017f0d46cab4397b23a44185c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664336, "uuid": "d7063252-14e4-466b-b630-d7088a3b9b8a", "comment": "Malware payload", "value": "867500add1f28c38045e2285cb39a6d7fc05b9bdbd3d1b5442f13f71f6cf17ce23d9a0e38316c8bc10025e8f7a48006c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OlympOfReptiles", "colour": "#202795", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664336, "uuid": "1a5fc979-5c69-4790-9d12-1b17d87de8cc", "value": "T15A074B91A5C24062F674A0314C3E917FAA216B96477177EFB3886B8B5A30FE12D3734D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664336, "uuid": "d9d71c97-d50f-4e13-bc89-43e8820022b5", "value": "e570a5ba1acc24c066e0421ddaeb64f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664336, "uuid": "2cd65285-a35e-42d3-a3b2-9e3d6f988911", "value": "196608:ZAFJn6Pm1RQaR0o0uxT9Nozy9h33PxZynS4w4V/Jsv6tWKFdu9CkA1JV:ZxuRQaape5ZH4V/Jsv6tWKFdu9CBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664336, "uuid": "83901fb6-f74e-4798-a657-16e5fb04e71b", "value": 18006528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664336, "uuid": "0a964f43-e6b4-4fce-b3ee-d42f4680dd0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664336, "uuid": "08a60890-1947-4f38-b6a3-ccfe26b61794", "value": "OlympOfReptiles.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402435ee-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622731, "uuid": "8fa1abff-297e-4829-a949-74df82706372", "comment": "Malware payload (RedLineStealer)", "value": "5ba24f7c2842b1c937ebe1f9d49deb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622731, "uuid": "07ad43d1-0cbd-4deb-8b06-90f311f7dbeb", "comment": "Malware payload (RedLineStealer)", "value": "7a3276d4866dae3c91aba03c77e25a6edd0ff760fcd2363833c4554579a3ea34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622731, "uuid": "2c35bfcd-19c8-479c-bc6e-8916eb8b4d3e", "comment": "Malware payload (RedLineStealer)", "value": "10dc539550832c166f96124e38c6d2b77c1f3d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622731, "uuid": "3ab5c42f-ce96-45e1-8951-d0cc18b9c51b", "comment": "Malware payload (RedLineStealer)", "value": "bb72b0c8e284f958d0ae5912e6091057b91caf64f8ead11081f9178bc63d28ea6b6cf8238ddd54318ecd77fbbcc02546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622731, "uuid": "006ba6c4-4958-4223-bc35-5a2a4fa2a04c", "value": "T194160129506D4E9FC53134B127DD1993FAADA870AB4B0E0122C2EDEFD99CD81F6909DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622731, "uuid": "1a3cf39d-2425-45c4-a0b5-04b71b3bab7d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622731, "uuid": "244161ca-012e-4b35-be92-2d3d100da99d", "value": "49152:+H6qSbxQ6xXa2eLw3CbsHJtIxnlWX4NYhRL6ZjqYzBATW4CIPhrcY9iSMbaTeG7b:M6oYJhII1LTism5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622731, "uuid": "7d85e479-cd82-4eb0-aafa-ed8ed141163a", "value": 4074824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622731, "uuid": "0c756527-604a-46fe-a89d-bde063c1e832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622731, "uuid": "366e99f2-6f9d-4f03-a578-29973531d209", "value": "5ba24f7c2842b1c937ebe1f9d49deb37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f875969f-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627335, "uuid": "fe4ad14a-dc24-459a-821f-cb3f5521417e", "comment": "Malware payload (AgentTesla)", "value": "2589caea54b3cbc88e76db0ec1db2af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627335, "uuid": "ccea1f20-91aa-4042-a046-a30079c6174a", "comment": "Malware payload (AgentTesla)", "value": "7afe939050783774542f85269947fac8aa2446ac9a5875c11b49bd54eccbefe0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627335, "uuid": "b64f89e5-fbef-4141-829f-2a075505128a", "comment": "Malware payload (AgentTesla)", "value": "1dc92f2038d82faf0a7fd0d4a76552aa48c2135b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627335, "uuid": "40c189c5-0f0a-4bc3-9d2b-62422eefeae1", "comment": "Malware payload (AgentTesla)", "value": "025f8dfcd5ccfe91bcc01ca99ad12284f2e0539cf389cc37cdc756b568bfab76e0196bd9ecc9a9c5b48209e094e11ade", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627335, "uuid": "7f0f9996-8596-48d9-aa19-4240e37e04a2", "value": "T1ACD44A3C18BC3627D174E6F68F9CC421F250996B3D64DE2769D3989A061EE0229C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627335, "uuid": "eaf49c89-b6e0-42d4-bd14-909018e5ce22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627335, "uuid": "76f4514c-c2cf-4e29-ab6f-7761c18571e5", "value": "12288:1Z8NlKjapEoYUIh8di9Iu3SD76CAmwjfH3zFL/:RZJyw386CQ7HDFL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627335, "uuid": "ab1d190f-e112-46d6-9f87-71677409b549", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627335, "uuid": "b255dd86-b686-418c-ba4b-34a7be75cc03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627335, "uuid": "5088d6ce-367d-4c95-8525-733748d0e078", "value": "Solicitud de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab77db11-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688648681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648681, "uuid": "36fe314f-f4d5-4fa2-8193-0afc5b301ef3", "comment": "Malware payload (RedLineStealer)", "value": "a3b27f049a22d73ef54a927900c6eff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648681, "uuid": "18b827ad-aac1-4936-b6e7-5b74c9550893", "comment": "Malware payload (RedLineStealer)", "value": "7b40c4128a50bad16a3eaff13a76098cdb3f97cd9e5375df3473c173adbf37da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648681, "uuid": "47f4a86c-47af-4759-b3fd-9628a59fc2d5", "comment": "Malware payload (RedLineStealer)", "value": "84cc6cfddd93dda0b8c70ae74c8a133340b47696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648681, "uuid": "2ef56f22-5e8b-4482-b938-6d2d4ca9d75b", "comment": "Malware payload (RedLineStealer)", "value": "0aafd08113d45ffa60002485d6e083bfb82b5604f1b1bc9b2dfb13638253664ee514e42983902f6f0f0e1b773985a734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648681, "uuid": "f2b4d3c7-b188-48a7-ba49-807e3000f58d", "value": "T1E3357B04B9BE8861D492003A2DDC83F5DD6BAC611BB14DD39F501E2A8DA45ECE7F24F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648681, "uuid": "154cda03-1ab6-469e-a1c1-b133785611af", "value": "0f6a16cfbb36a4f68dfecffff25187a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648681, "uuid": "55faebe9-8189-45de-a6fd-fdef51d1c70c", "value": "6144:LhvWGad/1VqBFJlXdvaIBNJtJSeAOAwveHCwnx++hcMwml52Q6J:NG/1VqBfdSeRvevhc/me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648681, "uuid": "918f51ed-5cec-4a4e-9be0-9a65ac741484", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648681, "uuid": "e257fc77-e8b4-44ad-84ae-4df9a04e10fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648681, "uuid": "0c6ee067-14dd-41d2-9be1-2f459163316c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8584a1-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637141, "uuid": "43897e51-d555-49b7-b864-8c9980623f18", "comment": "Malware payload (Mirai)", "value": "c3a92a67685c6ee1c412cd2192190318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637141, "uuid": "5753804f-b482-455e-93e6-80c9ba936686", "comment": "Malware payload (Mirai)", "value": "7b4b2095922238037d3e28606a80f86dd5cdaa190de701e9e00c9997042b8586", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637141, "uuid": "80fe638d-1f3b-4636-b262-1288927744c7", "comment": "Malware payload (Mirai)", "value": "3007131110cdf5dfa3f669cb07fae38611594d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637141, "uuid": "3dc03e08-7337-427a-903b-c90b640e01e7", "comment": "Malware payload (Mirai)", "value": "0a9a95fa3264670d6a3ede661475f61b2efb545ed7a374cd9a2cb1026fb9d1e6fa11be0699c4b1cde8d92a47e544cf7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637141, "uuid": "72addd45-9fc8-4e19-80c3-e9671b1ea10b", "value": "T1EEB2D0A087A19317C6B0B475A37CCB935B3B19E4C5F63926172092BC968255633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637141, "uuid": "d1a63cfc-bd8b-450d-befe-b4388f457c3a", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BxgsYhymdGUop5hu71:4GaKQFH0rs3zWoDDRsjt7LB9U+BxWs3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637141, "uuid": "e9e721c1-c4e9-41af-8aa4-fd99b23801b7", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637141, "uuid": "c0427514-4ff6-4305-9ab3-fd2156fb935b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637141, "uuid": "dd33a4f5-8a38-4c0b-b2f7-e9aeb94af473", "value": "c3a92a67685c6ee1c412cd2192190318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a68f1a8-1bdc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688634479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634479, "uuid": "b1de7e69-060d-494f-8576-97fcacc10474", "comment": "Malware payload (Amadey)", "value": "e20b32efa986681adffb2f57147e3f09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634479, "uuid": "a9bd35d5-bb80-4a08-b3b8-0b1fb3e95051", "comment": "Malware payload (Amadey)", "value": "7b921e025c1518ce09f5d9335a87cec5cdb6268dec79e3905843ad0571cc6481", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634479, "uuid": "73ea39dc-ddd3-4130-8d33-5f48cf72c9bf", "comment": "Malware payload (Amadey)", "value": "3eef4761bdfb3ab2fe57e9c1fd148d6f34b41085", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634479, "uuid": "43901019-668d-4e3b-b0ef-59013588739f", "comment": "Malware payload (Amadey)", "value": "934b772dabddbd2634864221c1274483440a82a9c42a8f35efab1df85f29d9b7878fac85d97d214e9596cd4d93da5528", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634479, "uuid": "60f75578-c3e5-4a26-b1f3-fe9a00ee7f6e", "value": "T183061111644D4E2FE43A387977EC4413F96C94B4DB090E4522C62DEFD98EE83F6A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634479, "uuid": "1c269b39-4d32-4267-b4ac-89e7e5c81c95", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634479, "uuid": "178a1259-6913-4097-b07b-efa0f2343c23", "value": "49152:8bExZfl3MdPq3EhMn6wNQgntvytjLem6b3GE7Ran6sLLoYwze8wcnlU4vDe+L9Xc:CatvAedb0GNnlPs1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688634479, "uuid": "15235e91-f961-44c7-8ef2-6a2da12807c9", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688634479, "uuid": "3f0b7194-83e2-4599-857c-9488ecb1489f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634479, "uuid": "225baaaa-b845-4e6e-849b-7d4502e83f61", "value": "7b921e025c1518ce09f5d9335a87cec5cdb6268dec79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807debf6-1c2c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688668795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688668795, "uuid": "2961770c-86bd-44b0-91cc-94a2c9315da7", "comment": "Malware payload (AgentTesla)", "value": "bdd7553bc13603af4f4a63db7d2fed5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688668795, "uuid": "d9164585-1b18-46ef-824a-41ddaf79135a", "comment": "Malware payload (AgentTesla)", "value": "7bdb76bc212b1fadd5f61ea2305f0fc082fa6720c23f614687add9d4b3de2ce4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688668795, "uuid": "595ca21e-18f5-492b-8a42-7fc20341a0e2", "comment": "Malware payload (AgentTesla)", "value": "748dd2fdc2b1a93b2c994c876abfde23682c2a02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688668795, "uuid": "4f04738a-5173-4e61-a87f-f3bbfe9a406a", "comment": "Malware payload (AgentTesla)", "value": "150340eee94e0540c856c73920d0bf8e8a123e6cdccd071e129c260900868c6cd726c6d0062eaa9e3409c388279d77f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688668795, "uuid": "b5f7f29c-488c-4701-b395-0f4bee903de8", "value": "T153D4D0013AB79B43E1B9D3F229B1104017B5366A64BED22D4CC7A1FE5C76F044AA3B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688668795, "uuid": "623b5213-c80a-40b6-bb45-295f019a3e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688668795, "uuid": "be17480a-d88a-4e1c-93c2-95975262f0ec", "value": "12288:5pt/fT7wxIV6HqEMmnvs3emeqMyGPEICZpqNmw9:d/f4xZq/6U3eVyXpqYw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688668795, "uuid": "9d9ab2e0-c70b-4913-8834-43e65f412dda", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688668795, "uuid": "f7f84154-cd44-4281-90e3-adaa82994617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688668795, "uuid": "032829dd-a6ad-4546-8927-c9ce52e1eb18", "value": "SecuriteInfo.com.Win32.PWSX-gen.9905.23513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2167b75-1bb3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688616963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688616963, "uuid": "e8415414-6ca7-4253-9e6a-7ea25584f77a", "comment": "Malware payload (AgentTesla)", "value": "009dfe5001a2a856a2d15bbb01a1b8a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688616963, "uuid": "174eee5f-140c-4616-9197-726760803fbd", "comment": "Malware payload (AgentTesla)", "value": "7c01ba932f550fa515252105205ee3d58751fa8a33c386e50104e0cf4251aa2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688616963, "uuid": "2c0d501c-0255-4cd9-ad00-90636025421c", "comment": "Malware payload (AgentTesla)", "value": "06a4a39629abb52558c1e93671b2b9cf40c25c83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688616963, "uuid": "8d33d9a7-15a8-46ec-90cc-8584ff2e9327", "comment": "Malware payload (AgentTesla)", "value": "50986ce7d08defa4ccccd9030b7137640eecd055a87b5782d9081bf316e56ef67cda694c1c830b2a54df0936a0c70f58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688616963, "uuid": "b7e8cca7-6e44-434c-b5f8-e1576c057a01", "value": "T1ACD45B3C1CBC7223C174E2B68FACC461F650956B3D619E3765D3999A071EA0229CBE3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688616963, "uuid": "6cddb839-29a3-4daf-a47f-d9fad3d5198d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688616963, "uuid": "169c0a1b-4a15-4926-9770-19e16c294f8e", "value": "12288:zFIxjbmVRaOp+vXNRMEobL6DOds3sx6g8gN:+xjbmXadXv2bLUOdFx66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688616963, "uuid": "9de1e34a-68c3-4e56-8465-577e4a09b9f6", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688616963, "uuid": "026f2598-66d7-4cd9-a1af-9591cf48c15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688616963, "uuid": "365bd4b1-06ca-41a3-a78e-d71f59ae6197", "value": "009dfe5001a2a856a2d15bbb01a1b8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b9c61b-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623324, "uuid": "f3328e35-dc18-4089-8bc4-4cdb8051109b", "comment": "Malware payload (RedLineStealer)", "value": "8cf72db661ab75ba11455a12cdaf45c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623324, "uuid": "69a74240-48fa-4943-bb56-8abd3c802c1d", "comment": "Malware payload (RedLineStealer)", "value": "7c16779526614b1e663da4c742c014376ca77f9619d2c1adfbd58c5e3fb44620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623324, "uuid": "eb356f93-c62a-4920-9eeb-5f0c72d43ada", "comment": "Malware payload (RedLineStealer)", "value": "2a06657fb84305b5e0f7ee61579215fd9a54a688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623324, "uuid": "beedb730-172d-4a85-9470-3f743bf577cb", "comment": "Malware payload (RedLineStealer)", "value": "03be1532ec75dfda7218ac164a7f3e09c448a3be4cc252893747e219c0ba83eca76861e75f0804be43050b35d472bb57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623324, "uuid": "569f9b67-ba4e-46a4-8e0d-ecd970e9112d", "value": "T1B0160118605E5E9FC83530B527DC0593F9ACA4742B2B8E1126CAEDCFC6ACD81F6D198D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623324, "uuid": "997daa3b-9b05-457d-ad46-9a78ad3bd57f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623324, "uuid": "d83d06c7-a58b-40ec-be21-fd76631d8ef2", "value": "49152:fu7tFh6ngIhzYKzmO1EBb3Ulx2PcUdk9eYE6sPWnGFO7pqC9hnPJOaShwYqiJuCN:Fnjq5KlzS6o6DBp+ToK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623324, "uuid": "f85d487b-9d12-4f0f-a869-1973e162dfeb", "value": 4046664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623324, "uuid": "90875fcd-1415-4f16-ab1e-0accf2f0b4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623324, "uuid": "0df39418-44a4-4ba8-9ebe-1781ecb31fa1", "value": "8cf72db661ab75ba11455a12cdaf45c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76eec4ee-1bb4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688617239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617239, "uuid": "cf1e3206-14ad-4e5a-b4e1-bcd87e58068b", "comment": "Malware payload (AgentTesla)", "value": "96747c013d4d5da97af5acb7bce91c33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617239, "uuid": "588c6443-aa8a-455c-a7a3-12fd7d115b56", "comment": "Malware payload (AgentTesla)", "value": "7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617239, "uuid": "9cdd1d63-55c4-4e93-bc29-9c7e38029998", "comment": "Malware payload (AgentTesla)", "value": "ea768268680d272283f9acfd7d7bf1f6bc12bca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688617239, "uuid": "a6a28607-659c-46cb-8118-52fdfb96410a", "comment": "Malware payload (AgentTesla)", "value": "b16d7832b2810b82944beaa5f1853beb21be235dac73c26142f169bd29a6c7cb0938fc686ddd3030d66959ddd56a2e20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617239, "uuid": "7012ee5f-cc5e-4372-aaf4-a4005284e25e", "value": "T1B7842390A999C0FBED53A7391D7BC3852DF1F8121A32325B67A06A897933384CE5D743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617239, "uuid": "0e2b56fc-9803-436d-9936-bde1d0e955ca", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617239, "uuid": "4c940ecf-68fe-4fe8-a624-f7bd4b459abe", "value": "6144:PYa6277ozj+CLvTgHOMtyu8MWHSxaBTUMj8gPkWUqM3t/QgzjWE1V+KM:PYI77oz6CLmOM0rQgPy3Ll7+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688617239, "uuid": "4ec716a8-1730-4fdc-9c69-0601fc7b494b", "value": 382824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688617239, "uuid": "014b58dd-3103-45f0-89e3-371c42ef429e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688617239, "uuid": "a22f0827-5907-4115-ba50-7ec335ca416b", "value": "96747c013d4d5da97af5acb7bce91c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff226964-1bc6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688625199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625199, "uuid": "e9189e00-81e5-4197-90d3-eac83e095796", "comment": "Malware payload", "value": "5c5198fd3a1e64be2c4c0303ae35653b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625199, "uuid": "bb3a4e35-20f2-4697-8dee-fe0cad782a8b", "comment": "Malware payload", "value": "7c9c9ab9e756c8aa4b72f4e5adb380be1577ec7418ee75a9cf3bd2b7fd74e5ee", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625199, "uuid": "79fc15c3-7fd1-4de7-9a58-3ef189241652", "comment": "Malware payload", "value": "7d8bb65b8ef62e88208c1e882256db08406954f8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625199, "uuid": "7346d6d9-0d5b-40a3-86e4-a1e5215f4286", "comment": "Malware payload", "value": "1c8b6ed0a7230f13798235ee366e4ce84142dd298e5fdddbd1fe03b01378bec4971d0d7af7be23416fb3a9814fa35fa1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625199, "uuid": "1c36f89f-bd13-456d-b638-75e6bb699cbf", "value": "T19992D117A2D11BB7D7701A2D803B5A8E3AE021E60999F12F5E7C13FAA17274607F931D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625199, "uuid": "4b9e632e-f87c-47f4-b6d6-ce43e5f848a7", "value": "384:ByrhC3a9uL0OC1lpDKxVdiJNS+zXyFMnZQ6gjgJdkWjMTV5fhOT1:B6kom0OCvpOvdnuyFLjgzXC5i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625199, "uuid": "87d4b1de-e27c-4bd5-976b-32b95e054413", "value": 19723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625199, "uuid": "0a391227-37e2-4a3a-b2e3-0f057faa8413", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625199, "uuid": "e3fa4255-019e-415d-9a79-f370de08cb95", "value": "74be707634c42021f75b2e87e7c77b85672490c5adfa3c2891ca400c4d06a777.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2c18df-1c1d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688662156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662156, "uuid": "17cf9958-2315-448e-8ded-1a7d2093995f", "comment": "Malware payload", "value": "585312e72f09b093e9044d4a0d64b66f", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662156, "uuid": "a46bae73-01d0-407f-9cb8-32d1bbab073d", "comment": "Malware payload", "value": "7cd360ee7a4cfe3151db93f2a557a6b564648943ac3d787ecc006eee8c1c84b2", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662156, "uuid": "7bb5dcda-ccc7-4fe4-a5e8-da5835623d75", "comment": "Malware payload", "value": "0ba5a08b9bd960f579f6b2546a4d168efe60e7de", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688662156, "uuid": "8740d00f-268e-4968-939c-0820280a0c17", "comment": "Malware payload", "value": "bc8e1f26826bebe0ae3bfb708f95c389e74a48cf3bbd75460e40dd6a116ddb041b1cc9463d0bbce464fee4a7d61d0a1e", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662156, "uuid": "10c9ca10-a16e-40d9-822c-560a2847b7cc", "value": "T19455121A51A70F94CE5C953DC1EB0F022359AB2F1606D71B2724E63F3FF26F88929156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662156, "uuid": "7fa661f4-701e-40c0-90c7-96fcbdd5b1f4", "value": "3072:rDqbBsVbVS6iasV5DjLEj5uDNWlg/5a/FmVhz55l2JcHJ0J5hQiCD:CWVbVS6bY/5GFmVhz7l2Jc0J5WND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688662156, "uuid": "9ce5e0bf-d93a-4372-ada2-6af1f92c1e5e", "value": 1346025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688662156, "uuid": "f4f30eba-56a0-4f3e-8a22-2ef00c3cb140", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688662156, "uuid": "165a87f3-b4f3-479a-b4dd-65cae49154b2", "value": "Evolion.sfx.exe_Overlay.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35750a4-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674437, "uuid": "1148eb18-0d12-482a-aeb0-e4ee40ac067d", "comment": "Malware payload", "value": "0d00bce2a79e6a108b0db39da3e91673", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674437, "uuid": "2624916a-a025-4d24-902e-2b323eb0e38d", "comment": "Malware payload", "value": "7cd409e343d4d472da9184af96659b5b6a8f05d81ee3e2b3f3b938a445ea108c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674437, "uuid": "d9431fe1-37f1-4045-a32b-887c7b39af80", "comment": "Malware payload", "value": "265d82de64fd23ae40186bd11745bac73b123561", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674437, "uuid": "3430d306-2e61-4a4f-aab0-96e6e02856b6", "comment": "Malware payload", "value": "c7ca0752832255fb5107f8ead118f226bfd30ee0854cb636ac011e5c9ca8b4336ba77cd0f629b7dc5dd6b0d5a270ae0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674437, "uuid": "c38bdac0-9b34-4403-89dd-277a5da54e89", "value": "T179B3B6866E327FFEF3D9D77087F3DA2056E6659127928284E1DCDD400E296CC281E768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674437, "uuid": "63369013-e29f-4ab3-86c4-4795f07d076e", "value": "1536:xaDqvnSTeH/Xp5TvyeMgQdqaJjFrBNxWPah5A4:xaQSq/Xp5rCgAqaJjFrBNxGah5A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674437, "uuid": "274c9803-44ef-47e9-a632-fec1a70748dc", "value": 113323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674437, "uuid": "b7a1eef2-bac0-4489-b3b2-675f9c3bc4df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674437, "uuid": "7c1a7c70-3290-4cb2-8634-5fcb381045aa", "value": "mips-20230706-2013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d9e4b6-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637150, "uuid": "e7c843ab-c048-473f-b535-5ad88a33e152", "comment": "Malware payload (Mirai)", "value": "66af518934509023412d1e2e3ae92b2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637150, "uuid": "0bc5626e-b091-4eb5-8ecd-23d74a4f09da", "comment": "Malware payload (Mirai)", "value": "7d5159204f26fd124fbd222c3daa3fdaae57f1824916403d1b3c95295ed29547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637150, "uuid": "ce47bf6d-39e0-4bce-bc2b-8e849660d183", "comment": "Malware payload (Mirai)", "value": "03e5e6804bb19bce5944d0641bb86778a7936bd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637150, "uuid": "f5ea3dd8-0614-4da4-991b-90781541d2d8", "comment": "Malware payload (Mirai)", "value": "4f43f1e703ac0545b7cb6c76d1ca37772eb564503c1efb4a3db824e43f9aad4a5fb3841d8354eb5db99885507d965467", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637150, "uuid": "97feb84a-cd97-43c5-a193-7b40d1a608d5", "value": "T118539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637150, "uuid": "b3ec24d6-015e-4bf1-b7a6-1a4e82c6e8dc", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637150, "uuid": "444ebfa7-9378-45ba-9ede-7eadb83a518b", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637150, "uuid": "77eae11c-e84a-47cf-8706-43a2ea550fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637150, "uuid": "183f1eda-92b2-4442-90af-3ec565030a50", "value": "66af518934509023412d1e2e3ae92b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141fa040-1b91-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688602041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688602041, "uuid": "af4a6b11-803a-4be7-8a6c-9bbfb7cff890", "comment": "Malware payload (RemcosRAT)", "value": "18e6037574492a81ee29e165bdaccc79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688602041, "uuid": "2a26d7ec-943a-47fc-8bbd-b3121e7364f5", "comment": "Malware payload (RemcosRAT)", "value": "7dd1bce12c35fd8c9252f5c261986fee97d2c32ee2a1f9e0206587856d2e1919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688602041, "uuid": "c6a05b38-a645-4c90-a008-a94f49b88d82", "comment": "Malware payload (RemcosRAT)", "value": "11486648929205a59649a9a126326fa0a3615c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688602041, "uuid": "8c42e5d4-0461-46c8-9c22-45aaac8f68dd", "comment": "Malware payload (RemcosRAT)", "value": "e1e76661e66066bd6fadedb87d7809131aae34647d6a74e3a75bee78ea50a929b84d46d22de92c955a94bd2d49f3ee8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688602041, "uuid": "0c38c954-5bdc-4c13-a9fd-bf13cecdb6e9", "value": "T100341258BB6DD85AD194C2FC9524D6F222E95C7E0D2665CE1BC8FE2FFD27200EC910A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688602041, "uuid": "b799a647-0ca5-4a05-8cda-1ea290b43c35", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688602041, "uuid": "577c277a-7be4-4797-814d-515f678a9fb8", "value": "6144:mvGSN9gWuLpcBKnVBYAsmrzpyDfOXXVYB:mvbGWulcBKV3uOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688602041, "uuid": "4d23539a-54d6-4efc-abc2-3aa98b977352", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688602041, "uuid": "e21399fc-cc42-40cb-b8b4-21ea61f4b549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688602041, "uuid": "4763e404-0642-4131-a977-6b5d3a220e52", "value": "bOd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c303fd-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638466, "uuid": "c6185286-177a-48b1-ab62-918cee0e34cf", "comment": "Malware payload (RedLineStealer)", "value": "fcd46ec187268403b1cb2286072b9bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638466, "uuid": "fdb86816-4097-4c16-810b-517bc4c35798", "comment": "Malware payload (RedLineStealer)", "value": "7e1a45558903586bced87e3a32f48351a4fc40b422ca4f96acbebcc3a60b102e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638466, "uuid": "ed64ec06-8907-468d-8a8a-6d0144b01153", "comment": "Malware payload (RedLineStealer)", "value": "9408f233f00b251b987f0fd3197bb97cc4a2051f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638466, "uuid": "cbcfd0ab-eee3-441c-9b97-5e3b1787d9b0", "comment": "Malware payload (RedLineStealer)", "value": "6c865171ad6692dd76ce8d56c1b169dcb2d0d9083fff3df1d2b707becb95037985b8096c8a599931a2d1dfdfe501e3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638466, "uuid": "a67f815f-3483-490d-8a6c-348ad741ebd7", "value": "T1E655AD05E09D1C5CC572E7B2BADC23523EAC8574291DA13992E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638466, "uuid": "37697782-8e43-4d60-8ac5-9ceded1d7896", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638466, "uuid": "17761368-64d4-436b-94e0-736c08d77c36", "value": "24576:0U8t1MvGbfl9RD7UronbZXqiFsRa7lORqodaa5:0DH+uflYrqNXTV7lORqRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638466, "uuid": "9837034b-6bac-44bb-84b2-65b02a57818e", "value": 1344336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638466, "uuid": "0c58e9d1-c133-4f26-9b65-b0c7daa783b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638466, "uuid": "afec2f6b-bdbe-4d22-a7c1-bba00f012bd2", "value": "fcd46ec187268403b1cb2286072b9bf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afec20c2-1c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676606, "uuid": "91339ab8-d0a1-4515-9c23-b3415bf3aab2", "comment": "Malware payload (Mirai)", "value": "f3d4be60409acf193503481bcfedd57a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676606, "uuid": "0e2ba304-1586-4c6d-b5ff-072fe898a2a5", "comment": "Malware payload (Mirai)", "value": "7e2296a129601fca82b0a78adf2a337bad70be97aa407a12debb5ba330dd71df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676606, "uuid": "2b0ee207-5d80-420e-804b-0f15c9da01f8", "comment": "Malware payload (Mirai)", "value": "d6fe525aa1e62a05f430afc50e9f846ee888fd8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676606, "uuid": "32a5b86f-6498-411a-a529-74370b072f67", "comment": "Malware payload (Mirai)", "value": "8f5736e1cc2d3f22fe7831eec0843ff3445118211df80e382947b4de539b6549ed98e39a2cf027f124a3090021e2e7a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676606, "uuid": "82967e2d-28dc-43c9-9526-80ddad55762c", "value": "T1EFD2E1FEBEA3E9D6FF7052333A20DDAB2C59EC74CB09554865C9A422006A1381F5AC55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676606, "uuid": "801d8cdc-9c36-492c-ae42-87746e4e7283", "value": "768:aXj6gx3B/exi4txO5AyiL0TB0lvvrEn3Nig5Je9qbUIAbbA:adBW+kLC0lvj43NieJkhb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676606, "uuid": "acf241a6-cb96-4373-b51f-a9273b8d4082", "value": 28368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676606, "uuid": "4dd9fa6a-d40a-4703-a134-d374d13b4b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676606, "uuid": "58b015ad-3325-4567-8b38-2f6cece54137", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecab75af-1bef-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688642777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642777, "uuid": "daa2f440-3dd8-4b29-a3f1-eedbac392712", "comment": "Malware payload", "value": "d84fd1a5d26c5bec4d45cb2d46c72d2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642777, "uuid": "0aecb928-1736-4b98-8756-6889e801070a", "comment": "Malware payload", "value": "7e2999f73b2aa4002a0ce9aa74d4f0052a68b1ce43093eb044b053086645eac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642777, "uuid": "74e56531-1959-4e7e-a697-33eca23b2aeb", "comment": "Malware payload", "value": "5c6a1189f59c9225bf65fe28f13958017663132a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642777, "uuid": "8f0f4286-54db-4def-8cdd-11ff23e2f305", "comment": "Malware payload", "value": "b2ea830604056a92b60a9d6bdae6ad01898b66b78a2e0b7b178945db453865a0b67afb57fee54504b4e95a4596351471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642777, "uuid": "58c24492-5b1f-4f4b-810d-de655147f530", "value": "T1E4629200BB68D621D9F54A36DC5312F50233AE69CC72D75B349CBE0A77B33974A22392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642777, "uuid": "97bfb183-df68-4f4a-901b-230dd3268162", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642777, "uuid": "d2cbc24a-67cf-4cc2-b0df-d16efd7abe35", "value": "384:/CfxlJa00sypALQT/KYs/9SxFv5JQzKoX9GE:xC/QTJQzKy9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642777, "uuid": "454eb0d1-a0cf-4542-94ac-76c7f1f23725", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642777, "uuid": "b4f242e0-1ffe-4173-9b4a-6997c525b2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642777, "uuid": "5d1d9887-7824-48b8-909b-2fe36a6e879d", "value": "7e2999f73b2aa4002a0ce9aa74d4f0052a68b1ce43093eb044b053086645eac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1d0e91-1c0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688656067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656067, "uuid": "f22b4cab-72d0-4a94-a0b7-c16f22f1537c", "comment": "Malware payload", "value": "8e8b68944650838a6ca278fbcc4c2dcc", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656067, "uuid": "0f0b01fa-0bf0-4d42-9db0-c9844ddf3a08", "comment": "Malware payload", "value": "7e3d69ec2da5a65466e4ef4a0f4b715d31fee0000ef4318eab8914e9bf030024", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656067, "uuid": "8989c82f-d902-46de-8ad3-def8671b8941", "comment": "Malware payload", "value": "89e1cfc0fa65e4369279b78a26837e6259d4800c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688656067, "uuid": "c5540044-657a-4353-8541-174ea8e1d652", "comment": "Malware payload", "value": "8e35d1b15f66e193aed9388866e7876aa90583e4a919d971cee3c1584d7ea9587cda363c02b394b778447aef9e11d979", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656067, "uuid": "911b02f2-3c28-4711-8f26-b46f3981ec8d", "value": "T12F47AF11B9AC1E29D2C7E0784D8E47A21732F5244135E6DB3936F23DAE62E53C71D32A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656067, "uuid": "d1ba94b5-b525-42d8-8f3d-91ea07a0bf71", "value": "196608:/ZMtPell91s55vLQdeA6RTzwCVWWFJUQmL3P+V9odgiDAoIEM7gIqlec0GKB1Dmm:/ZMtPYuZQdeAiTbwWBK3WDfiBsoI7fL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688656067, "uuid": "bacb2632-120d-45a3-a316-743808c0cd4f", "value": 25164614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688656067, "uuid": "0287aafe-188e-4f38-a294-963092ee223e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688656067, "uuid": "1d1e9769-5492-4824-9bad-a752209d74e8", "value": "Launcher", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338ecdf8-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610254, "uuid": "6aada08b-4f97-4981-afc8-67376bc397f1", "comment": "Malware payload (Gafgyt)", "value": "226c94ffc0a5a2a7bbcdb2d912b43a7f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610254, "uuid": "0d6d82ca-59a9-4954-98d6-8d63fec0b9c5", "comment": "Malware payload (Gafgyt)", "value": "7e5058023229b4c0896b6470215c2423de916346b9b3d6cb88b32f93820e4e14", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610254, "uuid": "a99a41fd-ad44-497a-8425-5020a5d89259", "comment": "Malware payload (Gafgyt)", "value": "250136d13f13c138478f7bade3c75420c4a761a7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610254, "uuid": "f8c08dba-2a05-4209-8ba0-3106b0e243f7", "comment": "Malware payload (Gafgyt)", "value": "ade963ca7b67e093f71f5f2bc42be0b57780c70949dbb097c72a40a2c43bd9748041c93dbb1b920ff8604a9a3b2b6035", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610254, "uuid": "0318fd5b-99ff-4c8d-837d-65c699217073", "value": "T147922B85FD45D905CAC4563AFA8D828C7B266398E1CE33039B1A7F92574782F0E3F954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610254, "uuid": "179dbfb1-a361-4a94-8d9c-02a5e5a58e30", "value": "384:RmJiW39muert7D/3rjl68c+kyo1Y6/sQ2n8l016e3vuXFx4e:R2iWtmuqJ/3fl681pUEQ2nkzuvu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610254, "uuid": "1568af0c-6b07-4c6c-a1e2-203745a60b4e", "value": 21088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610254, "uuid": "23b32b32-28a5-4b8c-a095-319dfcad95f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610254, "uuid": "6aac83ec-3b48-497c-b88a-5d9d73e70d59", "value": "condi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02df75fb-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638090, "uuid": "02d88f6f-7620-4d4b-89a4-0ded853a7516", "comment": "Malware payload (Amadey)", "value": "6b2fdbd52d3f9d0eae2693671a537207", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638090, "uuid": "41a00f7d-fc30-42f0-ac98-64c3cc6abd57", "comment": "Malware payload (Amadey)", "value": "7e67c3b247f8df439d1fa1a811ea62c5b9a7cba3a304e7a852435523e98586e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638090, "uuid": "6c8ffe1c-e2c3-43c4-b68b-f7e10240f067", "comment": "Malware payload (Amadey)", "value": "5bf80bfc116a485e04c0d48915d388a2711f4d8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638090, "uuid": "7e80d9a1-b5b7-4023-8f0f-fa0fdac28819", "comment": "Malware payload (Amadey)", "value": "0e5d30bf00be0706b26dc01f27c86498a24359b8049851fe77b02f85e62a71841a0b680e1b4c4af0338799e4fe839bb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638090, "uuid": "2588bcb4-1943-403d-b86c-2c05765e6ed8", "value": "T16F560112281C4C1FA4B639251FDC5553B9AE63A957130D8632D2EDEFEBACD80F641B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638090, "uuid": "dc11bc2c-9c20-4903-918d-50ef2176e2a5", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638090, "uuid": "d736d1e6-550b-47e0-8942-c3bcb92c8319", "value": "49152:cGQiGT7lyheBgkuK9MeYZkwBdDRgayBDopaYm1m+DwXG9Z9fP+T24GN4Yu87zgVY:cGQiGTByh2aAt+G1eXG1nvpFgVqTOaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638090, "uuid": "cc8f0846-1f54-4875-b407-01c3ee24c585", "value": 6007112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638090, "uuid": "28dd8063-7eed-4b00-8376-688632235192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638090, "uuid": "d9dc8e38-6299-474b-bda0-c7f6236670b9", "value": "6b2fdbd52d3f9d0eae2693671a537207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a07a28-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624274, "uuid": "c00e8823-0292-49ba-8268-f6c1a2df20be", "comment": "Malware payload (RedLineStealer)", "value": "cdd834e0cf45f0635637798f7cbe9f10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624274, "uuid": "63ca8af3-4aca-4f36-9c7a-4b36f51996d0", "comment": "Malware payload (RedLineStealer)", "value": "7ebd728ed9c9cc04e58b68b6276a9073dc4ee04571934d5b4a3bc399100e4b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624274, "uuid": "df0d1abb-d548-4912-99f5-958232e5a19a", "comment": "Malware payload (RedLineStealer)", "value": "940c4c80252caac2a9ff2b388cf9fc92643551ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624274, "uuid": "c1a0a727-8b28-441f-9ed3-dbe020967918", "comment": "Malware payload (RedLineStealer)", "value": "3e6c22b82eabc0e6c43fb7c3e3d486f4a8802c198208236e9828f036f5d18d06df6929130617e83783f8c7f3af6889d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624274, "uuid": "a1202382-4696-4c92-b011-121f24dd952b", "value": "T150160149512D8E9FD63134312BDD1993FAAC68702B1F0E0122C2EDEFD9ADD81F69199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624274, "uuid": "86710eed-846e-41e6-a541-c4351f97e3c0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624274, "uuid": "6292d617-90a8-4081-90a3-e0a746f0aa61", "value": "49152:dfDDRKSZWngkUwp96H3Z24xHzkTFFG7lSKE/9u4qpfjJIzq4Y/+BOen+YZTPyTTy:94w2kyE0rurp7c6eOenRqTGqPdtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624274, "uuid": "bc000f3c-c954-49d0-a760-486e9fc018f4", "value": 4096328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624274, "uuid": "a22c25db-6bc8-43d2-a140-5b0c67dfbae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624274, "uuid": "2b8cf4af-f80e-4fdb-82d8-ee1aa52d0aaa", "value": "cdd834e0cf45f0635637798f7cbe9f10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4af683e-1c1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663380, "uuid": "dd5fddcb-4c59-400a-96fe-c918c7d39807", "comment": "Malware payload", "value": "cfb6dd755a27da256fa19ce9e1b81795", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw lklp21", "colour": "#1A03B5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663380, "uuid": "5e451733-67d1-4970-81fe-f47e66c4d9e8", "comment": "Malware payload", "value": "7ed26f6a1d79934b67fc9c19070328e75b26978f3885ae918d41d51ade69c489", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw lklp21", "colour": "#1A03B5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663380, "uuid": "ebdad381-2c1d-4813-af45-8555dbfc3b77", "comment": "Malware payload", "value": "88a6fc48a02eabf860869c523ed32ee75f47fa0a", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw lklp21", "colour": "#1A03B5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663380, "uuid": "e42f1b9f-a492-4316-b6e7-9286b020e58f", "comment": "Malware payload", "value": "ef2a5f2f13318825930bcf45bce735fc4637e160a68712825c190e5532ec05b51b5ade1cbc6477257f7fcce8f5bdc115", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw lklp21", "colour": "#1A03B5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663380, "uuid": "fc2c34f7-6493-425b-a458-3e7e788c4a36", "value": "T1B9152392130975699C285026BA0E307E26DF2D8D9B391BC83AEBB5F50F1638D3734B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663380, "uuid": "7a9ca735-28a7-4eb8-9181-1e103bb8abc3", "value": "24576:u7tCMF20G17YfLnWKiUXiCg6W7iNLyXjGos5T8NMug4ntTQFBl/XyjQj2x:Q920G1kfOSyXjGDoTDtTQFBlPy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663380, "uuid": "65a496b4-bef3-40f2-8b5d-6948bf8fdb5a", "value": 955556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663380, "uuid": "3fe4cb37-d5f4-41cf-bcaf-4c5b39ca07d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663380, "uuid": "1e5900c5-223a-465f-b1de-6bff62d19ad3", "value": "lklp21.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9990e2bf-1bef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688642638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642638, "uuid": "8e8fac34-6378-45b9-a622-b87b0c1d1d89", "comment": "Malware payload (RedLineStealer)", "value": "6fb9194dc3c3e7e11a322f4a4ce34651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642638, "uuid": "715cff4d-94f9-4cd0-9c48-5dd64a9ffdbe", "comment": "Malware payload (RedLineStealer)", "value": "7f80871db00e1ae279438d2bee7e177bb4ac0bbe862035494e675e24a704ef6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642638, "uuid": "2e742f27-07b3-466e-8aba-9f99d9d0b4c0", "comment": "Malware payload (RedLineStealer)", "value": "3448fb0d232d36d074622917894dd770bd8af508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642638, "uuid": "a5b34cab-ea06-4913-849f-01f3fba8658c", "comment": "Malware payload (RedLineStealer)", "value": "6fa2c87c1f2c6c5b2dc0591ef02d98e45f11df910ec923d4704874ac6cbf66e159ad1ca2b978891867b269308930a20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642638, "uuid": "e1bc0ab7-8721-4b0d-98b9-fc81821cec81", "value": "T1DB060111249CAEAFE535397127CC4993F86CA4709B0B1D8522C6ECEFC95CD83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642638, "uuid": "ca8b5248-5e9b-47e3-86e7-b8c4934e8e7b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642638, "uuid": "89406b70-11b3-46ef-b4ac-c30bef5aef5f", "value": "49152:eViy6S3iDxXqO8yqJocR5jwTDE3m7JxchOZQK/dBJOikpMGc4apTKK9lnjoI7upe:eVBYKYDE6ZtnJOifTZTm7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642638, "uuid": "e0b75145-613d-4a5c-b104-20b56ac3c66a", "value": 3798856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642638, "uuid": "8cdfe46a-c11a-4a7c-8a68-5b8eb18ce603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642638, "uuid": "63cfba5d-d045-4fb0-943b-b187c2778503", "value": "6fb9194dc3c3e7e11a322f4a4ce34651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5789f6aa-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688651976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651976, "uuid": "97da2204-8087-4d5d-bd3e-ed86bd181686", "comment": "Malware payload", "value": "9da6a8e9d56d6ef316d51352c81236ed", "object_relation": "md5", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651976, "uuid": "a9098333-3366-4586-87d4-7eb81caba125", "comment": "Malware payload", "value": "8050a585fe1d534cafecaa56bda08ce2ef3bc26ea2b0ddad90c6b0c2be1ef3af", "object_relation": "sha256", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651976, "uuid": "dbf00162-95be-4d41-803a-0ef1a8588460", "comment": "Malware payload", "value": "c619fa0ef314de17b76fbdeee76bbd97e04f7b46", "object_relation": "sha1", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651976, "uuid": "a971d52a-551f-41b5-92f7-857b01804cc6", "comment": "Malware payload", "value": "65ae0183172a33191c285d6544118b813acfdc0207e2ef38cc2742d3bb5aded3f3a3c16cd25e5ba9ac8fe857258b0ea4", "object_relation": "sha3-384", "Tag": [ { "name": "chainbreaker", "colour": "#B13A01", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651976, "uuid": "8978a5c8-6086-4b9d-803f-42153282c9ce", "value": "T18D73D8D628076D97A283C41F0186F9A3961C90479D0C643CB6BED3D9EF2A9A9C1F4CF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651976, "uuid": "2082b79d-263c-4c3c-8fb3-e075c39319df", "value": "1536:5NGZS2C+WUuj70wAXvbpwpY+w00M6llsuKvlx+4Roh0f:5NGZS2C+WUuj70wAXvbpwnw0iGuKvOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651976, "uuid": "9bde2805-baf7-4ba2-b53e-f852ef5d0074", "value": 80304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651976, "uuid": "484c0e56-83ea-46ad-821b-478e71a04623", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651976, "uuid": "d90999dc-4981-4771-90eb-3ac09c087b9e", "value": "installer.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16346eb7-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688644135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644135, "uuid": "b8ee3d9f-4705-4af2-af2c-df48a40fa61f", "comment": "Malware payload (RedLineStealer)", "value": "0181443c0a468982defc866ba1ae0201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644135, "uuid": "e99756bc-de49-49a4-945d-3b6efd8f3400", "comment": "Malware payload (RedLineStealer)", "value": "814ee8c00a4119c52345f434a317d68ecede9d894ab44c6982dcb7aa94676311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644135, "uuid": "1498c503-608e-4deb-85d2-3c7bf0cf37ae", "comment": "Malware payload (RedLineStealer)", "value": "0b256a754f843d223ffe4f72a1f1030d9d728d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644135, "uuid": "614febab-5bf4-415c-a141-1e3acd6aea47", "comment": "Malware payload (RedLineStealer)", "value": "306e21c13e3b7523b51438d213e9309dfa07365cfb459bf2b661df911a11ac9f2ec25a8eb4a627c723d968f2efbf6a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644135, "uuid": "1c17ba30-c70b-4bd9-8c5c-2036060eb299", "value": "T15B060142649D9E5FE43A353537DC8523F86D9974DB090C8122C62CEFC89DE83F6A668C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644135, "uuid": "b1dafd76-91b1-48c9-a5d9-2e8d45b8baa1", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644135, "uuid": "af26c431-49d9-4dca-8f61-d010c762ab95", "value": "49152:ReY+hFTNaSkv6UuP3eTzU7WwSuk2UOZE421qkHiRpdNGvMsIWs4Gp7kWnZ4HQymX:GTiwSSvnpdOS1XCbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644135, "uuid": "e49122ee-6882-4b30-9db8-c0196b6ed04e", "value": 3773768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644135, "uuid": "507008c1-6933-41c6-ac54-7bb36bc8dac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644135, "uuid": "90fc8e26-46fc-4cb1-ab9d-e4381bb66c10", "value": "0181443c0a468982defc866ba1ae0201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8a3f67-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648793, "uuid": "17b5d56d-78e7-4b0a-97b4-271847fda245", "comment": "Malware payload (AgentTesla)", "value": "10ce80e324dcd9e462a4e42ced6a1d2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648793, "uuid": "2272d927-5f42-4779-ab6c-becb71edca2e", "comment": "Malware payload (AgentTesla)", "value": "817bd982ca96a349552017122eab3db9f948bdabe4fad431145085e10ded2a9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648793, "uuid": "aae47696-c89a-4223-b96c-67aa654a27e8", "comment": "Malware payload (AgentTesla)", "value": "fa2d6bbc23434661a5cf96f18985f9061bfc9194", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648793, "uuid": "1b8d3742-2562-4769-b618-2dc221353a3d", "comment": "Malware payload (AgentTesla)", "value": "9ab65d5e1c2bfcf4c38595d5944ae11781c0449cb10d5ea38acec860b7c6cfe16496163bc548363e7aebc1e25087ed8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648793, "uuid": "f7112a09-2dab-48b9-b6ee-99cf05bd0f51", "value": "T19315123D6BF3982ED8973BBD8C612EBAD1E46689B5B7C2534F63BD8CDC50B400990590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648793, "uuid": "13e57c2c-a3d8-4832-b794-f1f97b5a9214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648793, "uuid": "b4b8a456-f9e9-48f4-83d9-aac423107ab9", "value": "12288:dQPWR28Le0cY+Yg9fb9Aqil2fluSSkL21fmXY+Cg1YPZDLIZq0cOP2ucRP96ivni:d8+xL9Rk90r9k5BaFvmozJuRf/xD2ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648793, "uuid": "02f503e4-5b98-4927-9705-61d3c5591797", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648793, "uuid": "94b10aa2-65da-4fd7-b2b5-a204412ba994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648793, "uuid": "2edb5b6d-a7cb-468f-8177-b3cb6648f385", "value": "817bd982ca96a349552017122eab3db9f948bdabe4fad431145085e10ded2a9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d209932-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623692, "uuid": "4d4c09ef-010f-419b-a369-005a5042735d", "comment": "Malware payload (Amadey)", "value": "97d7389b1b010b0eebf2819d70661e4e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623692, "uuid": "6e4c273c-837f-4c47-8e6e-5f7fa6fa310d", "comment": "Malware payload (Amadey)", "value": "8192d05cff7b0723f855adb321de75e93477c14319a6806483f75706fd179467", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623692, "uuid": "77f98f1b-536e-4063-a8f4-67bdfafa8282", "comment": "Malware payload (Amadey)", "value": "6bddcc8c4bce6e1ae9993d4f1dc4d3ad5b5eca32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623692, "uuid": "d942e6ce-1f7d-4729-984c-7d77513eb127", "comment": "Malware payload (Amadey)", "value": "49120cec761b7191697850ad6ebd9bc3d30e90e1576c983cd6de10327ea8991dd293b116ca54de357c37e912484d829b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623692, "uuid": "d382f6a6-caa9-43b2-af5c-2e33bf4bdaec", "value": "T17C060102259CAE5FE43A357137CC4557F86CA4B4EB1A0C4121D26CEFD89DE83F6AA49C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623692, "uuid": "f3cf3cd5-f46a-4adb-92bf-ac6f0db5aea4", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623692, "uuid": "aae5f1c6-f743-4992-87bd-6650e70bddb4", "value": "49152:krBTSVGJAsblWsAJ0f/UlHoVQYix2MMiUe3CJmZtcqtTTOCJ8+dJxMfAkM6/B8VQ:vGi8iUegmQeTTZMY5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623692, "uuid": "7f35e6ee-c8c9-48b8-ba65-ef9974c7e444", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623692, "uuid": "9861323d-9ad6-4df7-947c-32957db2527c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623692, "uuid": "f23eefda-ed71-4145-ac0c-b29bcc762573", "value": "97d7389b1b010b0eebf2819d70661e4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63d231a-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628190, "uuid": "6735b746-bd81-4183-bf6a-6aa506aa4f58", "comment": "Malware payload (RedLineStealer)", "value": "8b1e7388a3dfd3b4b9e17139fc4ad8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628190, "uuid": "c48731f1-bbc6-42ca-869a-db1682ca409d", "comment": "Malware payload (RedLineStealer)", "value": "81aae0009d729dc49c24bc457617fef2952aea013abba9b069ee230343fb43ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628190, "uuid": "e49da6cb-f0a4-47d6-ab4d-f480db4c7590", "comment": "Malware payload (RedLineStealer)", "value": "d965002893b8ac5282767510d0042079d6bc1120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628190, "uuid": "672949d9-e99a-4344-95ee-1feaaa8a9da2", "comment": "Malware payload (RedLineStealer)", "value": "f638ccedc4d61c8442e76fe4f6fa1d5fe4c27f63d88a6a6d8d643ba7cb9448d9c02a4120c7540f42eee4ad4eedf37cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628190, "uuid": "4e5a5f65-a278-4bbf-a476-11acbeccedb4", "value": "T197060111248CAE6FE4393A7577DC0553F86C64719B0B1C5622C6ACEFC99CE83F6A258C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628190, "uuid": "31449f57-bda1-4dad-9d61-b3de78e07e07", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628190, "uuid": "6b35277b-5971-47c4-93c8-344a1d73a314", "value": "49152:sViy6S3iSSVqO8yqJocR5jwTDEEHLW1AovX5afFxWq0AnUoGmGZgWf+7C+VTAJ8q:sVBqKYDEtAd/xfbuO7C+hCxCzwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628190, "uuid": "22909bfc-9731-4408-aea7-584cc774dbfb", "value": 3798856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628190, "uuid": "e2682b02-dea8-4770-82a5-9643d28dcadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628190, "uuid": "7d907837-4491-4010-9db3-edfeea4a5d66", "value": "8b1e7388a3dfd3b4b9e17139fc4ad8f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5387252-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623384, "uuid": "2c860343-5b8b-4721-9d52-89bb87d41dd1", "comment": "Malware payload (Amadey)", "value": "8929e04561cac0d3a9fc6e75240777db", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623384, "uuid": "4ab03af1-8e2b-4bd7-bbf3-ff7b65031c6a", "comment": "Malware payload (Amadey)", "value": "823e57a0ceb5e60f7f39fc044f20692438997d5b4a6c45ec5ccfb676d53c5a21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623384, "uuid": "1b9720e8-b087-4992-a171-b846af890b90", "comment": "Malware payload (Amadey)", "value": "e6ce27094a6ab81e17226d2dab68acf481be035d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623384, "uuid": "812d3439-7ce0-4ef0-8624-cb52d2dc3fea", "comment": "Malware payload (Amadey)", "value": "1287e915707d8ee28ce8aa63670a8cb7823f88f798ef72a0fbb9e0a1ad92562e10f4b7d29f18a1072b8dfa85bdfb2faf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623384, "uuid": "ccfe951d-db5e-4f50-b26a-668bb948d959", "value": "T1F3560125290C4C2FA57638601FCC449369AD53785B231D9232D6EDEFEBADD80F681B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623384, "uuid": "73ea79f9-eac0-462f-98e1-6263a82a5593", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623384, "uuid": "9e9fbe21-2bb1-4c28-b88c-cae27a8ce65e", "value": "49152:B0qFZ8p8NbgSNj4WL68DdqDydFqjjPxCqilCCFu07nEUVMr+qxZ2HBAcmPz7CGv+:g8dzWUoRLibrgNS64B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623384, "uuid": "89bef654-750e-4ff6-b86a-570ec8c87aa3", "value": 5974344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623384, "uuid": "8be5f63c-5a50-4651-bf88-52c4dc613bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623384, "uuid": "cbf499d2-6de8-4d87-8bea-d47031ee75cb", "value": "8929e04561cac0d3a9fc6e75240777db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5028ff16-1bb6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688618033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688618033, "uuid": "c38d9e0d-3af7-4601-975f-65ffda2de454", "comment": "Malware payload", "value": "70f3e57916b9fb4109375eb760b9d5fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688618033, "uuid": "cb37ce90-3723-4e37-bff5-3125fe46844d", "comment": "Malware payload", "value": "8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688618033, "uuid": "9ab4fedc-5b9a-469f-a4a1-1472bc25eef7", "comment": "Malware payload", "value": "3d023790c74235c4ef77452e58f5191a93720379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688618033, "uuid": "714663b9-db7a-4e9f-96a7-e515f280bb1f", "comment": "Malware payload", "value": "c5a2abcc6771527ad0cc957b130fb413002d74358076021b78c80e8bfadf27effbb1267052170ffadfec20a5726264eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688618033, "uuid": "c01fc5e4-7020-4100-8f07-2aa75398d05d", "value": "T1D8D5B520F754388AF9E607BBC9FD26B98478ED9087CC40D7418165C7AD2E2E7353A9C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688618033, "uuid": "30a21c75-819d-4e6e-a720-8b4a00e7b9c9", "value": "c843070d0647a0de2aec007cdc8284b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688618033, "uuid": "6c85588b-167a-4ba1-ae29-54f7ac27e85f", "value": "24576:KjqEDdPxmg4KzMy1GiGto4jGUfdCrLOu5lfLF9D4OAj:KjqEDigKS2o4jhu57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688618033, "uuid": "b03a2f53-7789-4aef-8007-9d15ab029ca0", "value": 2976768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688618033, "uuid": "86d14d16-69f1-4642-855d-ef7498e47de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688618033, "uuid": "039f5ff4-1400-4d80-a2bc-1b564205ce83", "value": "surin_elephant_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86de31dc-1bd1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688629721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629721, "uuid": "d122e4d8-36fe-4db7-8ebb-9bca667896ec", "comment": "Malware payload (SnakeKeylogger)", "value": "cb65afcf6601aa7568335d2c2347cb7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629721, "uuid": "92c5da74-aff5-401e-a92d-2638b6a17818", "comment": "Malware payload (SnakeKeylogger)", "value": "826f8d872d3e15552eb033cb00299db7e7168bfaad710bb240b1cb2729b84d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629721, "uuid": "7438336e-e419-42f1-b3d6-8eb685e57bd1", "comment": "Malware payload (SnakeKeylogger)", "value": "ab021596709ba2f4a13f0b33058bd90d86ac4d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629721, "uuid": "24a2308d-9b7a-4f27-a79d-6ca4d588f87b", "comment": "Malware payload (SnakeKeylogger)", "value": "38271bbc32f4243a340c16be63092bf52555c905ef49a3d3a16e15c9a7de88bc308abaf1f360a09b30b382096f3f838a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629721, "uuid": "74750146-2fa4-422b-8530-ad3ca408b2df", "value": "T15A156DD1F151C89AE86B46F27C3A643025A77E9C54B4810C5A9EB72B66F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629721, "uuid": "52af9308-8079-4355-8442-8e1f65f99f08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629721, "uuid": "40f00fa5-39cb-44c0-b78f-c7f8041ca026", "value": "12288:hgC6DC4R12Lo8kG8LXT/XnD/k4NRI6UkCBO2ipNYytes:wF128L/Yd675t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629721, "uuid": "f43ce687-0f2f-4850-ba19-488e97a339e0", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629721, "uuid": "82030528-6183-4ee9-aecb-fa37e30371bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629721, "uuid": "1b534a1e-e144-442b-a882-7db882342310", "value": "FOTO\u011eRAF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dbbd78-1bf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688645341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645341, "uuid": "c50a82c2-f1dd-4920-8f4a-f40ec90bc4ba", "comment": "Malware payload (RedLineStealer)", "value": "f2678772b2e88a2dc430fd2e7cc3c153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645341, "uuid": "62d6e043-0826-4e37-85eb-0e9b0169cbcb", "comment": "Malware payload (RedLineStealer)", "value": "831aca689b0a4d6bcac4e6171e8c4479a0247f26901b9d6ce321b83293bdbcc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645341, "uuid": "c335c758-d134-4b4b-9b69-16f90545d9be", "comment": "Malware payload (RedLineStealer)", "value": "a99933651990981318c97c61e7a180d3fb27ff13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645341, "uuid": "7224a1ac-9d87-4cb0-aac1-150af9b92151", "comment": "Malware payload (RedLineStealer)", "value": "722d18e570a7fa1095991fa2984c0df46a76d70409527c273bbc76eee84886b24ae6b46aaa16eb00328d924d7a158de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645341, "uuid": "3af6dbf2-84d7-40f2-821c-a4ae068040a5", "value": "T1F855AD05E09D1D5CC671E3B2BADC23523EAC85742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645341, "uuid": "a37b799c-acbc-4ea3-ac02-eb8bca616e61", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645341, "uuid": "bbeacd3c-21b3-46d3-b416-85d892aaa900", "value": "12288:L66KZF+94P3ezcZ+whkMkqEt5+6Jili5RAjfrYwlth2rDBXWNN/HVUBnFUHXOtrV:2LaPgfU5G/fYuTORU/133iRrsgUP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645341, "uuid": "9bf30dee-0a2f-414d-97fe-b01141ffff0f", "value": 1343821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645341, "uuid": "9ba4f8b5-c9b5-4e39-87a2-64235793266b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645341, "uuid": "43875524-beed-4cc5-bf30-5a410b846621", "value": "f2678772b2e88a2dc430fd2e7cc3c153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4633d8ee-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623600, "uuid": "70d7ad9c-2090-4698-8c97-e5b804962fca", "comment": "Malware payload (RedLineStealer)", "value": "920d34f945fbdd4f52864b8409f6eb38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623600, "uuid": "1a2dbdf4-8fe3-4312-9ece-d56732777060", "comment": "Malware payload (RedLineStealer)", "value": "83c6cec87e2ed3d09e89ad17178a3ddd193d24a51bf0bf0b779d194c8f3e6787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623600, "uuid": "07af5ed1-8b76-4c3d-87b1-0f50c6c81b48", "comment": "Malware payload (RedLineStealer)", "value": "d4515e8c528ad04648f0aaa1f73cd35773ad414b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623600, "uuid": "1d906e0e-d69d-4f4f-a324-51109448fd27", "comment": "Malware payload (RedLineStealer)", "value": "bf6413e6ca3f808863ecba51307561c93aca3f2a9cbd8864f41b7eff12dc5c4fc0b60c1ac80dca6328c1908c1ff2531d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623600, "uuid": "b464c657-bfb1-4041-a1bc-97e1b233a0cb", "value": "T108560152295C4C2F947634241FDC555379AEA3A95B170D9232C2EDEFEBACC80F681B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623600, "uuid": "26085a22-485a-4681-b91f-8e40bae97aa6", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623600, "uuid": "5b0d94c2-e1e9-402b-a33f-2d6699e7d9af", "value": "49152:gpZI6U+qNzM7+t7+fUWY0Be1JY2MUWdzBKTjByA1yUaHmyRPKZgLnza9dW8GlL5T:gpZI6UM7+tiO0BeLZMdi1QLsuXrQ+uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623600, "uuid": "010d4df8-1062-418e-8bf2-d8274e9112ce", "value": 6010184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623600, "uuid": "3cf5640c-9b91-4a0e-953a-a6b8e8fe2df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623600, "uuid": "a94591c6-7dc3-4c99-b468-1ca78a274f54", "value": "920d34f945fbdd4f52864b8409f6eb38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f8ef17-1bae-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688614823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614823, "uuid": "bed05273-d141-401d-8d28-3e1198506adb", "comment": "Malware payload", "value": "ecb430093c06b40d7c45e45825683f62", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614823, "uuid": "fe7d696c-5627-4af8-bd31-0d4646fc4880", "comment": "Malware payload", "value": "83ce29d1b74162d5c6804395535f0f9cf0b09d2b482d4db18bbdfe404b18a4c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614823, "uuid": "9a52c02f-0402-4041-bf44-1be5f4c2bb64", "comment": "Malware payload", "value": "ea6b904191860ea5019673cff7b7187a76a73d8d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614823, "uuid": "b8ed766d-88e1-430c-b674-3da3baa89031", "comment": "Malware payload", "value": "992ed785ea13b47de727278698f86482c0bd8d2aae45b3420e30190bfc6f6a8bfe1a097fceedb5c37195de2256149dd1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614823, "uuid": "f8dbb00e-68b4-42bf-b83e-c841bb9d98d6", "value": "T1D5448C5074C0C472D97A2C345674D6B04E7EB8301DE0DA8FABD8597A8F326C2E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614823, "uuid": "406057c7-f10e-4344-a5ef-f87d1ef2d4c3", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614823, "uuid": "6ee2721e-16f2-4829-8cd3-dd59f42361c5", "value": "6144:nZL+74MyFAWMVF7WZ+XvUerPFdmgxgbYSv4Zul7mbo7Vym:np+7vyFAWMVFyZ+fU6PFdmJYful7ioph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688614823, "uuid": "bb33f5ea-dcc7-42ce-93f5-769230b64aac", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688614823, "uuid": "3d015b05-4a2b-41c5-a004-7639a1f23868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614823, "uuid": "a5ed9ca4-e042-4ae6-a44b-5f868867106d", "value": "SecuriteInfo.com.Variant.Zusy.475489.19146.28545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e806ceb8-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628167, "uuid": "9c28315c-d7ad-4541-9ce1-a0e49e0649b1", "comment": "Malware payload (RedLineStealer)", "value": "618db8f53d5a7e7926f09919306f5d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628167, "uuid": "f2da50fa-6800-4395-8977-3c8600f93403", "comment": "Malware payload (RedLineStealer)", "value": "83ec29514f5fa185c572ae48cc7235e50a73fe5c2a0dd211c25a875c570253fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628167, "uuid": "e64cac29-731c-4623-a348-06fa3e6a2e76", "comment": "Malware payload (RedLineStealer)", "value": "5cb159dfd120c477bc60c3ffe4c29032561b5cd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628167, "uuid": "3ff30b8d-e830-41cd-a6b5-dc0139c7e209", "comment": "Malware payload (RedLineStealer)", "value": "4cb0abf7c7d116d21487e7e2e3065aa15c314da55a6a38c469324a7bff8df472c10fe996234237275e4034afa0ca3f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628167, "uuid": "e4babb21-2909-4558-bf18-8feb81f16a91", "value": "T139060102259C9E5FD439397537CD4A57F86C90B0EB1A1D4422E22CEFC89DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628167, "uuid": "3c60a1e6-9877-4eba-9ce4-5c8874a6ebee", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628167, "uuid": "718e5d1f-e316-423f-9513-bfd2a3f3f2ac", "value": "49152:sNeD78ZWjuc38PljztG8LPoJbUbP3S073RA+n7Wkpo4SijDFXh4YSLe6PMo38sIz:pDRqLeOWkpoZMYns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628167, "uuid": "7705da32-0760-4171-92c5-b4cd2fc56830", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628167, "uuid": "d7f5e3a0-fa66-4757-8957-e89fa25a825a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628167, "uuid": "16e64bbe-4c3c-4cba-a9b1-ffaaf85de976", "value": "618db8f53d5a7e7926f09919306f5d35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f8b02f-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622313, "uuid": "4cbb8daf-9c64-435f-afb1-8441def5e426", "comment": "Malware payload (RedLineStealer)", "value": "cf374cf08fa0b97f33cde780bf14f5cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622313, "uuid": "79c9fd36-5aca-43f8-83d2-743661f94f71", "comment": "Malware payload (RedLineStealer)", "value": "8475eafe4ab9b001192a1479e36ba03b2e6f59e172ec95689fa7fdfdc7b3a1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622313, "uuid": "8fc63bb6-b705-4404-b8f6-a27c818fb9a1", "comment": "Malware payload (RedLineStealer)", "value": "f32d0163da36468ee56486724a9d1a4ff0164ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622313, "uuid": "c9a44562-0e1d-40b9-b363-fc895a8083a9", "comment": "Malware payload (RedLineStealer)", "value": "c0d2518ebe06df265038bbf6879e21891cda2fac1711c36cae90474a3527dd8ef5636da672dadbbe8f02756d91285df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622313, "uuid": "2e494c18-7829-4f23-9bec-e8d87558a458", "value": "T15D55AD05A09D1D1CC672E3B2BADC13523DBC8874291EA13952E21DEF95F9C1C72DBA8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622313, "uuid": "c9e2cc1c-da12-4db7-b953-ce80be43672f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622313, "uuid": "c277a30b-044e-4e47-9c4c-37f2b75f62df", "value": "24576:DjKLgm103/mQilGfbmyWZbMQC1RrsgUP9M:DmLA1ilub3WZbMH1igUP9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622313, "uuid": "9378f35c-9b26-4e00-862c-844714ae3a2b", "value": 1347400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622313, "uuid": "deb40da8-219f-41d5-b765-130c1f5079fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622313, "uuid": "d5d27e4d-6d4b-4530-b98b-4e48993ccdd6", "value": "cf374cf08fa0b97f33cde780bf14f5cf.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0579816-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623349, "uuid": "ceae2532-6a17-4bf0-844d-6dce27a18200", "comment": "Malware payload (Amadey)", "value": "7a79fc7a44984bd9bf7d3659e52a7fed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623349, "uuid": "0c343517-c9f3-4753-b55e-219e9244e7e1", "comment": "Malware payload (Amadey)", "value": "84ad08fd479fcbe255fc646e3918c3bade26122f68424ecf086ab71ccf6f4625", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623349, "uuid": "3c81fc9a-2c04-45d2-93ac-c69f96cb7072", "comment": "Malware payload (Amadey)", "value": "b24a1c3ba0520835e7346a059912041efb4eaad9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623349, "uuid": "f4bb3f4a-cfa0-47af-a522-44c6c4d3ac37", "comment": "Malware payload (Amadey)", "value": "c082f54e66f5dcf826bb7c8dd297b1fd448a8276fc09df7eab692f096d4a42ffaa4e273ce2435d970339d1bd3986fd92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623349, "uuid": "9c7dd9ec-0bd5-45a2-9a2f-c5b5f9d6f067", "value": "T183160159206C4E9FD87131B12BDC1993F9ACA475671F0E1522C2EDEFC89CC81F6A09AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623349, "uuid": "790c62f3-5be2-4853-9638-b436539442a9", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623349, "uuid": "e2deadf1-b76f-4ebf-a002-4a435c453f67", "value": "49152:UxJwD+qt7f9jZ07w2xayyBAoQbDmLMrphzKxomJ13TW7hoxATa7uw2WhxiH8vKwO:rpo7KkUqzu31TqrS2VrfO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623349, "uuid": "2210ddd5-21fe-4105-88f3-c61a37c7ca7a", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623349, "uuid": "d1083cdd-8c34-42d6-98bb-7b86615719d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623349, "uuid": "677b3eb8-6796-4303-9ebe-98f85fbf5c62", "value": "7a79fc7a44984bd9bf7d3659e52a7fed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b02da99-1bf2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688643687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643687, "uuid": "e67a1bd4-b8da-43bc-a53e-5b4f5430e037", "comment": "Malware payload (RemcosRAT)", "value": "173ed42eb4d31faf7b7ac6b735a67d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643687, "uuid": "dc457018-08b4-4478-b9c4-0de2469ef426", "comment": "Malware payload (RemcosRAT)", "value": "85d90e46a94421f0ea8dde00324393637a1a935adc6b1c4ce41a270833f0a1c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643687, "uuid": "7f53b706-2a4f-49f5-b269-6db06b75ebf0", "comment": "Malware payload (RemcosRAT)", "value": "552973fcde14ac378097f41ecd9bbd36a87385fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643687, "uuid": "4e341225-de82-4bf3-8027-e83831b2046c", "comment": "Malware payload (RemcosRAT)", "value": "09975d5acf53f0aa1fd7d703bd0b6ac5084d24cf52dfa88baaa25a17e2c6d63654bb37afc1680cabdaa45eaf8ead623f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643687, "uuid": "f64d6e73-d09e-4b67-b802-1e0568cf9cdb", "value": "T18935F19C766075DFC817C972CAA41C20EA20A877530BD347A49726AD9E1E6EBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643687, "uuid": "cf65acb0-f48a-421d-9cf2-a865750c4b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643687, "uuid": "31fe019d-118c-4eef-a904-2ee65afc52cd", "value": "24576:iQZSKA3ECq9qJUSi89QOgY+qGl5xO+UwRFF7b:iv1UC5yLYp+Z5xNRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643687, "uuid": "1d56463b-e4e0-46a0-8293-5d5154c0de5c", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643687, "uuid": "0aed50e0-074c-4b3c-a851-1436930c73fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643687, "uuid": "92a1a408-b0b1-478e-b782-d6360f24eda3", "value": "85d90e46a94421f0ea8dde00324393637a1a935adc6b1c4ce41a270833f0a1c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a312643-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622667, "uuid": "f29bc29f-7288-493b-a483-2ea9ae649d89", "comment": "Malware payload (RedLineStealer)", "value": "4946b28e394ed9bf905f1b2d4e1e640e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622667, "uuid": "3994cc47-4694-4a0b-8e0e-c2e7ac0ac897", "comment": "Malware payload (RedLineStealer)", "value": "864c5f665e0ef6cf7c84a5936706f60b640217f40ff31ce5ebb1f771ef7445ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622667, "uuid": "c78478e4-ea64-402a-894c-225ca4e4ef89", "comment": "Malware payload (RedLineStealer)", "value": "91528d29dfbca7111578e07a3beda7744b7e56bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622667, "uuid": "cfc4aab2-a80b-4271-b6ec-cbab72ad24fa", "comment": "Malware payload (RedLineStealer)", "value": "7459d08c47c966e2fa949717d911114994abe44f6de36f5511fb79a536594f074364bd7150ddc00e96cc45bd4732e8e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622667, "uuid": "bc941932-ed38-483d-bb24-0a5125c02057", "value": "T18816012960AD8E9FD43434B027DC05A3F9ADA8742B0B4D4166C6EDEFD9ACD40F6909CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622667, "uuid": "6086b10a-58f4-40f7-9971-e3add2e8ca93", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622667, "uuid": "4e79aaf2-13bc-42df-8084-5ecb455c6f5d", "value": "49152:miN/DkzyJc45wIeGVZuwH41bGsDeIY8T5bQjSFdkoX6IqDbuPH5u5k6ewFwx01w1:xbV9I99+lDO01wx7Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622667, "uuid": "ff449c4a-bb2c-4262-894c-a0d38a8da0c0", "value": 4049736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622667, "uuid": "e18a6195-5242-4db6-ad77-67ce6669aa44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622667, "uuid": "3bc90c81-0d64-4567-bc57-f1f708e574bd", "value": "4946b28e394ed9bf905f1b2d4e1e640e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8657422a-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623708, "uuid": "555dc838-ba73-44d5-9327-4805f3472e6f", "comment": "Malware payload (Amadey)", "value": "af5a29e50bbcc9f2cdf899bd1bae3d8b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623708, "uuid": "d5a54de8-6f63-42b3-86bb-f19be76c9592", "comment": "Malware payload (Amadey)", "value": "8715c21b21257f7877a8547a8a8001189fe02298557898b0f29db477bcf3c428", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623708, "uuid": "dff07118-84bf-44c8-a2e5-cb98c25e6736", "comment": "Malware payload (Amadey)", "value": "e3a30efaff3308fb1a6900cddac69a5b3ff2adcc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623708, "uuid": "9f69fd99-6b75-4e62-9369-7ead6b2d4238", "comment": "Malware payload (Amadey)", "value": "6d5a0d0dbaa9a4011e5171841f645d03d96830b32d61fa46901b89998e39a6510e08058d3430567262c02fefa5e659d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623708, "uuid": "2892d239-2733-4fd1-a954-5e4a124eef62", "value": "T19A060112298C9E5FE43A393537DC4557F92CA578DB0A0C8522D12CEFC89DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623708, "uuid": "555ad2fd-1022-41c5-8848-7b55deed8037", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623708, "uuid": "419be3ec-93a5-421a-8572-5049a1b94bb3", "value": "49152:jGRLgx+kkR7vbkNcDecHDw6TqjskPKzAU1WVxpRWZf+u0sUHdoLQziLkHKocfdkI:v419JUIQ2lYqSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623708, "uuid": "3d2b5213-823f-47ed-a750-3ed3222a5511", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623708, "uuid": "8b9a9d29-849a-466f-bc9e-17978b7d4f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623708, "uuid": "a3d2f258-5fa2-4739-8ae8-31e75733c1a9", "value": "af5a29e50bbcc9f2cdf899bd1bae3d8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d2018a-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688648082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648082, "uuid": "e41edfd6-c079-413f-b6d6-2f840e950fbd", "comment": "Malware payload (RedLineStealer)", "value": "2694b3fb90893338b74f5e2f541f3cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648082, "uuid": "7e685f8f-32e8-41e8-a9bd-dc0ae38be292", "comment": "Malware payload (RedLineStealer)", "value": "875c42e9aa2cbf0bafe21f8daed4c46567c0dad43cd384b6ac8ee65cb1403dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648082, "uuid": "7e9a89ad-17a9-4913-b5ce-33ac4d445a95", "comment": "Malware payload (RedLineStealer)", "value": "8858706be0e827fd3c248c20534d62d7b067c42e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648082, "uuid": "c9de3f06-5607-41ad-ac6f-87bbcfb5e8fa", "comment": "Malware payload (RedLineStealer)", "value": "200318edb121cf39b851c2045cf83868907b55700349d2b57aa93584c43ca9816ec595c70b31d0da576c1285a0b68b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648082, "uuid": "40a1d09c-369e-48d3-927a-b5ec9c85b777", "value": "T17CD402207180C4B3C477053581E2CB796E3A70B15BA6E1D7B69D5BBA5E107E1E7322CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648082, "uuid": "4cfcbc9e-3c7a-4439-bc54-256fe75810cc", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648082, "uuid": "883404a9-7bf0-4623-a774-6dca6a777fa6", "value": "12288:oh1Lk70Tnvjc2asUXllqdgPH+RWa+ujZJYcEKjIUZZi7JOZ0Lx4bTq+zbV9MYXli:0k70TrceUXljP4+VcEK0OosGid9x5YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648082, "uuid": "2014f4e5-ff5f-43e7-b5fe-d0906a5b2858", "value": 636480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648082, "uuid": "49d2b73c-a326-4164-b3ee-f8041d4d1675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648082, "uuid": "4a2c190e-faaf-4557-83f2-08734759001d", "value": "875c42e9aa2cbf0bafe21f8daed4c46567c0dad43cd384b6ac8ee65cb1403dc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62fdc49-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648726, "uuid": "f1bfa584-d182-4fa9-8e06-ad6e981f54aa", "comment": "Malware payload (AgentTesla)", "value": "19fe480a0efc03a6d749036c023c0dfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648726, "uuid": "57740837-5775-44a8-8efd-e4a75db55947", "comment": "Malware payload (AgentTesla)", "value": "876aefee92ee7079d9b36fd7f8a2f236399491f91aac1acd02a6fe9f2e504fc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648726, "uuid": "7aa1c760-2baf-4de2-b672-1734894d2559", "comment": "Malware payload (AgentTesla)", "value": "ac140a10cd94d539a22af6ca8ae1cd0aa62ee384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648726, "uuid": "9339042a-d9be-4455-81c9-a9c3cf87185f", "comment": "Malware payload (AgentTesla)", "value": "3e62536d0b900b2402b2e5133ca5b5f9a40617b114ff82b5b66180fc0d938365682ac9f4b0648a4ea13b369b202208f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648726, "uuid": "52526edd-76f3-431e-8b7e-4a9ba90dbcd0", "value": "T158F47B3C1CBC7227C174F2F68F9CC421F65095AA3E60DE2769D39899461EA0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648726, "uuid": "b280f52a-a12d-490d-8a6b-e4bdcb5588be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648726, "uuid": "a0da2836-ddc6-4ad6-a1c4-a6789284558a", "value": "12288:Tz6+jhnjh3ncGlsgVet/sVWyIxl9tr7cJh+MIwrU1fn+0yN:Tz1NnNzlsgVe2Kxztr7c+MXIf/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648726, "uuid": "16b995f8-a05b-4f7b-8782-c261aba590b2", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648726, "uuid": "50bb4fd8-aff6-40a9-afdf-f85669d54277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648726, "uuid": "e78b195d-c248-4f02-aaed-fd9de97f404f", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0d88b3-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "a617b97a-a1e5-4f43-ba92-75378c214a84", "comment": "Malware payload (AgentTesla)", "value": "edb9545f84001e4e272dcb8d64019748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "5804bc86-4f7d-4ad4-ad09-131ee2030451", "comment": "Malware payload (AgentTesla)", "value": "87c16818362a8b7107e0449e6f841f0eb5dc0f4674fe5bf10308034b396f19f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "8697eae9-4f51-4a74-a2c1-d86090732c97", "comment": "Malware payload (AgentTesla)", "value": "5fc43df11e921f89a1fad66d8953fe436aa6aa1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648519, "uuid": "0ede891e-2238-48fd-8576-6fe0bab34d15", "comment": "Malware payload (AgentTesla)", "value": "83098b08216dc2280ed4145c8fea8c28881d43308f8989076a79eac9150c7246c91abc0a3d381d14d0966b8e3e1db010", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "0ba99e20-b13a-40bd-8d6e-80213e3751f0", "value": "T110F411AC17BB882EC8927FBC4D542BB5D1F986817537D6938EA7FC9CDD45B0408822D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "28bba8ae-6f15-4fb9-8325-2ff87fedc8d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "11ef739f-c26d-4ef7-b4e4-e66038f455cd", "value": "12288:IZPWR28Le0cY+Yg9fb9SfTF/z5HTc/e7rREe50vRgwGaP/4l1AO6:I9+xL9Rk9AF75g/e7rRN0vSwGa411", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648519, "uuid": "e127518e-e774-470c-a837-4c5aa177ab5b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648519, "uuid": "6ee4949a-95e9-4778-a2ce-fd784832e306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648519, "uuid": "c3404969-d23e-46ac-a047-c8c9be8bc828", "value": "87c16818362a8b7107e0449e6f841f0eb5dc0f4674fe5bf10308034b396f19f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345b8651-1c04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688651487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651487, "uuid": "4a52638c-8835-420a-b0a5-20c470d5ace0", "comment": "Malware payload (AgentTesla)", "value": "7df961ae03f8d6f1a7d15a7568710826", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651487, "uuid": "04acd14c-b290-4535-9e2b-97d7f4f1702f", "comment": "Malware payload (AgentTesla)", "value": "88098938e733109b14c0ee166bdab671d28df84fa4a82076ee85ba18acab14d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651487, "uuid": "3e6f608a-c4cf-4a62-9c5b-d9e8a1270c4e", "comment": "Malware payload (AgentTesla)", "value": "6de4f533c9171e7fe9c6fa249b07237d5fbb8b0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651487, "uuid": "d8b17325-2b80-44c2-9a38-e98022941f72", "comment": "Malware payload (AgentTesla)", "value": "88db513660ede97b50c97e180697973926a63ae69b627247b4ef635926b1f22e71ad5dd8f9e08a82fee7073ebb03dbd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651487, "uuid": "dbdf8c02-9307-4419-ae92-46840f1cdbdf", "value": "T17A35913D1CBE523B95B4C6AACFD5882BF080E5B731226D39A4D353964356D8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651487, "uuid": "61b6ed7c-4886-4a51-b646-8b33b66b53c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651487, "uuid": "fd902111-0b6c-4db0-9378-1b60d5c1fba3", "value": "12288:NqrRRCj5Jjfc1pZ+uRjNtCuxufiWDMgY1pqY5sMp5G3uiK:NARCj7c0S8UurTYDqm943XK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651487, "uuid": "a9ee6227-66f1-43eb-8d7d-c4c02dc73ca5", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651487, "uuid": "c704ae65-3155-407d-8a68-9c7b51548f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651487, "uuid": "bd902907-1344-41ee-b5cf-e7dea30e0489", "value": "88098938e733109b14c0ee166bdab671d28df84fa4a82076ee85ba18acab14d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a602b9a8-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674441, "uuid": "42634d12-70f5-4e88-a084-0b828525bcff", "comment": "Malware payload", "value": "e0d3a5083440118d101fd37ddd281339", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674441, "uuid": "08307331-f308-486c-ada2-a5240c091648", "comment": "Malware payload", "value": "883ae0053da294adca33a4f2c32e69fd63cfc29629c3684ba042f67bd9a163ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674441, "uuid": "b79f1163-33d6-4dcd-8938-a5406641d49f", "comment": "Malware payload", "value": "f67e490da57e8eb954ede6ea7de525a32e05dae2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674441, "uuid": "807f580f-7b50-43c8-a891-e09982a41399", "comment": "Malware payload", "value": "a8e15b31e0e1d02f822e4a8a68359af7dd2651b55145ad6861c4a1ed849c1f8be6bc6433ce6aefa9772236a0c9581ecf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674441, "uuid": "ba9cf35f-82ca-4a5d-956e-db8a046dc662", "value": "T110A308C76A537DBBC5C7EBF4A7E6E02044F3B8351B62125477D8EDA24A1ECD8291C248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674441, "uuid": "3b78a4cf-8b38-4f16-b216-4bb46bb3c016", "value": "3072:LtesHZkZ0keqZVoq1b9PooAfJqmwbG5IhvjLB:LrHZVyooYfJqmwbG5AvjLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674441, "uuid": "e9d65dca-318e-4743-95c1-359195cd80d7", "value": 101479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674441, "uuid": "8804555f-fe0e-4aa7-b2f6-2150c216292a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674441, "uuid": "2dd82118-a1e6-4d37-acd7-d25e2ce5d6be", "value": "x86-20230706-2014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c83975-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624291, "uuid": "c3d6c7e8-6cc2-4b50-81ef-0ee30647988f", "comment": "Malware payload (Amadey)", "value": "5f2497b5ebc7583bc71dbe2089b39015", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624291, "uuid": "c229b8ba-8b61-421e-a9fb-d89bbe651e62", "comment": "Malware payload (Amadey)", "value": "887dfb8cd356992dd47119db327fc4534b5522ec7c944e18dbe116c79dfda599", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624291, "uuid": "0b8ac887-ab45-4db9-8b96-110662c432db", "comment": "Malware payload (Amadey)", "value": "98307f726949391328bfc2e15dc7aa72a2882e4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624291, "uuid": "e187adc0-df4f-47cb-b7e2-8b3ab8727016", "comment": "Malware payload (Amadey)", "value": "fef212f496afb6c79d2ca666532497bccbc3e4ad1ec842340233bb7bf3c033965fac3f0225217930485e7ce2ef564e34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624291, "uuid": "4a193d47-885d-40d6-bba6-dfaf1cbd71a0", "value": "T10B160119616D9E6FD57434B527DC0943FAACA8B0270F4E1022C2EDEFD89CD82F69099D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624291, "uuid": "c0a95d85-57f2-473e-9f55-602e8f06cac3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624291, "uuid": "0e49b28c-83a7-4259-a81a-dc2268df2c75", "value": "49152:eVrAqM+Plm1jTSn8VkPQZHSZudD81PH4zNO5WsgFQ6qXWdtvrhQIjxHasLyMoBb7:eHUa28bPmlZQrRgJrwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624291, "uuid": "9b109a0d-13e3-45f7-9942-77f7048a6f73", "value": 4064072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624291, "uuid": "d863160f-a4f4-4ab4-8a4f-d24429720f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624291, "uuid": "e3309bf9-622e-4465-9d19-88691c4771e3", "value": "5f2497b5ebc7583bc71dbe2089b39015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9060cc54-1beb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1688640904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640904, "uuid": "d409c6ab-f578-40db-b6d1-6a53afe96203", "comment": "Malware payload (DarkCloud)", "value": "5ebb62559516fb958bdf60a442a3ee52", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640904, "uuid": "44550b6f-0837-410c-9bd6-057cef83945a", "comment": "Malware payload (DarkCloud)", "value": "88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640904, "uuid": "51f3e7df-0ccd-4ee3-9520-b87f8388e0e0", "comment": "Malware payload (DarkCloud)", "value": "259aaad2a024dafe06bc1288cf3c6e049a703270", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640904, "uuid": "67a3af98-e539-43de-aca7-4c824d6771c9", "comment": "Malware payload (DarkCloud)", "value": "d2c597569c3139135e5f9ea19ec88b6e71a7fca0411f2a2472645ad88c3133974912773285f8b2963bad6d8996dac071", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640904, "uuid": "a50dee13-b692-49a2-bba1-759d36b40e03", "value": "T17335236925F7451EC1667FBD0D00A575C3F899407433E31B4FA6BAEC9E26F080ED1A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640904, "uuid": "a7f0065b-e482-47cb-a891-0d5613e307b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640904, "uuid": "b8cf15cc-d40f-4812-94e7-6481a7df84c7", "value": "24576:Z/thewlqB6pb1oxhCdsWAsgn5QPhLMILZhAuwUTSYzHOEkHT:de2q8p5oxI1FqShgIJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688640904, "uuid": "905a4342-9e31-46e8-b156-eb4605b319c7", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688640904, "uuid": "3af8c393-6fc5-46c8-9dd1-65eb2f7d59ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640904, "uuid": "41ac899d-b758-4800-8655-425bb325ff4a", "value": "88a1c7323a9de4502a46188936371d668473f52656b57628b82dd0d177f530e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5394a20c-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622334, "uuid": "4c021c99-b67c-4e92-8b53-608eff54a00b", "comment": "Malware payload (RedLineStealer)", "value": "1a9ac9c92d4010b031eb41315ab36f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622334, "uuid": "562cc793-7c64-4bbd-b4ee-5e32a123ea07", "comment": "Malware payload (RedLineStealer)", "value": "88a5615ad0b7d61cff4abe35692f8629e29da10f43db28947e155b57e8c093de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622334, "uuid": "2ffaa832-e351-4d53-898a-5532401d98a4", "comment": "Malware payload (RedLineStealer)", "value": "74320068e2cb44afb9f79f0af809d5d8dafcbc0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622334, "uuid": "e3aa0917-9379-42eb-b7b8-f06414b5f2a8", "comment": "Malware payload (RedLineStealer)", "value": "8749c7bdf595a6d4e43c2e81c58e94a1a1f5fd57eb00d8d2b4ba0e14a786486ff8e713e165421989d2f8a851457b5363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622334, "uuid": "5f2d22d8-7f98-4f80-a646-8e02dc5aaf91", "value": "T16E061111658C9E6FE03A397977DC0857F96D9074DB080D4222C22DEFC49DE83F6AA99C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622334, "uuid": "ea8709e2-68c5-481d-b915-a1aaf091b3f8", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622334, "uuid": "460ff33e-6460-4db0-aed5-84e02609df6a", "value": "49152:cmnZbXPgMLiEP7pBNLOsCJlMbDjt8FOiky/ix27nDxdoUvpEa6Fjs9+WLhM5NfRN:3XY+Dx8FpnlvpEa6tshGvaEAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622334, "uuid": "b1213db5-8294-4894-9b80-1f3b6e2bb396", "value": 3763016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622334, "uuid": "dd55f4aa-0936-4fe8-858b-8d38d3cc2bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622334, "uuid": "90412909-c6d6-498b-af5e-ccefe5d8d97f", "value": "1a9ac9c92d4010b031eb41315ab36f4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab852690-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688641379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641379, "uuid": "d19e1663-9c50-43dd-8948-73edc523af8b", "comment": "Malware payload (Loki)", "value": "815a8ae489b80bef5f31d24d65058c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641379, "uuid": "dd5f4b04-dc86-42d5-8eb3-9e5dfa99eb95", "comment": "Malware payload (Loki)", "value": "88ab1b089e6766141839ed227c35daa3b4b7c9dc83948427cec997ee50ddb7ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641379, "uuid": "74a10fd5-f5f5-497a-a4b6-dbc3cb97343d", "comment": "Malware payload (Loki)", "value": "13cefc1dbf2e58e9bea1a512d9fe543d3918d07a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641379, "uuid": "f2ceb7a6-4aee-4cbc-b473-10880d7b7cab", "comment": "Malware payload (Loki)", "value": "125e1ad1026c0982ce17fd666945773f0064d066fae3578a244c98c5d520fd8d18f71b86911d3d424fd731852423045c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641379, "uuid": "a4973e20-457f-4b28-883a-ca37be9883eb", "value": "T1EAF4E1AC33A134DEC95BD9B94D540D74EAB4296B730BC64791A3649DEE0CA9BCF040E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641379, "uuid": "97533a67-607c-427a-a6d7-1d4d020ae7ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641379, "uuid": "c8695625-9582-4a8c-958e-3fc0b22e48a3", "value": "12288:cZyvbhaDnLMzIL2q+RTdOL8sJfCiCPgH/6yEjtT4TfIrUOAsQRJPWQ0MWsivzBiL:ZOyqGUL8Uf0WSyEjtTOfIr2VRpWBsiLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641379, "uuid": "eafca502-0fc3-4f45-8a94-3ce2427369d1", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641379, "uuid": "b437bad0-f7cc-4799-b3df-ef8467976ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641379, "uuid": "1db51654-8f70-4cda-9b0d-a74d18a0b3f5", "value": "88ab1b089e6766141839ed227c35daa3b4b7c9dc83948427cec997ee50ddb7ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac623f6-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688641244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641244, "uuid": "efd4ea08-b5a6-4b3d-9b40-e4622baf3aef", "comment": "Malware payload (GuLoader)", "value": "6cd925574655ceeb750b8c947deafdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641244, "uuid": "4674a4d3-a3db-40eb-8d65-7451cd935bed", "comment": "Malware payload (GuLoader)", "value": "88d7e83b74f2a3c04658ae1e33977affa625a748b776b36a742ab73281d414bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641244, "uuid": "0596fe8c-0024-4b6e-a146-bdc797d64e90", "comment": "Malware payload (GuLoader)", "value": "db06d6768b00efbd84dbcadcb47c08607e7f1312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641244, "uuid": "3cdee5ab-1741-4418-a6a6-a6b63b6a6450", "comment": "Malware payload (GuLoader)", "value": "6ab6c9b7a1d5f185d16c96124e05fab1bf3c257e628a6f5caec6f42624b07d36ebb9d089c7891ce236cfa097ce7126b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641244, "uuid": "c499e88f-43ed-47f3-9168-6a895521ef3b", "value": "T149E30218A7D1C4A3C9B60E327E72AA379FBAF2115424631B13505B1F3B507865E0F7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641244, "uuid": "8f6723b1-e22a-4339-ae2f-61ae2e53ee93", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641244, "uuid": "d556e3d7-e366-4fe0-8caa-612ec15c822a", "value": "3072:EAe+3aJpgWXTBuWbcqG5GAbKqiNMeAmVngg24ihVmY8uYj7AdV+44MI:XB+pgUzcq6AqKPs4ihWrMz4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641244, "uuid": "63632e80-3bc3-48d0-a1aa-8fa799a6c714", "value": 154135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641244, "uuid": "3cd7cb7c-df0b-4807-a582-8a45a0397f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641244, "uuid": "fa0e3009-6b0d-45dc-ab48-130425501714", "value": "88d7e83b74f2a3c04658ae1e33977affa625a748b776b36a742ab73281d414bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d28a4b5-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688648603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648603, "uuid": "a3b576e7-9130-4839-ab5f-99c6f8020174", "comment": "Malware payload (Formbook)", "value": "d33e973840835c026b399d9780378815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648603, "uuid": "c6b91f30-a21b-4901-8103-98a894a0898a", "comment": "Malware payload (Formbook)", "value": "89525d55fd73880fae8d04629ee885c441a497fb091eb73e204c91d9d03ddb05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648603, "uuid": "253dd504-50d1-4948-8a76-b7d97482187e", "comment": "Malware payload (Formbook)", "value": "0dc5b78dfc836afbeff54fe20b637aecfa872c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648603, "uuid": "d3bfe98b-031b-4096-a4cd-6b9b128fd200", "comment": "Malware payload (Formbook)", "value": "bec0374780b19bab0364d7f96b564ca31d8e52575453b080a80fe72cf7b55c97a7c67934c3bdc792dcc3951fd1d37202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648603, "uuid": "f02439a5-61bd-4ed8-a0cc-52efc07f47d7", "value": "T120F412BD17AB492EC8973FBC9D212AB1E1F89A897037D6474FA3F85CDD55B080C811A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648603, "uuid": "75cd3a03-14f5-44b0-bc03-a0a24c8d3577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648603, "uuid": "2be1357a-6df7-4b7e-91f8-517671482799", "value": "12288:gUPWR28Le0cY+Yg9fb9diKpBwNr7rqSR5i7maIXRRO0gNXmJBey6iHw9Z:gY+xL9Rk9l4N47maOO7gcXaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648603, "uuid": "93615128-2a90-437b-ab8e-f7d3371dbe16", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648603, "uuid": "a48071da-73cd-4f7a-8e0c-6a7e01e6fdee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648603, "uuid": "904607f2-ce68-4252-a41d-5a394d17e22f", "value": "89525d55fd73880fae8d04629ee885c441a497fb091eb73e204c91d9d03ddb05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c272d9a0-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627674, "uuid": "c4f495c9-958c-4444-8798-9291000f7917", "comment": "Malware payload (AgentTesla)", "value": "4f885065ae18244a0e604771ac34bc71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627674, "uuid": "5d4e2b91-4a5f-4fc3-be07-71a9d7f2ce4c", "comment": "Malware payload (AgentTesla)", "value": "8a699596785bd7ca066cd25802b9c303763414b16f516fbb59b5dbe325023a28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627674, "uuid": "94fc206a-aec9-449b-81a8-021dbda064a6", "comment": "Malware payload (AgentTesla)", "value": "f11191488f21a52338554501762a6463e9dcf309", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627674, "uuid": "d30c8053-a77e-472b-9af7-a890fb5c44c5", "comment": "Malware payload (AgentTesla)", "value": "be994eaf81f4884f43f9df6227d8dd2e21cb09a0136f08b8a2793cc912a63bb824bc13109b32b956c0399512f87b1b78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627674, "uuid": "e5cdcfed-00ad-473e-a280-bb5a70657f27", "value": "T1A1742334B323744670C51ABE5B20CB5B4E9E901B54B097C025A927BAFF2DF31A6706B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627674, "uuid": "1d270578-60bc-432a-8e02-6fa0daeed2b9", "value": "6144:tOqvLA2atoyGcWOAUzt9QJnXYej3gNEfJTQ7FcFEA0Jr611rY/B+2Gntev7nT:4qvLA2qGcWZUZ96XtjpfFQeFEAwSY/gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627674, "uuid": "07df3c9d-810a-42c2-af5f-4f77f9cb75b7", "value": 367940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627674, "uuid": "2d73f476-27f7-4626-b24c-9ee6e0d23fc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627674, "uuid": "5ef372d6-6efe-4ec2-8ec6-f0c19f416575", "value": "DOCUMENT REVIEW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8014ccd-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674445, "uuid": "fad77b5d-8e41-4fd4-b632-92b4da48be09", "comment": "Malware payload", "value": "34b9767a8d75528747b6779e69f59a14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674445, "uuid": "dd6b0916-fe69-4d52-a3e6-6f699968454e", "comment": "Malware payload", "value": "8ba7608244d82313d12e277a06b787f3b54084c2377a714f0363c4eab251ad4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674445, "uuid": "bfdfaa1f-245d-4c85-9506-b8d7e77d20a0", "comment": "Malware payload", "value": "ce768a9cc0b54ffe5948677d81a954e02c4ddd2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674445, "uuid": "6306c521-a15b-4859-baab-1aeab6e4bb99", "comment": "Malware payload", "value": "d3fda53445e7884bb1c61f8f9e5412cdab3be2baf98dea53eb379f3d1d90bda0227bd16a7fc183d94c06ba6868d2190c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674445, "uuid": "65d2db71-f7b9-4c83-ae17-4fa079bb98ad", "value": "T1FEC309C29D537D33C2C29BB5FBDBD14837F39624939B2301A5986FB04B4BACD0A19259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674445, "uuid": "3aa16574-e948-4dd7-9e12-1bbf2b24560f", "value": "1536:4ln0njwOCyOHw/3KDeat0nD3R7diiOIuMI2kJ5oZYBWrlJkIgCgoOTOYwYIfHYr:ZjdCNRaayqIuMI2kJUeWrGCpOS284r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674445, "uuid": "e8be1e7d-db8d-4b54-ba5e-db151dbb6a2e", "value": 118402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674445, "uuid": "9f44d64d-f3e6-4496-8732-9f4fc4af1c1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674445, "uuid": "a4f1935a-4fc1-4580-a1fc-deb5b5cb68fb", "value": "armv6l-20230706-2014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1eadbef-1bc9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688626358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626358, "uuid": "1fb4d9c7-2fea-45b8-b228-c877200e0b3a", "comment": "Malware payload (Formbook)", "value": "b356a34b7494689f3c14c52caab4a448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626358, "uuid": "7c76228c-9a7f-4387-9159-81ee2c51ef14", "comment": "Malware payload (Formbook)", "value": "8bc27e883c445696fbfedca9bbe3863dfd9f38fb7dd0a8bc058071a7183eae78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626358, "uuid": "00938e04-3e3a-4d03-82ac-c425d1e0c6b4", "comment": "Malware payload (Formbook)", "value": "b2d8cfc753bbc69ed796bce372a12642ae0ab00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626358, "uuid": "5e97da5f-03c3-4f16-b105-fd6bf0568c87", "comment": "Malware payload (Formbook)", "value": "ef0e78428a2fa13862d56a1124977843da841dfe72a1dda1b3ee2fb7610cb0960d8a14f0767611eb72917651f7f01fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626358, "uuid": "6a6b637e-9db9-4605-891b-cddf6e38a839", "value": "T1F27422056AE5C077E8D305346B2B4B231BD8FC1378A1972F5780BA613D71B64EE697B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626358, "uuid": "d1ccedaa-89b6-4e7e-91b3-1fc92a2e8c2b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626358, "uuid": "c67438d4-9da3-414d-a4e6-8f65dd2b90d9", "value": "6144:vYa6W3SS8vv39VyadVYQXSCRfhaoBG5ymr4+asoATuS98L6:vYo318vviadVHRTBG59r/aLmT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626358, "uuid": "cd633008-52a9-44a3-866e-b4ef3ab15219", "value": 369978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626358, "uuid": "a2bda44c-129d-40a6-a8ce-61c204528bd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626358, "uuid": "e2658409-c7a3-4488-856a-8b174e331ea8", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ba7fd3-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688652273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652273, "uuid": "76c82cf4-028e-47c8-9e27-17dd94fa463a", "comment": "Malware payload (RedLineStealer)", "value": "46f97c0a289a8a678799798ed4979b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652273, "uuid": "d73fe29b-a145-49ec-b81a-e1460c536460", "comment": "Malware payload (RedLineStealer)", "value": "8bc722bfb5c3ac4884730522ac7baef5c7b50aa75590410f98e7cd0c68bf5628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652273, "uuid": "7e932e55-7749-4595-a0f1-4c5f8c785d73", "comment": "Malware payload (RedLineStealer)", "value": "964ea3bec6044d5c51daaa628d556f94d2f1859d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652273, "uuid": "7e4beb35-b0e8-449f-987b-4cc4705b873a", "comment": "Malware payload (RedLineStealer)", "value": "ae42ceaee9d8a2b38cb8492c10c0aafe506f3c40928bfbca75c8a42889d1fcb2d13013af0aaac5e36455adf3608f1152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652273, "uuid": "1ab357f4-925a-4f4f-b707-03aedbb136d4", "value": "T152444A123C82497BCC29E73BE9098E46FB19E10F516DCB64EB31D5B6AA43F450271E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652273, "uuid": "7eb94bfd-4d29-434f-a9a4-6724a781dabb", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652273, "uuid": "09752bdb-926a-4a33-8113-9d7a0b241a86", "value": "6144:Xn3Tmnp+ly2WtzH7NrIrBJjvft5LZFL92hUPEIOB:Xn3TqIYR0vfjZZ92hU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652273, "uuid": "dddee6aa-5273-4f31-aae8-5a5269903161", "value": 261452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652273, "uuid": "2ead5498-bd0d-4317-8753-6f9383471cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652273, "uuid": "3c9ba253-1d42-4d14-a4ee-c7fd1237a994", "value": "46f97c0a289a8a678799798ed4979b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff2b3a8-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622650, "uuid": "f4aca564-6c36-4fde-a96e-d071ee2d0ac0", "comment": "Malware payload (Amadey)", "value": "43d7f8ed1519562757a1f75c7a9ea801", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622650, "uuid": "f2334137-128e-40e4-986c-c4657fc7c57f", "comment": "Malware payload (Amadey)", "value": "8bfbeb1d5af206f22e7cebfbf339c77962c1c48535035b27ad1e5fc1062489aa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622650, "uuid": "faf5a348-edbe-4318-9ad0-d317955807cc", "comment": "Malware payload (Amadey)", "value": "9b695dd08680dfe39cfb62d0179bc64b17a1f7a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622650, "uuid": "338185a9-5b9f-43a0-b2c4-68cb211f5acc", "comment": "Malware payload (Amadey)", "value": "ab2dd6526821a26407efe72286b21a11b493b4ead03d31079b2a331114d3bf36020add4cf4cd62033fe304f32867404e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622650, "uuid": "f49d076e-ea9c-48f6-8aad-71cbfb8e3ac3", "value": "T161160129616D5E9FC43135B227DC1553FAAC9474AB1B0E0122C2EDEFC9ACE81F6909CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622650, "uuid": "5a4e1846-48d4-40ce-8f9b-cd299c2a5440", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622650, "uuid": "966731a5-fca2-4c85-9deb-4dcf116d6987", "value": "49152:6tf71yQats3L7ND7IOGQdlJFGgtwd+yaiuumggLjvZDQ2F+NmnSKf7l7twGDAVPw:YwQ9x0OhHQAir2EmnnfJZwJ68z2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622650, "uuid": "794986be-3c2a-4660-8c0c-7d34fe8a3493", "value": 4075336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622650, "uuid": "da741caa-a005-45fc-af93-bd8c54bb6200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622650, "uuid": "05c742e0-3a03-4a3b-9564-70d692f8ffe4", "value": "43d7f8ed1519562757a1f75c7a9ea801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61251c26-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688622786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622786, "uuid": "e94a03a6-8d74-4e96-a2b9-48b9a3200265", "comment": "Malware payload (Mirai)", "value": "6d956cb74d2a25ec8a28af83b90fd58f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622786, "uuid": "19c4b452-ec64-425b-85b0-55e07bb947e6", "comment": "Malware payload (Mirai)", "value": "8c8865a3ee07cde8d14e51c534626f91e7166fa462b6e97cb0308b32ffe7c9bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622786, "uuid": "05528b8a-66b9-4688-9ab3-a8e1d8a66fe5", "comment": "Malware payload (Mirai)", "value": "923ee65eb718563a375c12421fb16974c6ea356f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622786, "uuid": "efa036e6-a65c-4403-b76b-1bc8d9b70120", "comment": "Malware payload (Mirai)", "value": "498d34b268f1d7cc904ff5f6b25674da081e9df9fd6437aa9dbed6ebc1e0ebcd1809987adbdd039f8fd258f33f154cbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622786, "uuid": "74a5b4e8-0988-4984-b3e7-da39135c6ab3", "value": "T1ABF2F237C98078F281680C7A4EFF464256B71B3BD24BB1EF36A452149751D9B2EB6089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622786, "uuid": "f9a237c9-0bcd-4b66-9f68-9c06b08c69a0", "value": "768:XvMsaRSP7dkA0C8BHc0olif+w1FqUykk+jmbcb5KnOvz4QU3UB:XvzPxZ0Re03fU8jms5KnOvzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622786, "uuid": "bdc07d9c-0508-4744-a679-b36768c73cd9", "value": 34616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622786, "uuid": "6cdf0d28-e2ff-4682-bbad-9d4d88a35569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622786, "uuid": "67a032f8-ef7c-4988-8aa5-8e263ac5baa4", "value": "arm5.nn-20230706-0553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b342ae-1bff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649656, "uuid": "226bf7f7-1621-4324-8c35-3bb1700c14e6", "comment": "Malware payload (AgentTesla)", "value": "46a86df76ddf5fa09b4d52045c697420", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649656, "uuid": "2afc1086-c4f1-404c-94f2-09fee8a0ebd4", "comment": "Malware payload (AgentTesla)", "value": "8c95d61b603ae5254044c9bef1bcaddafbec1dfecdf7cded4bb9fa1c9f350e49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649656, "uuid": "7c50a342-40c0-4812-bd99-f4eaf0114e6e", "comment": "Malware payload (AgentTesla)", "value": "b61f0c2d1db74dc3e0a285c37bcb1b2e725e58e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649656, "uuid": "3ccc069b-57bb-4283-94f4-3f878bd666b0", "comment": "Malware payload (AgentTesla)", "value": "e39a987f801a3f2029ea7b24748a032b52f26f00bf3c6454c7d5ddc01ef62f3703ded5d17f9e7ca6d3f9a68bc8d8c752", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649656, "uuid": "087319da-52dc-4ff7-a607-07aefe5285cc", "value": "T19F1574B92A4022ABDB75AE7645E2084BF23B6F2772135D6825D273C1473250F37ED90E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649656, "uuid": "ca4edabf-446d-4178-b690-2bcea3529b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649656, "uuid": "6a53407b-1ca7-474b-9be7-18ed516e524d", "value": "12288:t3bsgkcDxqDqtSDAcqwHObcIxNIlrqqVb0f0JMh:1kcsDqADAhw4cIxNIlrF9K0mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649656, "uuid": "0646d35e-43e3-4e5a-8620-c07aecfdfc78", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649656, "uuid": "1d7828f1-c5e2-45e0-b0ae-389f56306a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649656, "uuid": "b17fe4cb-09b7-422d-a2f3-7718e642611c", "value": "8c95d61b603ae5254044c9bef1bcaddafbec1dfecdf7cded4bb9fa1c9f350e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585945b6-1ba6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688611175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611175, "uuid": "3a23b582-a484-4b0b-94ea-aed410fd1044", "comment": "Malware payload", "value": "ea33221f1f05d4a58b93455f7216f405", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611175, "uuid": "232747b5-fed6-4d69-994f-2645778f916e", "comment": "Malware payload", "value": "8ca801ae218fae833d27173aa8bdf274562be24fb96bf48a108736f1768b71da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611175, "uuid": "8c2f661b-64c8-4876-8ae0-19e789b6cb68", "comment": "Malware payload", "value": "4d06bbc654261b7d43c4f8f885af1c11f92b0a42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688611175, "uuid": "2396a8f4-54e4-4227-8596-a2a11bb8e83c", "comment": "Malware payload", "value": "18457f37275a54b95611d270855552d25d2a48fb987cb4127f2e1037edc21b635c657083099e1e0a0fd8edb635936d28", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611175, "uuid": "1d9fb4f8-ee43-4a5f-a87b-33064ede239d", "value": "T197234B21F8D1E962C08AB6710BDECB15BB365751B3F45043799C02CFEE626E18A39379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611175, "uuid": "c1e5563a-080a-49f1-a897-871c5bec1c51", "value": "384:8FGKRXsBtPTaE3bRkWOnbgI0HRPkVXi/aDFM9+FqHotM4cIXuUyL:bKR4Rkl0HRPkJiyZM9FK2YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688611175, "uuid": "e4fd1bcd-a8a0-4aee-9fb7-1337da911a8a", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688611175, "uuid": "3dc4517f-87a1-4489-8bd7-089209f9a282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688611175, "uuid": "026f4de2-ad2e-4d2d-94de-10dd67d553e0", "value": "SecuriteInfo.com.W32.Virtumonde.AC.gen.Eldorado.11076.18085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328f4c75-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610253, "uuid": "6bdea648-e3fb-4146-bd13-cbce65538ed9", "comment": "Malware payload (Gafgyt)", "value": "398c6c85731323a54a87a2d52fae80d0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610253, "uuid": "afe434be-4122-4c38-bca4-bd3439bf786a", "comment": "Malware payload (Gafgyt)", "value": "8d5f896c2d6fc178c068b6a2ae23e3d23dbbb5c0580d0fc0a6a1ee516dcb3a3c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610253, "uuid": "c95eac54-5525-45b5-930b-7a6f24d1fd30", "comment": "Malware payload (Gafgyt)", "value": "9caa9545466452a823abe70be0af2e88104bb53b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610253, "uuid": "42526243-f212-49f4-88a5-48272314cdb9", "comment": "Malware payload (Gafgyt)", "value": "6beea24fbff8d9deff8b4da0bdc8b29f3375ebff89bf9b776fd952add43ab135f81f69b63436042d81bc371f54ab9380", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610253, "uuid": "cee055f3-a616-403e-940d-85d1c794f985", "value": "T17F922AC5BD44D902C6C4467AFA4E868C77236398E1CE3343AB167F926B8681F0E3F559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610253, "uuid": "80891e2b-e6da-4be4-88ab-8441f2d088ae", "value": "384:XrWZskuuipbDXfjz7CJ9KJ+9WZeJZoQ2nDl016envOfFx4e:XrWZ/uu+Xf/7IKJwJZoQ2nBzOvOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610253, "uuid": "6bbaf780-3f43-44f2-807c-2caf0396f3d2", "value": 21088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610253, "uuid": "8789a324-d279-401c-8083-cc46c16014e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610253, "uuid": "35eca698-eeca-40f9-8eae-bae2ca6dccb7", "value": "condi.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6652b35-1bd6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688631949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631949, "uuid": "1b05bc31-ef76-4a4d-9760-8f26ac1d518e", "comment": "Malware payload (AgentTesla)", "value": "5186385725f0c78fd2e358ae7a5bc4a5", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631949, "uuid": "bece292c-da3a-4976-a410-16b3b6cf1e91", "comment": "Malware payload (AgentTesla)", "value": "8e0c70fa9c6c7bef958499df864d286b2bb3f99d9e11c68077737507528d9e22", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631949, "uuid": "35a136b8-a2cd-46a2-85fe-06eeeb3c3d6b", "comment": "Malware payload (AgentTesla)", "value": "c5a6ba30765f2f6eb29feafafb447105ae1f20bb", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631949, "uuid": "1ef489f0-bf1d-4b6e-882a-ab7ddce8c4cf", "comment": "Malware payload (AgentTesla)", "value": "bbf912a9cc02c88574f8c645868e30cf28ec7152847aef0ce9cb7acc8c5d9d0c5b7df8db9e0ec9b5e86a6ccc4f5da4a4", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631949, "uuid": "99747d5a-dbca-413a-9b0e-3f0074b6d73b", "value": "T1F9A5333BFC71ADC40B8484DC4D32696818A43B4DC98E4E1B596AFADB43F32E93479493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631949, "uuid": "d47cd0a6-06fc-41ff-a0fb-7d44631cfd51", "value": "24576:EivDqgMucl2mMrNml4M99g6jqtdLoEo2IhbCYonTSuQD8Qf800STRzXqQm0B1Cta:E/u9xmqtm92abRonTSuQD9knyXffQPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631949, "uuid": "317c774d-2d26-4588-8b6c-7f721cba6620", "value": 2073520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631949, "uuid": "2852bb89-e921-4957-baf0-ae4374f7a7d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631949, "uuid": "fddb001d-9e60-4e95-8cbb-42947a46f88a", "value": "5186385725f0c78fd2e358ae7a5bc4a5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb505c70-1c04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688651741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651741, "uuid": "c0800122-87de-4080-9819-e8a0427fe667", "comment": "Malware payload (Formbook)", "value": "f88909f7197ac24c1308e7e39e79e804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651741, "uuid": "f8b2b23b-47e4-49df-9748-b5e026a83334", "comment": "Malware payload (Formbook)", "value": "8e0ccddc8d7184730e19eb4b678fcb517dcc374425fbdcd209880dffda9f6886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651741, "uuid": "966e96bf-2c92-405a-ac49-975c298e8ad9", "comment": "Malware payload (Formbook)", "value": "eb1d315c71cf54f90fe992aed510b9e4510cee46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651741, "uuid": "f232ddbf-e09c-486d-a3fe-bc8b4cad5682", "comment": "Malware payload (Formbook)", "value": "92285a2253f1e3ffe9560e74d0e1f81f5c6b5ba82c4cfe3d75733a764e9946021f9265f0cdeaae1713029de96f3fb3b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651741, "uuid": "8b8e359f-fc2f-4573-a966-88e2e4c97a32", "value": "T12405E080313E2A63EABE8BF50251527097F62E5FA15DF6E84CC670EB52F4F404A51E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651741, "uuid": "8bd7e9a7-e75a-4d0e-8ea1-660454c8ae95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651741, "uuid": "e718c1ca-a609-403b-b6bd-b7b0828b42da", "value": "12288:PlKnuVEXqXdVCEz+3oTOUGW80nmdUComnsaHNqhIZEZP6x/aIy:sg4qXdVCCj5nmyCtsatqWG6l+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651741, "uuid": "ebe455ee-5060-45b8-87d8-9407cee19f32", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651741, "uuid": "7f4b1dba-94d1-4b99-8e5d-fe0cce8bee08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651741, "uuid": "9affe39e-066d-4195-b3ca-6568aad51173", "value": "8e0ccddc8d7184730e19eb4b678fcb517dcc374425fbdcd209880dffda9f6886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e224df39-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688644478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644478, "uuid": "62479685-aed2-4161-a9dc-5984d16a9f2f", "comment": "Malware payload (Formbook)", "value": "b84b85eca462eb7a2ae76de622e19a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644478, "uuid": "ff2796ff-dc0e-4d04-bc7d-febd2b039b16", "comment": "Malware payload (Formbook)", "value": "8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644478, "uuid": "8cf6a48d-de71-4686-9999-6f2220d1a991", "comment": "Malware payload (Formbook)", "value": "c90f55317f2391a83c64fdf824e90ace4a03f93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644478, "uuid": "b6c29bd6-3695-431f-9b0a-92c2972e615d", "comment": "Malware payload (Formbook)", "value": "a9f7b1237bdcfe5e6488106b22f27a4bb2af43ca9a795263dc6ffa2f2d05c9fab2f8598550142b8f44f5b6766c62c786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644478, "uuid": "b485b46c-4c25-4fae-a369-131ec7e9f2e4", "value": "T1D105022D16FB521AD8173FBC1D140272E7EE5A967127C2075F9BA8D8EF137244A906C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644478, "uuid": "4449162f-d16f-4c08-a06c-868c96465353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644478, "uuid": "3651fae4-5eb8-4456-b356-56b546baa3e6", "value": "24576:y4f0biRoSErVxIE5pUpEknAE5mVI+EheNc9U:Ty4oRrjIwHkAqmG+EAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644478, "uuid": "ae2bbd33-c896-4612-89d1-9fadc1b28697", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644478, "uuid": "55b640d2-982e-41ba-a3d1-9ab05fab865a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644478, "uuid": "88323310-b16c-4612-9894-89e5e4faba6c", "value": "8eb7939848c171ebb4a2203ad90741bcdc5c7e1feebdd3cd1b7ca4bd4dc307ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff3ab63-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622328, "uuid": "1110970c-5112-42cb-a4e1-e2b90f633180", "comment": "Malware payload (RedLineStealer)", "value": "036474a430824dd3313c87923f910a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622328, "uuid": "6a1994be-bdbc-40a2-93b7-27692b0c9307", "comment": "Malware payload (RedLineStealer)", "value": "8ec2409047023ae11bdcb0a8939e42257d88a6ba08925492a6449ce4308bca04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622328, "uuid": "3562eee5-163a-448a-9dc2-19404b9d4961", "comment": "Malware payload (RedLineStealer)", "value": "778be8e89cc300666289e456a77b408ac5a38276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622328, "uuid": "2a79cfd1-a384-4401-bf92-1c4f0b7a6ba3", "comment": "Malware payload (RedLineStealer)", "value": "aace0ff2eb2603ae316507284b0c66ddd4858150d6ae8184add9dc0283b8969796ad7f238c863ecd4453469acbde2490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622328, "uuid": "6b201561-f052-4a38-bbe8-0cf0a716a632", "value": "T1F1060102249C5E6FE43A393523DC0553F96CA474EB0A1D4522D6ADEFC94DE83F6A68CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622328, "uuid": "0b58c1c7-73ea-496e-81d7-352502e1e763", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622328, "uuid": "42a52af1-9537-4d2c-a20e-524d592f058c", "value": "49152:ho+WTXthga3g+zPoEE+MZBA3Gkpo96C4fmKBTMxKiGvRd2vrXKYQz82KEuRUdHN6:heABA349BYTS/2Rd2oydRURVjuEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622328, "uuid": "42974bce-a4e9-434a-b4f1-c7d6ef58a857", "value": 3791688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622328, "uuid": "586b2094-b358-4e95-bf94-3182faf84601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622328, "uuid": "4dd50b64-d466-4cdc-ae7c-44a85c745ce9", "value": "036474a430824dd3313c87923f910a03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c8cb9b-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622958, "uuid": "a62741a0-28d4-40da-aa03-9404bc954a7f", "comment": "Malware payload (RedLineStealer)", "value": "5446c8d6e93d5a4cbc83e68d7ff1766a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622958, "uuid": "31aa8c7a-9104-4ff2-9acc-a7cfeecb3f1b", "comment": "Malware payload (RedLineStealer)", "value": "8f5d5d1fe6f81af22caea0ea931200367849f5bd5408e15a1de252999a54c14f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622958, "uuid": "19a7aaa2-14ef-488f-aded-d5a22d05491f", "comment": "Malware payload (RedLineStealer)", "value": "798b2ed7757d82c6f196a8d8ce34ea1c269b432f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622958, "uuid": "68de4d35-5ced-4601-b7e6-3925b8eb21cf", "comment": "Malware payload (RedLineStealer)", "value": "2d444d889aa45dbdf4b37a013a12a976118d996746b87f442218319bfe08f91ce736304b4e40c1527d92f5983cc744a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622958, "uuid": "ff8915e3-f8a1-4433-8c8a-6cf04f916785", "value": "T138160119602C5D5FD67034B52BED1993F9ACA8702B6B0E0122C6ECDFD4ACD81F2E199D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622958, "uuid": "ff4c3ccf-7c0f-4229-8cb1-43f9bfa0e041", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622958, "uuid": "53ffe130-43d3-4932-aa7b-077ea039d2c3", "value": "49152:AnIJn+STtJu/ukNJYbs1k3hUfjZsl72fRR6U/ohmuOuaNcpZlX7KjfXxd4AjqJyo:AnGOV2Ahm/UdbqJXvN4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622958, "uuid": "904da2f3-8848-4ffa-83e6-907c2f465104", "value": 4103496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622958, "uuid": "549c8116-7d34-4908-9d35-d4be774a21c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622958, "uuid": "93a7866f-3b9a-48b1-ae8e-b56ab79f1bba", "value": "5446c8d6e93d5a4cbc83e68d7ff1766a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99ce15a-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624304, "uuid": "557aac23-91d1-49b5-9883-35f93cccf610", "comment": "Malware payload (RedLineStealer)", "value": "8e7602e7e579cb6b1c30fd49a7f659bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624304, "uuid": "aaa0d731-d918-4d57-881d-c2029ccbcf02", "comment": "Malware payload (RedLineStealer)", "value": "8f912e503524964e53bfe59bfada77722295cfa64c78b99a912aef5d186e2122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624304, "uuid": "4b939611-0b9e-4f79-b7d9-de4791ab0be0", "comment": "Malware payload (RedLineStealer)", "value": "d0a7c8b4cf16b9099429d5061e36b000e1ff5b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624304, "uuid": "9ca41bdf-c10a-4aed-9737-f6f0a0ad76ca", "comment": "Malware payload (RedLineStealer)", "value": "d5b52000bf613445987bef9f825adf818a736dff8fc5b556594044b118709217f7c477ac9bd35b410fb85d7bab0890de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624304, "uuid": "4421505b-adf6-4a52-8c54-2b1c30d684ed", "value": "T18C160119616D4E6FC435357127DC1993FAAC94B56B0F0E4222C2EDEFE8ACC91F29099C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624304, "uuid": "bb5d2a57-2043-473c-bdfe-fa649335c8a8", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624304, "uuid": "7e827407-f189-492f-a49e-f366f66d4ae1", "value": "49152:7ocMOavRRZX46oVyM1B1K6nHbkD7v1rgW1Z7j+ZeQEx+8MvQOPzll6E2bOtU2/l9:scb7IMU+W1Jum5OPKE26F/lw9YB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624304, "uuid": "773c5ace-ce07-41d7-be7c-5f6b2a66f718", "value": 4071752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624304, "uuid": "d6bc0a98-133d-420f-9297-e59f80265221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624304, "uuid": "54270ed8-cb22-4981-8164-7bc292033c1b", "value": "8e7602e7e579cb6b1c30fd49a7f659bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63041a42-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622360, "uuid": "b957119d-d448-4736-bdf4-47829de369e0", "comment": "Malware payload (Amadey)", "value": "27c979f47d42cba8f13449217f194e5b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622360, "uuid": "177e4b7a-890e-4e08-8cac-c82a23ca2dd8", "comment": "Malware payload (Amadey)", "value": "8faa3e3ebf9dc4cf9d302ba3a6321cfb9db915ad7596e986120da5aab26afe93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622360, "uuid": "f194c3ff-be38-4bb4-a5bd-e9d0f0f00500", "comment": "Malware payload (Amadey)", "value": "02c393495890de8e55c0109dfb1a4337ca961ac8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622360, "uuid": "f585e19c-c396-4fe3-83d7-13278e75eaa0", "comment": "Malware payload (Amadey)", "value": "eb21173d172d60d7067c6e7a352eff465ae5c5923300f2b52f3383c412225b3b0aa08f4eaeee416bef86b3cea7918b95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622360, "uuid": "0c4f676a-bc3a-4cfe-bfe7-7066bbcafd65", "value": "T163160129602D8D9FC43134B52BDD1953FAACA4316B2F0E0122C6EDEFD9ACD80F69559C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622360, "uuid": "41a269ca-ce97-4035-ac28-f33385d11675", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622360, "uuid": "eda5074e-8199-4144-b46a-de2a593947a3", "value": "49152:z1eFZE7oA5wQ1MIPufSQza5yEWLvZ+ooedAOR9oUDO3KVcIbUlr7icphBk6y/jfK:USZovfGFOTAhIgZubD9BLP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622360, "uuid": "87dd006c-2194-4ea9-bafb-4f9837a156bf", "value": 4078408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622360, "uuid": "77d32eae-56af-4b4b-bc4e-4e157f1e2d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622360, "uuid": "6c703ea9-5675-43d0-ad8d-f6fe85d7fbf5", "value": "27c979f47d42cba8f13449217f194e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af36623c-1bba-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688619911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619911, "uuid": "28effec2-79a8-4d27-9ec7-7358e0a81e1c", "comment": "Malware payload", "value": "13f95276ecc6e93815a3b7724b4ba150", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619911, "uuid": "560a4a42-72f0-4059-aebe-05ec07cc9b67", "comment": "Malware payload", "value": "8fb4fcb7ef3de06ea00183c3398ecd49cbba75bb9eaf9aa3ea71adb383b30d2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619911, "uuid": "09fc0b30-d607-45a5-aba3-b56efcaf07e3", "comment": "Malware payload", "value": "9791a15517a5f4281da14377cdbfe4c2cd137d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619911, "uuid": "349c2cc3-7418-43c5-8239-4ba76c21c079", "comment": "Malware payload", "value": "509f7392850605345b21de80dae46d5d155799a6887067f459e1b5962330eec889e3c19d34f8a45134f3d397976bd952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619911, "uuid": "4b072053-1faa-41b9-ab52-126c0d46a97f", "value": "T130A3D90A7E21DFBFF259C6304BF78A31569437A62BA18644F15DE6480F2038E645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619911, "uuid": "f12eed58-1719-4129-aa9c-b83de125dd71", "value": "1536:Uu6G+A/8JtFrzqX+TrtquFszrBUqo1XFwZRO5H34eHAeSnk2bURgo:UdGKt54+qodARO5H34GlkAgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688619911, "uuid": "029afb84-46d6-4441-8013-26fe81b5d4b0", "value": 106060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688619911, "uuid": "7600fb25-7c94-4e74-8cc2-5fad2f2131bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619911, "uuid": "c943eff2-d69f-4930-a915-42b6f645ec93", "value": "13f95276ecc6e93815a3b7724b4ba150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a6ee55-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688624116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624116, "uuid": "f78ed259-cedf-4f2c-a39c-0835e01ed7d6", "comment": "Malware payload (SnakeKeylogger)", "value": "fa06d74fe3e30c3945ed7290e6f7c033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624116, "uuid": "750a73cf-328e-4926-94a3-6ee73f1312bc", "comment": "Malware payload (SnakeKeylogger)", "value": "900ac8b3948216cea6f3bd1ae3f3b4c3b3d715e9d666657d2f2f17e5ec300c56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624116, "uuid": "dffaf704-d99e-4666-aef6-cb10e5dec6fc", "comment": "Malware payload (SnakeKeylogger)", "value": "9e0821ea82787fb68863fa73b055c51870dbfca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624116, "uuid": "37338cd5-86a3-43ba-beaa-6391e37ff9f0", "comment": "Malware payload (SnakeKeylogger)", "value": "7e3759e9d25a04369ee8b67a493af4fbf05b030265c1ddd857feb858eab5ac096fd2e1767dfffb0d1eb9528f7cc78044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624116, "uuid": "e692baa7-d63c-451f-8f01-313797735807", "value": "T15CC4393C1CBC7223C134E6B68F9CD421F264956B3D65CE3769D7989A061EA0229C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624116, "uuid": "d03f4ea6-baaf-4ad4-8722-3146b4d6a42a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624116, "uuid": "6a347370-7b6d-41b1-b636-8d610f88153f", "value": "12288:1XBe9QM0ugms9mIh4yRdFAt/Im0j++my4zJtbZQm:9MLhee0dFvm0f8zJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624116, "uuid": "ff186f40-1e7f-4718-b9a3-abba7273c784", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624116, "uuid": "aa6aa23c-0bf6-430e-aa93-225e31e3c9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624116, "uuid": "457c6e21-5135-4b99-8cea-18480b473512", "value": "RFQ Ticket 1652023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75895357-1c04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688651597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651597, "uuid": "011143e0-ef9e-4a88-844e-2a91f6cf1a0b", "comment": "Malware payload (AgentTesla)", "value": "bd919f42faf309cd91c1bfcb9e8e5f71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651597, "uuid": "2c47cbea-bfc2-4dae-9668-ac189f87e00d", "comment": "Malware payload (AgentTesla)", "value": "9059ad105bd54068b066f69fe3fc0cdacd0aeab946f78dcfb1d744ff1742fb2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651597, "uuid": "b0975d95-8db7-41f1-bcd8-3bcef7b71879", "comment": "Malware payload (AgentTesla)", "value": "1fa16906be1f0eb4aa9556fddb816fe847c45aee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651597, "uuid": "2e5c6597-b1a9-4466-ba4c-04e65787c7d4", "comment": "Malware payload (AgentTesla)", "value": "9c1fc59e0e42c42250f5dd831f6fa4ab3c158febb634edd3979d792d0bf3239cafc075edb57a63cd6ee43d3fa47a45e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651597, "uuid": "c4e0e74c-3a8a-40db-9789-6fcb659afa71", "value": "T12A05E080713E2963EABACBF50251627097F62E1FA25DF6E84CC670DB52F4F414642E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651597, "uuid": "54101b31-be6a-4fb1-9c49-1a1f40d1237c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651597, "uuid": "572fb259-6465-4261-8d3f-fbee4fb69708", "value": "24576:ih4qXdVsyFKi9R3rlcmce5LC10FRnuWX:W4qXdblNcMRn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651597, "uuid": "af66c850-1bfa-48cc-98f5-f259b4790589", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651597, "uuid": "f98a57b6-feaa-440a-87d6-fdf3d1197f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651597, "uuid": "9c491a72-8db3-4e86-814e-82aa5b6d10df", "value": "9059ad105bd54068b066f69fe3fc0cdacd0aeab946f78dcfb1d744ff1742fb2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ca5d45-1bd5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688631597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631597, "uuid": "08ef7107-67d6-4e48-956b-2af530d83c2a", "comment": "Malware payload (Mirai)", "value": "2a29a564a9e620f2c2d0f69264a22051", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631597, "uuid": "984d6055-f3a2-4fab-a3a6-7ad9fac20547", "comment": "Malware payload (Mirai)", "value": "908ba6e2e76842d62bac08153fdb1cec1e51262a4fac254df868fbd3c930c404", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631597, "uuid": "b5cf4e13-499d-4912-9332-19a69302632a", "comment": "Malware payload (Mirai)", "value": "c290435f11019d85460319fb9362d8bd9d3c7e9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631597, "uuid": "2346f0ae-8294-4c8b-992d-efd9b8f33559", "comment": "Malware payload (Mirai)", "value": "b7f94b5333d824e9775eeb315d86a69bf85c3e17b97571aab31e8bc98f95a3699882e700c2a2c6363a29758949cb8e4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631597, "uuid": "48010902-130b-4d84-ae28-2d1fd2061882", "value": "T195330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631597, "uuid": "787a8953-48d7-43c2-9bbf-11d51fa95fee", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGT:r/hqaJMDg9eqK806MHdkfQX6HuCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631597, "uuid": "a5399c87-b7f7-4f38-820d-8b9681fb0cb4", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631597, "uuid": "27fbeaaa-d54e-4e64-9574-db27f01a56fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631597, "uuid": "5e1d5b11-9ae6-462f-bfe8-12e65ebca37b", "value": "2a29a564a9e620f2c2d0f69264a22051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff2623-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620454, "uuid": "ad6524d6-4442-4123-a334-99a28061a91f", "comment": "Malware payload (Mirai)", "value": "b547790065a10d1a22950ebf7e4d3f41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620454, "uuid": "57295602-310d-4521-89ef-c765f98bd668", "comment": "Malware payload (Mirai)", "value": "91fa5c3398bd48bc0bdcef941691ab6626ed37f56f0e86ac6a5e3d2a87045497", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620454, "uuid": "2bc21050-b1ab-4393-8d48-5ee5a2d49156", "comment": "Malware payload (Mirai)", "value": "186bc9d22202382fcd0927806731e724212db583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620454, "uuid": "8d948b52-709a-4879-8672-14051708c498", "comment": "Malware payload (Mirai)", "value": "d6981fa960ffe095c35360ab93c78a1a98b050b5df70da248b5e07670b962d90fdaf789a609e709a571c84a1c5fd3f48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620454, "uuid": "1f62b28d-1a53-455f-8084-9012ce1f923d", "value": "T172349621592AE213C0ABFFB9EFE676929399F2474E858603B5D0144D4FF4E58241FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620454, "uuid": "49b08cdf-87bc-487f-b382-1f08cb69b365", "value": "3072:DNPwCROFuErxCN8IpmtMyCe/ICIQjGzr1TwZfWy:pPwCoj8+ye/ICIQjGP1TwZfWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620454, "uuid": "c47ac34f-9274-4431-b4f2-6de44a944d1b", "value": 243479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620454, "uuid": "7ae32c76-e2da-49fa-9b09-d5d2a09132f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620454, "uuid": "e1c4df99-5418-4311-a828-74e05f8fc13f", "value": "b547790065a10d1a22950ebf7e4d3f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff641407-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661706, "uuid": "a956e488-c65a-4232-801c-8781970abca2", "comment": "Malware payload", "value": "3b754cb58af437695a070977e74a3271", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661706, "uuid": "f99f6c0c-0eb6-44c2-85d2-1662fe376bc3", "comment": "Malware payload", "value": "92c30369096db1bc8673c979798faffeba3903d2e6e43ad1a2686c033067532e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661706, "uuid": "9983de91-2bbe-43e8-8016-7c7aaacddbda", "comment": "Malware payload", "value": "a76c7a58ae563b0ff7078b217fecea6d9ac8a1a7", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661706, "uuid": "21205c44-ee6b-4ec9-8d4b-d72e2bbc197e", "comment": "Malware payload", "value": "b33197aa022be7f942bff1477528cc98735e7b3a9a743424507111160af9a877d228a9ccdf834a0ff47ac7e4755b94c7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661706, "uuid": "48e31c24-07ae-4471-bf9b-c4d08f0542fc", "value": "T162A5C983BA469DE1C185573AC6B7883403B1D54123BBF60A798E232A55C37BB7B49D0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661706, "uuid": "7be379c7-edc8-4ca2-a4f7-85d8028fd53f", "value": "24576:s58eKasUSIBtKnaoEGpC/nA3DhWc0b68herEh5S:sKZasAjKnaoEmCaWc0b68h4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661706, "uuid": "7a8088f9-a53d-4773-bf6a-8f0b55b880a4", "value": 2160640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661706, "uuid": "d8866cca-4791-4d9c-9feb-9a2e7b3c4535", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661706, "uuid": "360da63f-9862-4fa4-b4d4-061cc9cf23f0", "value": "Sipari\u015fi (P.O_5220288)_GEMA ELEKTRO.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9959093b-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623310, "uuid": "35b6c271-fb92-4b8e-bb5c-576e5daee1f8", "comment": "Malware payload (RedLineStealer)", "value": "446bf18e0cb7f760006c57521c094722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623310, "uuid": "cf70e2f2-f152-4139-aaaa-3c868a1b02dc", "comment": "Malware payload (RedLineStealer)", "value": "9303dfe506227ee70d3c3f423255db110d6db10565bb3016c3f076818f984513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623310, "uuid": "2b587179-cb17-4d76-aa0b-90cfdb3ffcd8", "comment": "Malware payload (RedLineStealer)", "value": "be6dfa6cc34d745ae50fdae065ab1088fafd1eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623310, "uuid": "ae21831d-8e81-494d-b621-7ebc4b84377a", "comment": "Malware payload (RedLineStealer)", "value": "4e537c7cde5aa8fc57044abc2d2fc7fa31f8a1adbea850bcd1b09232f86125dc0c7c135c0971190cc32c9e197c376bea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623310, "uuid": "c5a846c5-b8b9-45d7-b362-c584a192d4d5", "value": "T14B160119606E9E9FC57134B12BDC1993F9ADA831671B0E1026C2ECEFD8ACD81F2914DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623310, "uuid": "461dff0c-71d3-4e88-b54f-ce1af54376b1", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623310, "uuid": "23b1d042-3420-48d2-b745-9237f4a84574", "value": "49152:2iGfXhwCqihJ/J6QHR/mDD+T14wVjk5zAdF4GOlA2w1m105zv9VsNLZZGrlNmkB7:OfTJtoaVjEGO2DE7mMmia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623310, "uuid": "8b46ab71-8ad7-463b-a9d8-40c2d88e0ed5", "value": 4060488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623310, "uuid": "df663b85-d278-47da-96cc-8b6535bf2c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623310, "uuid": "a8651d72-f70b-4f0c-9765-3470b1e0900c", "value": "446bf18e0cb7f760006c57521c094722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08316242-1c46-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688679760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679760, "uuid": "efc74743-e60d-46b8-8208-d96f34c97111", "comment": "Malware payload", "value": "b7e00c20de3ee65c6511774d9ec7258b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679760, "uuid": "080668d6-9ebb-40c8-be51-5a6e356c1154", "comment": "Malware payload", "value": "93296266fa08b301da48418e8b88cc4f9d453eb9d844d39c56619d0f741f2a29", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679760, "uuid": "788a4cfa-5937-49e3-af07-026c15249254", "comment": "Malware payload", "value": "cc5915fbf3291d6a721ff5ef968760f1447b8397", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688679760, "uuid": "21789ab9-252a-41ba-a4e5-0bcf2120355c", "comment": "Malware payload", "value": "78dd5c639668bfb398d2289b2e81a60f8c658988a6d494e06c77521eac2388b155a518bc03c68cd8190fa37880461abd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679760, "uuid": "53b9ab61-4d74-4662-a6cd-0dffa0bef0f3", "value": "T1E3F4A5C227FBBD430417037A33A566F59939CAA5D9C998DCF5453C68F0ECE02B9982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679760, "uuid": "dc601b1d-85ef-4985-95db-60aaed83de98", "value": "12288:+MPgFdWHvTbduIqgSiF9LAvRfb2G+hSPnnbwESwsfEVRz8YnpyGM7dBLTw9FzetX:+MPgFdcluIqGF98RbxqSPn0XxfEVRz8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688679760, "uuid": "0d703ca9-2b9a-4bf3-8568-19c63cf0bd11", "value": 783751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688679760, "uuid": "b4bcff01-80d2-42bd-a01b-6b181df9e380", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688679760, "uuid": "af208fa9-b53e-4388-8c5d-051e755a28f9", "value": "Document#002137.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751248e9-1be6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638711, "uuid": "2a580fa9-ae74-437f-963a-07a7cc40e90f", "comment": "Malware payload (RedLineStealer)", "value": "908fa2bfc49aac3a04edf9f67e89c7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638711, "uuid": "58956f86-574f-4783-943e-efe1838501d1", "comment": "Malware payload (RedLineStealer)", "value": "93342d5ad54a23ce2df4d6fa19156e77bd8f922d82b8236b03df6d9d8e1e68cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638711, "uuid": "00c85ac4-1798-41ab-abdf-19e863ced888", "comment": "Malware payload (RedLineStealer)", "value": "b7ed5951c8d4a1c8d387e7463544a891bd0bb7cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638711, "uuid": "f3cc1a1c-8dbb-43f7-a225-c62110605c13", "comment": "Malware payload (RedLineStealer)", "value": "705c31295c7089772588528b2ec1460009cba8d97c9d8f9878f9dd24f9027bbb74a9fbb8c96e7aeb480fbef86891dedc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638711, "uuid": "571bc2f5-fe50-4950-b645-5c08b06d6dd0", "value": "T1D8160159642D8DAFD47038752BDD1983F9ACA4742B1B0E0122C2EDEFD9ACD81F2D598C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638711, "uuid": "c4a28380-77ad-4144-a83f-2ede0c49ecc9", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638711, "uuid": "0f145ee5-c130-4b2e-aa1e-8461114eec32", "value": "49152:v9mFbRYtpO1vfAVFxTCbmXEKwN40XHOIvt8/zoPSwa4cvGgH1I+bpSCxaSl8FUOl:U80YQOCtq11IUzEF1II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638711, "uuid": "cf598cde-b227-4c0c-b963-215b03c63430", "value": 4081992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638711, "uuid": "c2d13e6f-13ef-41e4-922e-31996d424dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638711, "uuid": "f0dd5b71-e259-424d-9632-317f40223cfb", "value": "93342d5ad54a23ce2df4d6fa19156e77bd8f922d82b82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad29dfe-1c1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663283, "uuid": "fbb986e8-47ec-47b3-ac2a-8d4e0024765d", "comment": "Malware payload", "value": "6e77acf509bc278da615cacbb43de0dd", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663283, "uuid": "cafecf52-4311-4351-a57b-be9fc50f081b", "comment": "Malware payload", "value": "93dc05053f3e84a67c89d47f8d49ca02f2287bd5d758486bc26207d64e670106", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663283, "uuid": "956db3b8-29ef-42c8-b09c-8fbcdfdc0299", "comment": "Malware payload", "value": "8310817da37df1c009bcb5590716b01942eeb404", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663283, "uuid": "e1e37cc8-157d-4e69-85e6-934ca0cd46b7", "comment": "Malware payload", "value": "6d1a6628148b8d4fb0b0708c923383bd5cbca13f492bdd700941ae90960cdb1e3b489970664bbdf0fc2188eb35dafe40", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663283, "uuid": "2a3b47b9-c06b-4523-a7a5-f0c0bca4ee91", "value": "T130B5F113E3638E0AC07127FD46A2D3B566237E846522D20AA6F47C63FAF79671D0B0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663283, "uuid": "50f91781-2dfc-4510-9176-e80c4b65cf3f", "value": "49152:fiWElNf+qn/9pLV8zi7q+4txSWxmTRrwnr+c6a:6Wpqn/v5aiG+4ffQTmnrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663283, "uuid": "f9411cd7-68a2-4293-87f6-ae4298a74575", "value": 2494464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663283, "uuid": "ed428142-9530-43f2-b550-16a122a74faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663283, "uuid": "8592dac5-e6ce-435d-bd93-0a465c8262e5", "value": "Evolion Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8074fab5-1bd7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688632288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632288, "uuid": "71bf853e-dfb1-4e39-b38c-6eb34cabc171", "comment": "Malware payload (AgentTesla)", "value": "4870075075b5b22fbc0f0685d6dbf6e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632288, "uuid": "b9586b11-a6bd-4fbe-b9df-10bb17dfcd66", "comment": "Malware payload (AgentTesla)", "value": "940452c26b4fd683f1c88746b751d4299e9b8c3fe25aa62168eca31924c17592", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632288, "uuid": "1d00a2ba-1061-4185-b971-46901052fd5c", "comment": "Malware payload (AgentTesla)", "value": "9a57af117a8e3ffb211da1655cda7a6ab81f3d6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688632288, "uuid": "912eb569-89a4-4a74-b208-149c53ec999f", "comment": "Malware payload (AgentTesla)", "value": "8851858695163f12a3801214346af1c56b87e11bf681cac603a71f5b4ccc765a4d12157e2180b25040f0b12fe4a1fdda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632288, "uuid": "537f7b77-c56d-49cd-8ee3-961a266e6c15", "value": "T1EDF48C3C1CBC7622C134F6F68F9DC421F25095AA3E61CE3769D39899461EA0265C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632288, "uuid": "fa0b3b7c-f8e2-4543-b143-a6d56e1e1b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632288, "uuid": "43df01ab-2a14-48a1-ad91-935098e70616", "value": "12288:Jzy5jhnjhKHmTgEBQXfidVZrCFlh5lqD5WfcAkBBcnECDhRg0IXn:JzONnNKHmTgE2XKD1CFlJ/DKBcbVRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688632288, "uuid": "bb866d7f-f4ae-4446-a654-c6cddd9f12d5", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688632288, "uuid": "ea0d7b30-2369-4d47-ba7e-ff05d6f025f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688632288, "uuid": "90803eb7-75cd-41fe-b43f-2215346ff678", "value": "29CB21AF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab3e76e-1bf2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643713, "uuid": "ef70066f-c2ee-45dd-a404-ef646c51f8bb", "comment": "Malware payload (AgentTesla)", "value": "1aa902b726ba92d2461d2183472f899c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643713, "uuid": "9ba41682-e024-4455-87fd-0b9729efe901", "comment": "Malware payload (AgentTesla)", "value": "946712b857f5929d15d1460183ec4d5e6f09b6096e99be7a37a8f167621d0206", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643713, "uuid": "006e32ba-c90a-4fc1-b0a7-d70a6dc2d0c9", "comment": "Malware payload (AgentTesla)", "value": "69c3247dcc0e061c9918a9723ba93229a803760f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643713, "uuid": "058a0904-cdc0-4c3e-8756-2239faadec25", "comment": "Malware payload (AgentTesla)", "value": "1b90cd0d4a445df5d5e294caa950e9613b8b8e46e1e50ae22ab19ab529e7de0d46cdbd8ac0e758b7f8684fbdc1a696be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643713, "uuid": "0ad7eb50-6400-43ec-9485-576141022040", "value": "T1B4126C185EDC0B96E78BC3F6E95CBC690852FA74DDDB3881A31DFEA20B031535A57481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643713, "uuid": "4c738979-caa4-4938-85b7-4ff4eed54d99", "value": "192:4pNekr0sOczXZBFZmPMpBYTEEVpvhFk5fN30gjWWGiO9uA7lKRj:25r7jZBFZM+BQVvA5f97WJ9KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643713, "uuid": "4971f00e-9d92-445a-bef7-2bebf7f1a1d7", "value": 9185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643713, "uuid": "b1aa0d12-6513-4de9-a03f-9a66c3c544a2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643713, "uuid": "e8137df4-9a8d-402b-b435-0f5372e5b277", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.24026.32120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3983aa-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624253, "uuid": "989d1fa8-a2ae-4c94-b143-6daa21792520", "comment": "Malware payload (RedLineStealer)", "value": "cf1ac1293dc075b6a4128f810f4cfdb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624253, "uuid": "d39c3d95-cfd7-4acd-82f5-ae84790878ed", "comment": "Malware payload (RedLineStealer)", "value": "947667aef0e64d8228b5243a5d6d6515fe3aa8d5c83940ef3ff1a2f52806ff86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624253, "uuid": "2bc239ea-6462-4b00-be65-759d80a096a2", "comment": "Malware payload (RedLineStealer)", "value": "4e8ed1541cf06d291631caabb4b91a45a6f23cd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624253, "uuid": "7cd917b8-9768-4f77-8810-8795480e6e72", "comment": "Malware payload (RedLineStealer)", "value": "6b90100cb7a8165d5bd6a576a19b1d4799552a2efeed1e4954457a247253ab8e1959ec69df6c9d9e2accfb366d666c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624253, "uuid": "de4ab566-d00e-485d-8fc7-0a073750885c", "value": "T16E060142546CAE5FE03A357577DC4817F86C94B4DB091C8562D22CEFC88EE83F2A699C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624253, "uuid": "a63bcad2-3cfa-4182-8097-aff849f23a58", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624253, "uuid": "78752bac-9cb8-4644-8365-674469644261", "value": "49152:Ca9Yyvk+UHD2PtL1yprIR+jCv0XVyrbF0HcxrNKup+YBMl/t5SHyHwq48XtJWAGZ:LpmTwqc5+kCiSHk8XtJM7Mcg0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624253, "uuid": "0e758138-c491-470a-b44c-1787d13ca647", "value": 3756360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624253, "uuid": "af371bf8-177f-416d-bb5f-63799c31ecba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624253, "uuid": "38545c0d-39bf-4113-9b31-1e670dc5416e", "value": "cf1ac1293dc075b6a4128f810f4cfdb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8525f9dc-1bdc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688634443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634443, "uuid": "ee22daaf-ab00-4865-bd0c-722640af750d", "comment": "Malware payload (Mirai)", "value": "9242521b0ccb3fbf0c28d759e964ad37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634443, "uuid": "924c5a98-c18b-4691-9879-d5e066308f88", "comment": "Malware payload (Mirai)", "value": "94ef7ff95429026d2944f41620e29eaf197cb70b0c69179af6af0a880c4c3a01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634443, "uuid": "883609d6-e7f5-4a87-978a-7a3f6768acf7", "comment": "Malware payload (Mirai)", "value": "141f054ff88d83d6787e4868f2f50e362e48107d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634443, "uuid": "1c386d64-71c3-4763-97fc-760926311e60", "comment": "Malware payload (Mirai)", "value": "f30290b280be3c81131b4637d2c83aa5ec37cd7f7aefcc30cc89ddabe726ea65d33a9f4df06c50df3a5bede67d17bab3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634443, "uuid": "e1466704-4ccd-4c9f-880c-ac9123623890", "value": "T154A2D025D346AEF4DFAF9D9052C2C2C276F587C6278BC8E340EEAF013516046BB89D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634443, "uuid": "c3569897-494c-47b1-8326-6558949489c0", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5bM4uVcqgw05VxJN:9RxsSVsMD6xiJJE5zRWN+4uVcqgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688634443, "uuid": "7d9fe6ee-a139-48ae-8eac-b5880f16fb5c", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688634443, "uuid": "cb20c52d-1647-453d-817f-51f014e2d90f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634443, "uuid": "c19a48d7-3f81-403c-b901-bd225911d148", "value": "9242521b0ccb3fbf0c28d759e964ad37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d96c017-1bc9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688626270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626270, "uuid": "2351ce35-e0ed-4bfb-a3da-fbe5d3655e85", "comment": "Malware payload", "value": "4292a106a5f1734967155a129a3b06b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626270, "uuid": "a96a011e-3acf-4209-a5a2-cbeca0a82676", "comment": "Malware payload", "value": "95467b7aab6ad6bd7ba78ab6639626601b5dac75a17c68c408aabbaef6d74562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626270, "uuid": "78e6672b-3736-418b-a6ba-231e7cf986d1", "comment": "Malware payload", "value": "3d641d09971ca6d25aaebebde233921f4567495c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626270, "uuid": "ff8613f7-844d-424a-8e02-f5bc90fb7e52", "comment": "Malware payload", "value": "76fa3f7d4b6095f5128df9b56c0737920deb24a6280569853bbb81bcb04d959f84c2eb447c2fa3ee094dfcc5b785ca14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626270, "uuid": "2aadeb74-adae-415e-9b1c-a4b9fddf53c1", "value": "T1B055F0AC721075EFC817DD769AA82C64FA60747B430BD207902715EDAA0EA8BCF145F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626270, "uuid": "fb91cbb0-37a5-412c-beb2-f9db51160af9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626270, "uuid": "270d2d57-5128-41cc-b04a-e866ef163518", "value": "24576:ZTElHo0KPth6gkBxWGtyBSG4mOPBDgh23q5Tm:VmHzKPGL1ABBpkBD46Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626270, "uuid": "1ed76f95-fd4c-4f89-bfe2-7391b0869c91", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626270, "uuid": "e90fa0da-db91-4ff5-9fb0-028a2d565ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626270, "uuid": "d4548671-78a7-45d9-8374-accaa59e0a4b", "value": "DOCUMENT REVIEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee60b9e-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638459, "uuid": "e4ace2e8-10ac-47c1-b114-45d3df2af193", "comment": "Malware payload (RedLineStealer)", "value": "c18c0260d2ab41bddb5d3d77b8d4cb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638459, "uuid": "bdceb25d-14a9-42e2-9488-0803c7ce6b43", "comment": "Malware payload (RedLineStealer)", "value": "958e8b061a61a24c98288b472e133ce2581f705185b8ce7e7fb8d6f5ff25bc83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638459, "uuid": "e11b7792-73da-4821-b4c9-4246e4c17804", "comment": "Malware payload (RedLineStealer)", "value": "7630fb4c84e62a955241d9774958bd295ef0ecf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638459, "uuid": "e8767b66-92f2-44a1-be63-fc7d593219cc", "comment": "Malware payload (RedLineStealer)", "value": "195a94afc1e67996e5ee41b8645e9a99cf9f879b8ce35a1b2a3520ece5a8f57b48becce8b3248a73e46e033f3b17be0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638459, "uuid": "745a9fb3-e79b-427a-a664-bcd795af86a0", "value": "T16016015960AEAEAFD93430752BEC1553F9ADA475171F0D0022C2EDEFD8ACD80F29189D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638459, "uuid": "854dc600-f031-4aa9-8ff6-ed267709c522", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638459, "uuid": "5ac8d2ce-fc64-4954-b50c-c4bf36cc5d51", "value": "49152:WvzIXOV8B3IKS7PbB4gkbTknQHoEaCG+YMsOuztORieqM/hG3O84uR3V59xTvKrt:2TkUSQnREyfjLLw/hG3F7tbLQGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638459, "uuid": "d5808a89-bb9a-4c1e-af78-718808fbdf87", "value": 4053832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638459, "uuid": "0fb43f3f-2634-45f1-bbc8-1980f35ea572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638459, "uuid": "b642dc4f-2079-4b5f-9d77-2f908797fa16", "value": "958e8b061a61a24c98288b472e133ce2581f705185b8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0755394-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688623832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623832, "uuid": "858f1f2b-eff1-418a-a82c-33240b307b0d", "comment": "Malware payload", "value": "0b137de431ea3d8b3b13d54bc7408273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623832, "uuid": "910b96c8-6ca8-452b-a995-535d1469bc89", "comment": "Malware payload", "value": "95b213f1264d45aaaed1c36b9fb6be5aa0547fc3ccaa7e954b754e7504840ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623832, "uuid": "573a6288-7f63-4823-817f-4fb45d612a18", "comment": "Malware payload", "value": "b418122fa52a5d3591c89262b2287e74bdb4ee4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623832, "uuid": "e51b4d5a-f3f1-4558-bcf2-c74b036b3c5f", "comment": "Malware payload", "value": "182bb6c8944de53f0849f1f977e76308cb2880dff9536c98b3b7619be8720671b32184ef14d498e0c05b493f68d59079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623832, "uuid": "8d56c7b6-e55b-4384-9c55-7ce44554bda6", "value": "T1B2644A65BBF6AD84CE9D33B3C8146BA4069E077645F2E3C84D285952273F6A5CB0B13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623832, "uuid": "e8193049-0e98-446f-ad1a-88bfe64a9145", "value": "6144:L/E8DIpjK28t4snQxlp3z/pSZ+pDKpf9EkQbKxVKK:dEpj7snqv/cgu4VGnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623832, "uuid": "60ca5056-ae31-4eba-9745-5d4957c090e1", "value": 329732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623832, "uuid": "483b66de-5ec1-4edf-be8c-d05fae44f807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623832, "uuid": "da225486-ec78-47e8-b4cd-76c89a949079", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74127e92-1c00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649876, "uuid": "3b447aea-928c-4aa1-b13f-062dbb3bdbf1", "comment": "Malware payload (AgentTesla)", "value": "d53689ca2b3ef5ad84921b2894468ff8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649876, "uuid": "3782cb2c-c132-4211-9b5a-8a895b0e266f", "comment": "Malware payload (AgentTesla)", "value": "967faf62f7ca8a187e54a09b1cf77ec300cb9e2dc935a4b0d0462b498f3d004c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649876, "uuid": "b2eb375c-8f10-469b-9d18-599ea3141688", "comment": "Malware payload (AgentTesla)", "value": "e030fe70f3fc2ade788537f98a68b2d0ff880549", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649876, "uuid": "a5e561de-d61d-4f91-b9a6-3f1abdbb1671", "comment": "Malware payload (AgentTesla)", "value": "4466c7441a93ab8c80eca41f507eeae6811dd01c19e3945de178a621ef230349e52743b8a4ce5fee287d5fbd04511e85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649876, "uuid": "2d08c5d4-7010-4709-b4fd-5bf3133bdc25", "value": "T1110512B90BA78A5ED8973FFD2C216AB1D0E59A85757BC7838FA3FD5CDC40A0808851D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649876, "uuid": "de9cc653-c866-4cb7-bd7e-8dcfc3d0313c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649876, "uuid": "b583ac09-d0e8-46c9-9146-d3c89ed31db2", "value": "24576:QzM+xL9Rk9z2btREft9jKI5cLkV/VfvC:QzM+bkd4RkF/3V/Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649876, "uuid": "fa70ee55-f804-43ba-97fa-15e5fb623a0a", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649876, "uuid": "d82420d8-77b3-43ea-9207-0ac3d55ffd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649876, "uuid": "377096cf-869f-4470-8a06-3af37474ed4e", "value": "967faf62f7ca8a187e54a09b1cf77ec300cb9e2dc935a4b0d0462b498f3d004c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e26db94-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622352, "uuid": "468fe538-684b-4dcb-b04a-9019fd684ba4", "comment": "Malware payload (RedLineStealer)", "value": "1b39cd2a9892c326c0db18fa3b0ef482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622352, "uuid": "30fd0965-5c97-43d1-b15b-61952f865d1f", "comment": "Malware payload (RedLineStealer)", "value": "9749d61dd88f0c62f769387b6f59c44332233d8f7df7aafe47de29bf499618e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622352, "uuid": "bd6730a3-3102-4207-860a-25040ac25341", "comment": "Malware payload (RedLineStealer)", "value": "1fa95adfd4e0f67d4eb8fdac385bf90b1b9e2611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622352, "uuid": "e5954948-51b6-4274-a17e-c3e824d66d8c", "comment": "Malware payload (RedLineStealer)", "value": "35cd15ff005baef807d600032044ee0b0ae33364b78d53d61dccdb77caaebc9f0683ac9736e2e89e84f8aa1886c83473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622352, "uuid": "bd04a7a7-6780-4549-b85a-c401e7aa1464", "value": "T1F7560012294D4D4FA07638651FCC544379A967B90B170D9232D2EEEFEBACD84F681B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622352, "uuid": "31a281bb-d708-4ee1-836f-9fe4625a5ca3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622352, "uuid": "61dd9101-7f89-4efb-a1b8-7e8aa989343b", "value": "98304:xacws+vOEQswDDCRewNz0DbKDYSgYaKsj:xa3s+vZQs24V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622352, "uuid": "38617752-5093-4c48-a18a-d3bd5382e3c9", "value": 6025032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622352, "uuid": "8f37b211-3120-4cac-a4ae-1e9fd11a3ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622352, "uuid": "41a5ccaa-3696-4e3e-a223-1df58d9bd087", "value": "1b39cd2a9892c326c0db18fa3b0ef482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df4c8c6-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688648497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648497, "uuid": "0c0dd4fa-c370-48b2-8119-df744828675d", "comment": "Malware payload (Mirai)", "value": "dfae1c1ea2ad58d3751bd45c9e1c7925", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648497, "uuid": "1d1dcaca-e3ae-4eec-a713-01f101511954", "comment": "Malware payload (Mirai)", "value": "975bc32d2a7fff91ac86bcee2bdce4b9372cbf9ee16ed277e0f4b83bf647d307", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648497, "uuid": "a2924fce-2917-454e-a345-51710a84be8e", "comment": "Malware payload (Mirai)", "value": "bf845d80ac267a918ef6c3b5639d9b94f47cc973", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648497, "uuid": "2620b117-b082-43ad-9d3b-246e4b111bc7", "comment": "Malware payload (Mirai)", "value": "7f2db19a6162275769b1addd872d7b6af582335e7c4b8c8ac74622c44cf26cb957a17b732827ecf2cf5bceaea2834c43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648497, "uuid": "59fbb717-ca2a-4e02-877a-6b96d9c625b6", "value": "T16D731986B9819A10C6C517B7FF1F018E33025798E2DEB3638D141B647B8FC5F0E6A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648497, "uuid": "bedad335-4ba1-4cf0-99a1-3ccb53d95290", "value": "1536:FNn9WZkjRakMEI0u6INU/R2/PbojCzVLFa1AfX34cgIFiYPSGJLFbr:tm/EFKU+EmhLFamf/PbJLFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648497, "uuid": "1aa2e802-08d8-440e-9923-bb4d3d249326", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648497, "uuid": "e8e03b11-732a-4063-9c97-98652b110780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648497, "uuid": "341ac1c8-52c2-4bb0-afe9-8d4e3cb5b239", "value": "dfae1c1ea2ad58d3751bd45c9e1c7925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15dbf61-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624263, "uuid": "c3e8496f-ab30-44d6-9026-f64160bd7009", "comment": "Malware payload (RedLineStealer)", "value": "dd955b33cce7ae32e6e09bbe735da1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624263, "uuid": "eeb52be3-6ee9-40d0-9f3d-bf245f0a4235", "comment": "Malware payload (RedLineStealer)", "value": "984bc96d5031b1e5aebd9ef1761b1f5b0eaa9cfad27ad4816aed9e73e441b32a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624263, "uuid": "29cd4fab-da30-469a-8271-0f903a2b6020", "comment": "Malware payload (RedLineStealer)", "value": "a77c76bf134f5fd9c21d2918d32e51294354d530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624263, "uuid": "f03ff179-1779-45cf-a447-9cd5816c965b", "comment": "Malware payload (RedLineStealer)", "value": "6d234b6c5e855fe9fca5889a300fe951d0a6095f3c18775545a8c27df85d2f81195b036258d74d6e0d0e49096e903d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624263, "uuid": "2ca2af75-78c1-4d6f-a1f0-6bcd7d2f5c52", "value": "T1B9160118606E4D9FD47135742BEC1A93F9ACA4B1671F0E0622C2EDEFD89CC81F69099D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624263, "uuid": "30cea45d-ae08-4ee0-af91-0c74af8881a9", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624263, "uuid": "19406a8c-69b9-44b9-bef8-21767632e793", "value": "49152:i+0tVj/RmVUi6tdSh/MWYGDwW24HbGi0qiDqV1wMQQbRhe8wEy1rpk4+ebq3o8OD:i+GEIIP7HAy4Qm8wjowq8UeWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624263, "uuid": "425f4b64-d559-4919-b030-88c2076facd8", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624263, "uuid": "eb1e1934-54ea-4613-a1aa-7ffdb1f417c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624263, "uuid": "ac5bec2f-606d-438a-ac4d-6688a64d4fe1", "value": "dd955b33cce7ae32e6e09bbe735da1a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992f4707-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688645644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645644, "uuid": "6e375bd1-6ba6-48f3-83e1-32011bb56ae1", "comment": "Malware payload (Amadey)", "value": "af78d9fb97ca4e8a492ada5d03e5cc2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645644, "uuid": "a29ca6e3-decc-4e5f-9960-f4769fe2fdf1", "comment": "Malware payload (Amadey)", "value": "98903fec5c30f0cac1ed4d5a050a9b40d5b8ae588e54b9e9f666b70dd5577d5e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645644, "uuid": "6ab62a27-0b1f-47e2-bc5b-d32f0ffc7316", "comment": "Malware payload (Amadey)", "value": "1247ff01540938a727adea8e4b2542b916f50dde", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645644, "uuid": "239a7fbe-5c02-4b77-a6f3-340c98036378", "comment": "Malware payload (Amadey)", "value": "5d68d4fdfbd9329a73f4941b7bd8ae560219b5790899c71b12cc157b5135a791b2594f518e6fcc4e24b74b052748a608", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645644, "uuid": "58a49644-0a55-4f6c-861d-fe0f66b838e6", "value": "T1F2061102248D6E6FD13A3A7627DC1453F96C9470DB0E0D9522C2ACEFC98DE43F6A659C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645644, "uuid": "72dab90e-a244-491a-8b6a-2f4dd89e33c6", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645644, "uuid": "2de17b3e-79bc-48ad-a5a3-0e87f6c8db7a", "value": "49152:3PENHI7hCt0WL9g0RoO3O2YkU6tXW+2IA1sV+Vf00frWQ+JB4tgt9ixbxvcaAi97:uI72pPYe5B4+JpsxJN7l/iF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645644, "uuid": "09fef637-d1ec-46e8-9580-867777f3611a", "value": 3788616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645644, "uuid": "cf5fcaff-98af-4904-ab95-0cf1699f5fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645644, "uuid": "cc80f24a-4290-4cda-b5bb-39d332457e26", "value": "af78d9fb97ca4e8a492ada5d03e5cc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fcddd2-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677047, "uuid": "bacb6410-93fe-40e7-b2df-603d4e368b79", "comment": "Malware payload (Mirai)", "value": "bca39ccb510c3bd6b8c401dd7d1879f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677047, "uuid": "88fc6ec8-1e72-452a-b721-f8bbb7950029", "comment": "Malware payload (Mirai)", "value": "98f803ed9efd7aa2c7892eaa6781518c15b22c42126f22934875ad8dfb683397", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677047, "uuid": "22a169d3-cef1-40da-8cfe-3627c35c56bc", "comment": "Malware payload (Mirai)", "value": "c5364838ddb4acbfad99fd7dac91106f2854a8c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677047, "uuid": "e1c3c4da-c760-41be-b8e9-21fcac25a3e1", "comment": "Malware payload (Mirai)", "value": "46b8bf76d2dcb7c959d73b04e70f5324f50569661e3eec125e8334a4e595507fc5641474238ac0c152cb11a7a3ec16f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677047, "uuid": "2a9c790a-89bd-449a-8b53-3008833d031c", "value": "T193D2E1EC3AB4791AC96D5876E08925A2C755B05032DA0F047349CFCCB639A537A3E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677047, "uuid": "af87ff7b-2c89-42b3-85a4-94bfe5c09439", "value": "384:RnazFK1Ij72/joCNWOqwPW2zumXM0n8qhXlc8rxaPQl50i+7s5nR/2PUACRKhROW:EzFlq/j3qH2FXvdhVc8rxSm0TbIKqWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677047, "uuid": "e366c3a9-fa44-4245-a641-727be9c4e0f5", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677047, "uuid": "a08eb3cf-3310-4e96-81a6-19bfaef9b6d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677047, "uuid": "4da81bd2-bc95-4527-b467-80b3794ee978", "value": "bca39ccb510c3bd6b8c401dd7d1879f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b86e6a-1c02-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688650758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650758, "uuid": "f07ad9e1-b3b2-4c0c-94d7-2f05316f59df", "comment": "Malware payload (RedLineStealer)", "value": "52c776a2f44238d79642662fd80ef3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650758, "uuid": "3a46a0fd-d9d6-4e84-b115-bcd6b873e1ba", "comment": "Malware payload (RedLineStealer)", "value": "98fe6a0a798dc0eca9dfc29217df7e73f049a89877559af60d76fb39c6527e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650758, "uuid": "778f7db7-b313-48ca-a68c-fa3202127bc6", "comment": "Malware payload (RedLineStealer)", "value": "87ce8e19f6c45d988af96e0aeef217816c97cef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650758, "uuid": "bbb42c37-9de4-47fc-a872-7a06ccd377ca", "comment": "Malware payload (RedLineStealer)", "value": "ab778fe3c986a0aa5dc8d4c33b34aa77f7b62577e5aabf77bddb370eb87a40f27539b8fb85818f57788dfa1436d01d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650758, "uuid": "8654c9bd-2146-4467-a6cb-617e1da39039", "value": "T1E84439123D81497BCC29E73BE9098E46FB29E11F412DCB64EB35D5B6AA43F450271E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650758, "uuid": "403e4463-b6c3-4260-aa22-329f8eccabbf", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650758, "uuid": "8edbb896-e192-4dc8-86d4-be0e3e004630", "value": "6144:b/NOL9p+ly2WtzH7NrIrBJjvft5LZFL92hUPEIWq:b/NOJIYR0vfjZZ92hU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650758, "uuid": "dd628782-8fac-4821-9601-18979a9ebe95", "value": 261449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650758, "uuid": "f87792f8-bc13-44d1-8be4-c3e23f13d3ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650758, "uuid": "45969d1c-1edf-427f-b020-8b5219ab5cce", "value": "52c776a2f44238d79642662fd80ef3f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57f0734-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637128, "uuid": "0d2c7f07-6f22-4a84-a89a-78cdb9341b95", "comment": "Malware payload (Mirai)", "value": "9a3e21ea1391735c5313e9058c85787f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637128, "uuid": "c4be6d67-944c-4d3d-9bb2-f0bfc5de716f", "comment": "Malware payload (Mirai)", "value": "995d576e40e5a4ff5a0d0ea04d7560b60a93ad6cf2992e37fdee0632d6444d65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637128, "uuid": "e764358f-0130-4468-861e-e4228f72a2cc", "comment": "Malware payload (Mirai)", "value": "990927878f8ba63a46515e3c3108b93401670732", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637128, "uuid": "9da7a002-1aa8-4492-bc2d-d5b7e2dcd628", "comment": "Malware payload (Mirai)", "value": "3f9afdcc0c7501b42e428e3766afb158bc674dfa6b667451222f551a11acaf1310eb00468150f0179775e9758d589f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637128, "uuid": "96fe9b48-de56-4bd4-83dd-7b3d224abdcc", "value": "T10B536DCAB8119E7DF5CBE77E84220D0EB821726150931B27BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637128, "uuid": "b97db759-aa7c-4cfd-826c-24289c9933ec", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8a:N1TjJ8EVGOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637128, "uuid": "af754122-3f3e-4dc8-946a-b64bd5a6dd24", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637128, "uuid": "b168355a-05f9-4ea4-89d5-3a5a783e0faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637128, "uuid": "f854231c-e75f-40e8-a1c3-19e6783bbe53", "value": "9a3e21ea1391735c5313e9058c85787f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19827f1c-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688641134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641134, "uuid": "800840b4-5efd-40c7-a544-ccef088656c2", "comment": "Malware payload (RedLineStealer)", "value": "4cb0ea2686e23dd6195c3569144e6382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641134, "uuid": "833e2705-e964-4b65-b215-223378837d44", "comment": "Malware payload (RedLineStealer)", "value": "998895920a578d5be566c48e78f0139214e2e0e393cac2593fee9778289fb47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641134, "uuid": "ab9b492f-37a5-4178-ba47-f0bd77d48a36", "comment": "Malware payload (RedLineStealer)", "value": "f54e47d40970988a25737589b4ef7b40a60eff7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641134, "uuid": "662daaa9-e669-433d-b07d-cf2c6c707c22", "comment": "Malware payload (RedLineStealer)", "value": "b2821015b44fb0d566149e43338df6fe5671ed73061a3ddbafad8e7dee1f5848ab23dfbc5790ccf7f7147b754f9887b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641134, "uuid": "376522c8-5c38-410f-9bc0-959a1e05e9fa", "value": "T1BB560152281D4C5FA53238201FED405379A9137A0B174D9236C6EEEFEBADD84F685B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641134, "uuid": "4b774be4-569f-4c12-bcac-44e49340b712", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641134, "uuid": "6998c9db-ec12-44e5-a76b-7233f76cfc59", "value": "49152:PGyUcYNnxLjFqrIZlUeeaJ9IDIxeDOD+Biax3RhvKzEkcceuC6bDSokun9C1DBqz:PkNniGlU+aIQVJd93Ycg6eV5wZ56Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641134, "uuid": "b0bac167-3bf4-4bcb-97fd-fd27b37bda2a", "value": 6035272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641134, "uuid": "a92cf04e-c4d4-449e-8e7b-2d7a861a7a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641134, "uuid": "061f0238-d007-4572-a94c-96d288165e0f", "value": "4cb0ea2686e23dd6195c3569144e6382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a344fe-1bd5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688631602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631602, "uuid": "de69023d-e119-4ddb-87ba-b989b9bd39b9", "comment": "Malware payload (Mirai)", "value": "c0e33c7f93c56b3e85e117628de230cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631602, "uuid": "cbaf12ae-6f62-44d6-9824-e4844a7a2b88", "comment": "Malware payload (Mirai)", "value": "99a878dad95671c2c74c2fdd1583487629ddd464707aaa7d7e8a97639e64c5ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631602, "uuid": "f368da7f-6f1c-4e29-954e-55a17283478e", "comment": "Malware payload (Mirai)", "value": "f467dfadf484c7e0870a9ac1d00ad6b7cd869857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631602, "uuid": "8f58bd76-fc6e-494c-b022-f9920eed3db3", "comment": "Malware payload (Mirai)", "value": "f0d4a75adda21f41dd2b13527e93776611dd929f210246e99c8b23be5f61818fe0e83c581a9311fda689b9814eafe41d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631602, "uuid": "8d8f7d14-42e9-4cbe-ad4b-75786cbc1d38", "value": "T1A9C2D1E07726EA31C420AC7DE53A4D893A51067C91FF353664258C358FC269B67F44F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631602, "uuid": "1adf063f-6a66-4229-82d3-60b00c2b0dbf", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwr6k9q3UELuA:OKy4qfqoeJdXWgELx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631602, "uuid": "c8c1ea79-fd66-4446-9aaa-c98bd6c1fe57", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631602, "uuid": "69c2b65a-3b64-41c8-804e-4504400f8168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631602, "uuid": "92ff6c7d-75b0-4cbe-86db-67216ed8495a", "value": "c0e33c7f93c56b3e85e117628de230cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743e7330-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688627543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627543, "uuid": "3a0e4a50-5dd5-4af4-bd8a-16ccbd2708f7", "comment": "Malware payload (Formbook)", "value": "e78ac9afcc64ebd5ab58997166ab6e94", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627543, "uuid": "6c52f9a4-5f71-4443-ab46-400e51adf39e", "comment": "Malware payload (Formbook)", "value": "9a29059d2b2cc0ddb01f8d8459d8728a48bac5e9f504dfb805a7045b9e8bfd44", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627543, "uuid": "c24e563a-45e5-4649-9af7-6a7dddcf872b", "comment": "Malware payload (Formbook)", "value": "78c83bad35af2e182ab3eb2901abd7ea49b6db26", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627543, "uuid": "0c15545a-2272-40b7-985e-c80d37bc7a99", "comment": "Malware payload (Formbook)", "value": "89262859a50cdb24ed08d5f41183ad35c9cbf879776d8f529f276c67b5c0aaa65ba16942e896d240db62885cdd5110ab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627543, "uuid": "69e6d523-eb1e-471e-9c78-985e185f8e23", "value": "T11174238228621E80C8EEE02F81ED5215F9B8608ADDDD4FDF0B0DD46AEE0155FEE4DE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627543, "uuid": "b29446d2-d5e6-4854-80d1-3209f6a17040", "value": "6144:gtXK3g6OXf5tSyE6xr9Q4LHyny/kk0yQFzriEgUTSIKru4cn0L0YcffJnfRptzr6:UXGgtxlE6N9tDynRyQViE7TSIKKF0L0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627543, "uuid": "f4b08c13-fc31-46c2-944f-c578e62147c3", "value": 355708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627543, "uuid": "f48696ad-cac1-46d5-aba9-9de396aec69b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627543, "uuid": "a1fb9823-034a-4fe6-9085-e1e95ef3e0f0", "value": "KIEFEL Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0493c439-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688627355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627355, "uuid": "aeaf542f-c497-431c-b195-b15793fcffbe", "comment": "Malware payload (Formbook)", "value": "11c19d501fe4d19a9ca69da5ecfebe8f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627355, "uuid": "cedbb74a-6424-456c-bdc0-03a1f5236fe5", "comment": "Malware payload (Formbook)", "value": "9ac451f5ffe7e97516d74e20dcbb5db470fe65c37125e64e793373921afaae4b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627355, "uuid": "52c8325f-e141-4ceb-8d9a-1f883264430a", "comment": "Malware payload (Formbook)", "value": "55924c6c32268206b06b200044a67d2424a2a509", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627355, "uuid": "22b8b8d0-42e3-48a0-a9e7-3352f7d3c9db", "comment": "Malware payload (Formbook)", "value": "5cdd773a2fea022a6f68f45ca1e2d91dca8a1be9318263dcdb23382b34c8a729d179a9ec5720f25d26c768d6eb765047", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627355, "uuid": "4d3aa090-1b41-4833-ace9-0ce3630d888c", "value": "T10E74238228621E80C8EEE02F85ED5225F9B8604ADD9D4FDF0B0DD46AEE4155FEE0DE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627355, "uuid": "bce160ae-2559-44c8-b633-d602285a1814", "value": "6144:5tXK3g6OXf5tSyE6xr9Q4LHyny/kk0yQFzriEgUTSIKru4cn0L0YcffJnfRptzr1:vXGgtxlE6N9tDynRyQViE7TSIKKF0L0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627355, "uuid": "4daee023-b36b-47d2-b314-8ae426c6c8e4", "value": 355714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627355, "uuid": "0162a01a-2c30-4e3f-a8e9-9cfcecda1f5a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627355, "uuid": "33775850-125d-4420-b448-62284a2193ef", "value": "RFQ # 1045981 - MAA_D Plant Project r01.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847300cb-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688643032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643032, "uuid": "73b94bdc-8b90-4a93-81d6-bab292056947", "comment": "Malware payload", "value": "5bdb5b0b082e33ca8a05b651578cd96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643032, "uuid": "b18df0aa-f3e2-4a2a-a4d5-0ce97bf815c3", "comment": "Malware payload", "value": "9bb4d6da8d6497736976210ded8747e6af4578324a085257b38e3cf049b7d645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643032, "uuid": "5abd5428-f320-4cad-a7f8-51d5380339cf", "comment": "Malware payload", "value": "32254dd0945497f0b1ca03df1c16c64928594af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643032, "uuid": "0a52cbac-3dc3-4e16-847a-749657128593", "comment": "Malware payload", "value": "9ba9d8522c28f1fd6a1fb7931a04cdf92cfb2cfec16be6e912e8d652b0f9f843c2051b8b76bbbf17df3ede4fec5ffa89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643032, "uuid": "544be2ac-b78d-4fed-aaf7-c368608155f7", "value": "T1CE562910E601912ADDB724F94EAD726DA40DEEE0171420C392C86BFE9E7E9F13E3515B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643032, "uuid": "891f49b4-65bc-4ba4-9b56-77008c6f394c", "value": "e04de564f93f6a3af063f17afb69dce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643032, "uuid": "da3efa71-d1c7-4095-8d51-38f803956fa9", "value": "98304:aHgdTtDs6K+H+hXfSVUpZWfR6FFMboxFF4I4stO:aH6uvCR6FFMXwtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643032, "uuid": "f1b7ab63-715e-446c-a17b-a470aee6f6a4", "value": 6294016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643032, "uuid": "cca0622f-13b0-4db6-8584-44c2a6dc3fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643032, "uuid": "9e5a8462-9d61-4fdb-9d5b-df2ff1b67337", "value": "2BB0C675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2defe4d6-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622700, "uuid": "5c09c006-341f-4285-b614-d6e20064add2", "comment": "Malware payload (RedLineStealer)", "value": "4f9b810455ef3e4f2e9ba608243238b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622700, "uuid": "09026fa3-fdd2-4456-b090-5f47423f7107", "comment": "Malware payload (RedLineStealer)", "value": "9c903dfab2b9f5522d594dc9834fe8bc4376aad74a37d066aa0411b5c81b6998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622700, "uuid": "4528ef84-e62a-4094-8b47-8d2f6a6d0f92", "comment": "Malware payload (RedLineStealer)", "value": "ef959d0a8b0aacacf82d326c94c1c4f2e540da3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622700, "uuid": "f1394504-c1e5-4219-80aa-de42c2ac94c2", "comment": "Malware payload (RedLineStealer)", "value": "badfe0b7079c8e2b801beca44e6dde194c18325fc4b1cb54910cb45cd30b163a896039c24692906f09693e4e7fef0a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622700, "uuid": "838b08ed-44d5-450f-988a-843b5cb7ba35", "value": "T1E516010A206D8E9FD870357127DC1593F9AC9474A71F0E4122C2EDEFD9ACD90F690AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622700, "uuid": "6989b3e6-e5fd-4214-8be8-8d825b07e39d", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622700, "uuid": "52f0308c-648b-4860-8fbc-c22a6e84def4", "value": "49152:4O7qsQldyBcLZlq6J8RNQfnj2t4FZBzH9fwHx5KgR0thf8wks2J+ar/1KszjGImP:FHYyBy1J42jpZB858hy/710l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622700, "uuid": "2b727940-133e-4b81-a4f1-1574fa512516", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622700, "uuid": "e24394bc-1596-4c83-b969-1c826647a248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622700, "uuid": "3229e3ab-5082-4d08-b129-52b7c263fe60", "value": "4f9b810455ef3e4f2e9ba608243238b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdac3067-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1688623478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623478, "uuid": "ee7c2f5b-73d4-48c4-a581-51e3330e65ab", "comment": "Malware payload (RecordBreaker)", "value": "7aa8353d95576dfdd42d2382ffe0e626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623478, "uuid": "03981b73-51bc-4e12-b9f6-028b57d6f460", "comment": "Malware payload (RecordBreaker)", "value": "9d05e8ef93511f02e7f0d270402b37658817a2d233f9cd12b40b87d4a4af7a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623478, "uuid": "02981a51-c05e-4fba-ba6c-a8bd125c6068", "comment": "Malware payload (RecordBreaker)", "value": "9798cd96ca573c6f54fc84611cfc4a7802212dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623478, "uuid": "b7557de7-1e80-4950-83c9-218e3c5db774", "comment": "Malware payload (RecordBreaker)", "value": "b8ef4620a945e4b8d71ee8721bb419464342a32cf2dd09a42c91dde52daf48b5558f76b3232757d34ad9b76427d3f8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623478, "uuid": "9e0b99d1-0ec4-431a-99c7-c44b4cd387cd", "value": "T1D8064C13B64B85E1D0861B75C95A7C2803B0F68376F3FE19364E23944E47BB66A19E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623478, "uuid": "7d8b54e0-5697-47f7-9356-095c558575c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623478, "uuid": "0f71cacd-a8e7-436b-b452-aff56e7c4a65", "value": "24576:yqCSpM9XJSnFTGkzgB3uz60e5Lb1HCfLSovTaCqbvF+WKzQqW/pt64Y5v7QHuHOa:yqCgHny3COVb1HCfLpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623478, "uuid": "57ecce7e-8e18-46ef-b245-54f122b666b1", "value": 3671552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623478, "uuid": "599cef27-be64-4b82-8bee-41e2c6f2bea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623478, "uuid": "5a95764e-8df8-41ba-9a16-76a6e3e9d7e3", "value": "7aa8353d95576dfdd42d2382ffe0e626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac22068-1bef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688642640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642640, "uuid": "1889598b-0129-48f9-99e1-fcae01aeaeb4", "comment": "Malware payload (Amadey)", "value": "e102997a3f4e94186c4807c712d84deb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642640, "uuid": "8c994c3b-39d1-4542-9d08-c590df7011fc", "comment": "Malware payload (Amadey)", "value": "9d24dc1a23bce804af1d61eaaa52c1097c1d3c9471dd1e05637eccb9c094e12f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642640, "uuid": "33d49176-6b95-4879-9f8c-e5cd22a130fe", "comment": "Malware payload (Amadey)", "value": "280285537f14313bb0b731e563471aabcfbbeab5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642640, "uuid": "5bb0a99c-94d0-4554-baa9-05f430084404", "comment": "Malware payload (Amadey)", "value": "b616f1cab1bca8a9e79883bce139627e1c7b6ee768612e15e8cd95d4bd6eb952f253839ba6b62e308580af2408912553", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642640, "uuid": "2d7e4c28-c4d5-4463-be3e-0217b5bf80ef", "value": "T110160159616E9EAFD57134B527DC0A43FAAC6870270F0E5022C6ECEFD49CD81F6A089D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642640, "uuid": "2dbc0566-4378-48a9-8254-c4b3f3928a79", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642640, "uuid": "d25d7046-e6b7-4176-9ed8-da9492872763", "value": "49152:fVrAx+Plm1jTSn8VkPQZHSZudD81PH4zNO8eEOIil24deuuLMi+TK7ShesXTkNmP:fMa28bPmLOIE2b+TOUYo4jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642640, "uuid": "4ccc7af8-c672-424e-a130-45c401cda2f9", "value": 4064072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642640, "uuid": "d45d5044-840b-4641-be08-f7f9c94229b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642640, "uuid": "c1675799-51fc-4ffe-b4fb-378bffc68a44", "value": "e102997a3f4e94186c4807c712d84deb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd7e636-1be6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688638805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638805, "uuid": "4a9f9289-614e-43b1-b9b4-e3d155a29dac", "comment": "Malware payload", "value": "9a2543cd7173c4761ef89bd658ff23af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638805, "uuid": "6d4b41ee-5866-43dc-a5e8-cdfff73b63c3", "comment": "Malware payload", "value": "9d854bb6e82b757d7ec45eefd80e83113920a25bb75c58a74bb19984319adbea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638805, "uuid": "c6c9f333-1070-4766-803f-ca25ca44c83c", "comment": "Malware payload", "value": "2084088dd0cfee1d09749ff9fd019d6426f2a945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638805, "uuid": "2ea017ca-e66f-4236-a8e7-e59f1ba028ec", "comment": "Malware payload", "value": "3ebf1799ee221d430944ad3efea3d4d1181ce9ce6f520e75c08e1fd4ad62ec355ad305f5a21db66af7a3165e4548812f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638805, "uuid": "01dbf4ef-a028-420a-a78b-4691e752a41c", "value": "T17EE59E1036E4C075E1B23A3199965F75667ABD332B7782CB52803D3F3E705E2983936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638805, "uuid": "9f88a828-4297-441e-ac86-6ab078a30125", "value": "0fc67d303248275f656546b6fa4c11de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638805, "uuid": "af52e118-772e-488a-81f8-eb28b2f1410c", "value": "98304:pVQB/oZ7gYjdDMXhH/XHn+2e14L6d0JiA1VIzuYX//R/:PQB/oZKf+WLZD1OzuYX3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638805, "uuid": "afd88b5c-b8ad-4bff-ac13-9f84f7624fa5", "value": 3246080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638805, "uuid": "c1bab105-44bf-4f67-9605-3f8c4bb09bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638805, "uuid": "00e3ee1f-ec0d-48a3-b166-f868c62f2df3", "value": "kita.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5df10f-1c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688665701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665701, "uuid": "1926cb9c-fcab-4f01-8ce8-d2d4e01e8964", "comment": "Malware payload (Formbook)", "value": "83ac71c56af969bb749fa069e0f825fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665701, "uuid": "4be78a25-976b-48d5-914e-73baf92cac43", "comment": "Malware payload (Formbook)", "value": "9db16c0a924741e46c356d5d94bc9edfea62ff0767115fc2f82b693e4cfd5798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665701, "uuid": "c3d6afdd-cd26-4529-a46f-f9232ed14d3a", "comment": "Malware payload (Formbook)", "value": "11a33a92c72b2f7f47c621cfb0682dec401f1a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665701, "uuid": "47fbe2d5-139c-46a0-8510-778aa5ddcf43", "comment": "Malware payload (Formbook)", "value": "633b8644626f867e29624bbc8973d6b7d576ec8f9999a0bd3ab8a393e158df7aff70e30c2c0fee2605ae9a722dbdc38d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665701, "uuid": "0986338e-6029-4514-8df4-87e06db170df", "value": "T1C7E4F0017ABB9B03E4B9C3F329B5140017B9365A28BDD22D5DC7A0FE593AF454693B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665701, "uuid": "b2505f66-6090-4e0c-a483-cc59de95e647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665701, "uuid": "425c0ba3-bca7-4b7e-9dbb-4637a67ddd83", "value": "12288:xrGQp7oJWw5AIXStvfh2fRkYsU2wiuC2xFskic1oh:s4oIIAFx2fRkUUutxFLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665701, "uuid": "f25e00ec-9733-4eb2-aec4-09f50491293e", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665701, "uuid": "77537e82-d7f3-4a48-9dc0-52a6e129c42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665701, "uuid": "b5f812c7-69b3-4165-85ca-fb8d553d7c10", "value": "z65EEZlUvGsqeOXqtN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ed9df2-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624185, "uuid": "c42891ad-a8aa-4598-b7f6-274c5a764294", "comment": "Malware payload (Amadey)", "value": "d412095a8b3edb888afa6c432ddac005", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624185, "uuid": "0280f647-db3c-40d4-af30-96e005c1affb", "comment": "Malware payload (Amadey)", "value": "9e254fd5256c5c4e1c13cddd53d53c6ab19d031694494fdcc908a147060f8d7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624185, "uuid": "bb2dc105-cf41-4561-94dc-c1c88a86a896", "comment": "Malware payload (Amadey)", "value": "7dc7cd0acfa827088dbdc0e6be5d985a330f2997", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624185, "uuid": "ecc2f252-d823-4417-ab24-439f2ba12b78", "comment": "Malware payload (Amadey)", "value": "70ff43ede13234743ded38ab4ffa05dae2e829383e3a4ed1d82d887dc9744e47c32042ac74f473fb0a1cc81b81735982", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624185, "uuid": "13dbad76-9f4a-41be-83aa-b7d37936003d", "value": "T1C6560112290C4C1FA17134641FDD5493B9AA97B91B130D9632C2EDEFEBADC84F685B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624185, "uuid": "3e467026-206c-4e64-8ff1-95564b7db4e7", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624185, "uuid": "66e605c1-2154-45fe-a166-d990a83417ee", "value": "98304:feypROrgsyzmSyOW615jt2T6IjQYKwP0/tO6R:feCOMsyz1xWiB/IjQRV/86R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624185, "uuid": "bcb7f1da-0df1-47fa-9604-f0e56a4802ef", "value": 6013768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624185, "uuid": "0011a305-7207-46d8-932a-7ab7f4412dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624185, "uuid": "165b68b5-541a-468a-bfcc-f34ad962357b", "value": "d412095a8b3edb888afa6c432ddac005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02502aff-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688636371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636371, "uuid": "01cc4df6-5129-44b9-9485-9b2bdf25417d", "comment": "Malware payload", "value": "6fce4ce8f881b172983540163434c133", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636371, "uuid": "13e23498-ba61-45b5-b5d0-558b063bbe9d", "comment": "Malware payload", "value": "9e323da77921aa6160eefc13bb01e3583012f5ab756f8cd1dcee160faf17f390", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636371, "uuid": "8f5831a0-f334-4504-b97c-afb723566306", "comment": "Malware payload", "value": "c7679cea88d9198d4da37f00425d1cab32b68f4a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636371, "uuid": "e113e9c6-3906-4e3d-8ba3-2dacc9cc1a0c", "comment": "Malware payload", "value": "c7ef49d02d157e02d857ce54986ec6e21031b2a4bf5d01dcc31a99457ca4961fe27a2c020324c658f7c6beafb641defd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636371, "uuid": "3e056bd0-d9b9-4fd0-9c71-3b8124483749", "value": "T173448C5078C0C472D57A2C345674D6B10E7EB8311DE0DA8FABD8197A8F32AC2D625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636371, "uuid": "31eb722b-fed8-4293-809e-97403c66cf51", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636371, "uuid": "41355b03-3c7d-46a6-b66c-9b60da354072", "value": "6144:nkEmDpM6FAWMVF7WZOWfU+BPBdmJJgZY6/RRuFLtbo7XJE:nXmDC6FAWMVFyZOWUAPBdmkY+uFLZore", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636371, "uuid": "f10fc2a8-4beb-4883-ba1c-59a7ed49a3e2", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636371, "uuid": "8b87638e-01dc-49a2-82ba-7cac585a95d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636371, "uuid": "29e9c5c5-426c-4276-9656-dc24bec165ce", "value": "SecuriteInfo.com.Variant.Zusy.475489.5932.32694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e523225-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1688646055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646055, "uuid": "5f2a75cd-0eeb-4dbc-ad3f-5cd236db4508", "comment": "Malware payload (Smoke Loader)", "value": "e48aed8d0d36c84893d0138380cfa502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646055, "uuid": "bffc42fd-d74d-4f46-ab9b-94361d075178", "comment": "Malware payload (Smoke Loader)", "value": "9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646055, "uuid": "240eebc4-8ab0-4f4c-9acf-44329e33ce33", "comment": "Malware payload (Smoke Loader)", "value": "304161c0718d7f89489a722aab079bea2d244c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646055, "uuid": "090d1e57-d966-45d2-b20b-150d31effd81", "comment": "Malware payload (Smoke Loader)", "value": "599b3b5b6cf6988cfe4656679315352e981ac96918944084fd12494daac699e6a49df416cfda57838f6d4e5b8a12df9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646055, "uuid": "f5898472-3a6e-4040-8da5-9d3bf2fe9dc5", "value": "T14E446D0362F17E61E52647329E2EC6E8365FFA618F5E3766221C5AAF05B02F1D273350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646055, "uuid": "7684d8b4-35b3-4ab7-8b60-7b0c2a73878d", "value": "6697fa255a05fffbb8331cc121287cb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646055, "uuid": "399803ba-7536-434c-b6b6-74f2a9bb1e3c", "value": "3072:wM1uSnn2s90r+1fRCpYM11PuVn6NCy2L0rshPXW/02QMG/uLLRKx:RuBs90r+1fIZ1PuVn4Cy2HPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688646055, "uuid": "cb563f15-350a-42fe-879f-aadae851641a", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688646055, "uuid": "de885874-5c3a-437c-a520-8d41cf90589e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646055, "uuid": "047e95ab-9017-4c95-86e6-26c6c60f7d6c", "value": "9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2ce299-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638084, "uuid": "6a267cf6-5a79-4825-9a20-b7f1543ac00a", "comment": "Malware payload (RedLineStealer)", "value": "48450133ca161dd888ecc85922c79ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638084, "uuid": "d537424b-edf0-4bd3-a15b-c8674475d11d", "comment": "Malware payload (RedLineStealer)", "value": "9f031799312ff9d3e2741114cc67b69d82c5fb285d25b05c71088fa27dbbe490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638084, "uuid": "ba41d11f-073d-429c-bb98-cd56a30b6023", "comment": "Malware payload (RedLineStealer)", "value": "12835c2a885389e5d7485328be39549e68f1033c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638084, "uuid": "aab13a02-7a14-41d7-80ff-c8b818a7713f", "comment": "Malware payload (RedLineStealer)", "value": "5cc71921a777725faecb25e7b70e4f269d29509b22c358f037b523d742466e08fd428259b3236995ef03d48c342d2a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638084, "uuid": "72710e5c-46af-4116-997b-39326d362140", "value": "T1A0160119206E9E5FC57430B167DC1593F9ACA8762B1F4E1122C2EDDFD9ACD80F2A198C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638084, "uuid": "c5d5d440-65bc-4ed7-967b-75701831a513", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638084, "uuid": "01c73e62-38ad-41e1-9152-0e59f8fd6979", "value": "49152:jR4x8CmvD9jMOVIgL2CjS5TlDm2YXUKyOJNl2yCyLAcMGH1fnqJ1Inwx7EefIdXB:jqO5VVIW2Nlq2aUhOfq4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638084, "uuid": "090c7fd5-f6f8-4fe9-8c1e-3e16d9d07292", "value": 4049736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638084, "uuid": "98056751-45b3-4c29-b683-04507b10c406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638084, "uuid": "b6952f54-b779-49fb-92ce-d778d43402bb", "value": "48450133ca161dd888ecc85922c79ea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fa2ba5-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624559, "uuid": "abd78b6d-4bef-4d8b-a7f9-3ea15780e78a", "comment": "Malware payload (AgentTesla)", "value": "4135e4cf4bb6c09eb96a2170b05c5a6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624559, "uuid": "553894ad-8612-48a4-b10b-cd267be3a110", "comment": "Malware payload (AgentTesla)", "value": "9f61fe0c95d1c2021eb396c026b8e5bd953a8acf1c448a32bfdb985f4767da65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624559, "uuid": "cebb23b6-6e81-4fa0-b4b4-1701869392cf", "comment": "Malware payload (AgentTesla)", "value": "1aed757262d5386d619fbcbc0b843920e714ebbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624559, "uuid": "e7c46026-1012-4835-ba38-fc0a7171052c", "comment": "Malware payload (AgentTesla)", "value": "7bad79d0d374eb90ac25e0d737e8e4236590a5dd727712e87eaafeadf21c96d77207e3e0d7d030bd887f6d8c72f9d6ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624559, "uuid": "a2e84139-a890-4a83-9b50-8d70b52b2a5e", "value": "T1B484651370DADCCD61E27A63075FF8B90FFAB6D4462E4199A1DC430A86C5D9C8E486E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624559, "uuid": "843a7cd1-99ce-43ee-a968-a81d7cfa188a", "value": "1536:rkkkkkYIr6lJlclGhInVJ0iSMrxVWY3jS6QHJkkkkktkkkkku54lA:rkkkkkYIr6lJlclGh9pkkkkktkkkkka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624559, "uuid": "357386dd-0041-4394-889b-d93d24cc6576", "value": 379572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624559, "uuid": "81f5e034-8c47-4f4e-824c-7c3faddf4c49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624559, "uuid": "28ace85b-b73f-4632-9754-b279d1ac2564", "value": "nuevo pedidoO06708..PDF_____________________.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6517cca5-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678627, "uuid": "57affae1-840e-4bdb-9136-31fb319a1434", "comment": "Malware payload (Mirai)", "value": "13bb690fc99903719a7c3cd9038dfb71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678627, "uuid": "35157050-eced-4d39-ad38-c90ae7e9007e", "comment": "Malware payload (Mirai)", "value": "9f81af29c974eeb4184483efc12fa2e4adafcc35d7efd2693f9a294bdc34ac54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678627, "uuid": "1ded96c9-5f42-48a4-bd46-cc34ba7155c1", "comment": "Malware payload (Mirai)", "value": "0ea8da76ca27c05442ed49811288e2e429d354d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678627, "uuid": "518f6eb2-1934-4f23-a68d-908ceb4153ba", "comment": "Malware payload (Mirai)", "value": "ddd8364798217573a55879f3595f6bb92e4874416b292d9e4e7cc9d2874457d5c7bcec7352ebe6386faec0087e539211", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678627, "uuid": "d2ec0cad-5d9d-4346-b95a-b16000511b07", "value": "T109B3F8C2AD427E33C2C2EBB5BBEBD14837F2561497DB3301A5D97EB00A1A9CD1D1A254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678627, "uuid": "4bcd019b-df18-4531-a9a3-ef7950c1f4a7", "value": "3072:MlKxwLHbqdI7GtGnXoVO6WLL/RtIfLdHaVQ4:y7qdI7GtkoVO60/RtIfLdaVQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678627, "uuid": "c28c722d-7240-476f-a706-0bfa20fe2c9d", "value": 111916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678627, "uuid": "747fa67f-f25c-4877-9ed2-62f8796f4f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678627, "uuid": "520e69cd-d55e-4b56-b232-0bf78c08c795", "value": "armv4l-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e67bb3f-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688652444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652444, "uuid": "8af6690f-615f-4867-b344-3914cf13146c", "comment": "Malware payload (RemcosRAT)", "value": "f37a776c7918591a61633ffe6fd7025c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652444, "uuid": "4fd9632b-5511-4cd3-b303-5700cb362c69", "comment": "Malware payload (RemcosRAT)", "value": "9f99648517b9f710d70c90aebcf84a8581c894be7e5c04684a2ba4e032d490e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652444, "uuid": "ca7d3963-7d1a-4cfe-8870-5c5d7540bec2", "comment": "Malware payload (RemcosRAT)", "value": "2dd023f647c3972c877223d8c5a9ff84f1839c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652444, "uuid": "af3a5d60-9d53-4885-b988-4d58f2fbe905", "comment": "Malware payload (RemcosRAT)", "value": "bafd1f5b25aa23e5801c78e1457523bbcc4db52273ab1758d6350e443c8ef29b0c18446bd259da07b49638406e5281ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652444, "uuid": "a61d65c2-8479-4758-a49e-a60366d0d354", "value": "T10F341298AB2EC869D595C6FC9414D6F222D95C7E0D2665CE17CCFE2FFD27200EC910A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652444, "uuid": "00df73b0-85a2-480a-91f5-70ce333c606e", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652444, "uuid": "943eaefe-b1e5-4598-a07d-d6806cc8bfc0", "value": "6144:MvGSN9gWuLpcBKnVBYAsmrzpyDfOXXVYB6:MvbGWulcBKV3uOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652444, "uuid": "da6dae3c-69c9-4bd3-b426-f9b0d4408808", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652444, "uuid": "f4a70b4f-be2a-472a-b2ed-9278f1fa61a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652444, "uuid": "db533fd5-e771-40d6-bbdb-862749cfdd4a", "value": "bOeS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaf3de1-1bb9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688619586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619586, "uuid": "2c3842d2-2a84-4e36-a76c-3f3605675960", "comment": "Malware payload", "value": "1fdd81ea6101b1276bd41e7711356441", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619586, "uuid": "153804ed-4e8d-4ad0-906e-5554fd600529", "comment": "Malware payload", "value": "9fded99d3646f83a78384b291eeb77b39aa8847b8819eb90f96365d781cf9597", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619586, "uuid": "53a2609f-6de3-4989-b4ab-ce7e8adf8471", "comment": "Malware payload", "value": "a3f46516c7f3da44e078f10ffb7f5a1fe33429b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619586, "uuid": "5fa3f31d-6d9c-4a67-9fb1-3b7c3e28f9ba", "comment": "Malware payload", "value": "5d4e9b37e1d725b4fa4ca2141433fe74499cc0ffc83ab5e464ba4b3b2f9699d9f6b71ca221958dd407a4c2b09e3ff3d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619586, "uuid": "9c6038a0-c497-42c9-b7ba-461c1d0d51bc", "value": "T141448C5074C0C472D97A2C345674D6B04E7EB8301DE0DA8FABD8597A8F326C2E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619586, "uuid": "b9a5930c-9e58-4b2b-813f-977e59cbac05", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619586, "uuid": "572ec730-440e-4509-969c-511138403888", "value": "6144:lZL+74MyFAWMVF7WZ+XvUerPFdmgxgbYSv4Zul79bo7Vym:lp+7vyFAWMVFyZ+fU6PFdmJYful7Joph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688619586, "uuid": "9d1396d6-860f-44f3-9b30-15c2a4cbf9cf", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688619586, "uuid": "fb062bf0-12e0-4a4b-9040-50d687e72976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619586, "uuid": "bf5ee59d-e454-46f3-83df-291b0bff1ae2", "value": "SecuriteInfo.com.Variant.Zusy.475489.19882.15761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972446f5-1c04-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688651653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651653, "uuid": "10b6d69f-8962-4365-b0b7-7cc90e1fe277", "comment": "Malware payload", "value": "fdff0ccba08c8cc681759c55fa2f5103", "object_relation": "md5", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651653, "uuid": "a369cee0-a7e9-4865-9965-5be814fc2dd7", "comment": "Malware payload", "value": "a0b8789ef3249b5fa8eb3590cd6f183e24273b5886560233025fc9d8de52ce0b", "object_relation": "sha256", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651653, "uuid": "86650f85-dd2a-4633-b95e-0b27c4aaf25e", "comment": "Malware payload", "value": "ea07d018dea04a294d370597d5dee263e48428f5", "object_relation": "sha1", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651653, "uuid": "df4e1f28-f46f-4a56-b030-6cb4c5af3526", "comment": "Malware payload", "value": "eae5e0f863ca5f1da3ce3aae1c806d657da35ddaded8219664106b99524baae3f113c7aa83c3d80bc70b312a69681422", "object_relation": "sha3-384", "Tag": [ { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651653, "uuid": "779d0e57-48aa-4d80-b43f-21965650a4b0", "value": "T1BDD533FB962A82AD60B2C85349E9893B64F1C45C3EE0CDE71017CDDB268674D3E491ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651653, "uuid": "2c184d99-57fa-4d4c-9415-8bedc9ccec8f", "value": "49152:j6ycTOQruNHx3erp0CQTwkUitytztvGB9hVIvBxuPWjnz4Hk+VduDc81LrRb5Orm:LcTTuerBkUitgzYhKvBxu+jz4Hk+BKLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651653, "uuid": "d23b1415-a8a8-450c-b693-f53f6bc968ce", "value": 2981934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651653, "uuid": "16418420-00bb-42b6-bbb9-014691284dd3", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651653, "uuid": "d2a86a0d-ad19-4c04-8509-de346cd11834", "value": "Pearl Land Launcher v3.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc28b04f-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623825, "uuid": "5772578b-c078-4822-9c59-8b371f3aa1f8", "comment": "Malware payload (RedLineStealer)", "value": "c9e527c5bc727415646a789f167367e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623825, "uuid": "cf666287-53c0-4c4f-959c-27abfef8feb5", "comment": "Malware payload (RedLineStealer)", "value": "a0cfd3977b345ecdafca6d5989ce66c3399436f6561a9fb30a7f2e9ecd8e36c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623825, "uuid": "df8bcce5-4593-4a5b-a63d-bb657febe818", "comment": "Malware payload (RedLineStealer)", "value": "d59212d1bdfdcdcaeec97fe6cb8c902e98d96db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623825, "uuid": "129c011a-d38f-430b-8c05-a34f7c5a1361", "comment": "Malware payload (RedLineStealer)", "value": "ce26ca9925cf64034b60511c9a8c882d40b16725631db1cbf937fb01abc9e7b736db67b61aab861eaeadf73c2c36ab1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623825, "uuid": "a76d8530-8e6a-41ed-96ae-3460b8fe92d5", "value": "T15C160109606D5EAFD475347123DC1953F8ACA8B5271F4E0122C2EDEFE8ACD80F6919AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623825, "uuid": "b7780d89-5df6-4fbc-9e4f-f9ae362643aa", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623825, "uuid": "b9976892-17b3-45d7-94d6-39d56b34d443", "value": "49152:nZ03ADSVWhlgHRRzfg4RwI1TccpqZzvNMPqS8pP2UlavUZ2wNZtzR4bRxYjdK2YO:dzlIlh1Tl8zY/8nla80LQJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623825, "uuid": "1677fe96-8405-4f17-bdb2-337002203d13", "value": 4067656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623825, "uuid": "c42c1064-6072-4983-a1f0-568504f74836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623825, "uuid": "5ffdea3d-0758-4da4-8fa8-830fd8a8e266", "value": "c9e527c5bc727415646a789f167367e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527c9c18-1bcf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628775, "uuid": "b048abf1-1019-4a63-b1f8-185b5c91c0ab", "comment": "Malware payload (RedLineStealer)", "value": "bffbf0c0460169aa56acb21a22ca7435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628775, "uuid": "05d7706f-7aee-404d-a787-3e10edd80d75", "comment": "Malware payload (RedLineStealer)", "value": "a1f5e63f986e5a0aa18dd355ca1c28fca3ab7e52c310e76b69218e78d7c54024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628775, "uuid": "b0cfcc1b-2699-4a20-befa-b3ea68fb778e", "comment": "Malware payload (RedLineStealer)", "value": "33a0be6472d0887a1da9c32fa20bda3cdd7b4dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628775, "uuid": "15f7df92-0d28-4b27-889d-09518ea54b80", "comment": "Malware payload (RedLineStealer)", "value": "7c807e5efd99dec4295f2ff37ab68020e64eed91632d9f7bb30803f69555f102c4f75b074c993a81b1e177ade9b937e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628775, "uuid": "4a058d04-58e0-49ba-9379-7bb6c7265a41", "value": "T17F060111514C9EAFE03A347577DC4947F96C98B4EB191C8522D22CEFC98DE83F2A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628775, "uuid": "dfad16a7-0974-45f3-a025-00e48dba9961", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628775, "uuid": "186bb747-56f8-406b-8796-a478503a7bbe", "value": "49152:CbH8aSZl6zcwuJK8TdyZ8mUnHCvaHbazdmXFrL0OsEpgarDSj++YewTzlbL48Pgt:gcWFUHiqMtEgPDaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628775, "uuid": "0d63812c-6bde-4f86-9c8f-c3e7caf06d1c", "value": 3755848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628775, "uuid": "f32dc081-95f5-424c-a8e9-f647c2d49c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628775, "uuid": "827bc38d-226b-4be5-9f81-1e4571bac1fc", "value": "a1f5e63f986e5a0aa18dd355ca1c28fca3ab7e52c310e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0604beef-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624351, "uuid": "1dba5e4b-5bb1-4820-805c-eefbdabb7698", "comment": "Malware payload (Amadey)", "value": "e1438e07c628b64c64ad5d50dae1d913", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624351, "uuid": "f7aa9f6b-6390-479d-9ee8-cd9785b72890", "comment": "Malware payload (Amadey)", "value": "a220fec18df3377c6b473922ba77098cee3234b125e71f29e746452d2a5518f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624351, "uuid": "b536638f-6b2b-4f18-9c6a-a3e300e26e5e", "comment": "Malware payload (Amadey)", "value": "389b6d9b6cd08330e1fba7c984a0e6dd635b7c4c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624351, "uuid": "f8a43376-4b5d-4f67-9981-8aaef2be6eeb", "comment": "Malware payload (Amadey)", "value": "0246785306237936c15415cf00241113f06121f27dd910eb179d4ef6aff25c30189469d4d8729b419ec1d92dab0a43b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624351, "uuid": "1e731298-00cb-45dc-b7cd-2d88a69ee4cd", "value": "T1B7560012284C4C5FA4B239251FDD445378AE67A85B174D9232C6EDEFEBACC84F681B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624351, "uuid": "c91d5363-7ace-4884-94a1-7d775ccaeb02", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624351, "uuid": "f1f936fb-c150-4b81-b774-00a4f19477a8", "value": "49152:mgrbEUCUNO4dBNLf4PQBHopaSg4WCVeOLtRRAGo2GYBXKi+8JmzqTptrqA9g14sa:mgfRO4dBlqQmWqVemj1lpepIlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624351, "uuid": "443807d8-d4be-4785-8fd2-a2cf23c52f19", "value": 6010184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624351, "uuid": "7fef5a86-3e71-4977-a703-dda8f1cc0323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624351, "uuid": "4e36375d-0678-4998-a323-2d11966a7f44", "value": "e1438e07c628b64c64ad5d50dae1d913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6320c44-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688636646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636646, "uuid": "2533f3c9-df1e-4775-9348-c9cab136be87", "comment": "Malware payload (AveMariaRAT)", "value": "619ae6e8a0a6455fc77fd6234352d4e3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636646, "uuid": "51e89530-22ee-4823-8961-e2acd3dbd463", "comment": "Malware payload (AveMariaRAT)", "value": "a26c6d538cb232d0296e5b770e975782c57497dba81fdfd82a0d3340975faf17", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636646, "uuid": "f153e263-3090-4553-966d-fef2b827019a", "comment": "Malware payload (AveMariaRAT)", "value": "f77deb2ad7f5ad76d29087cff64f037cfabe4c28", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636646, "uuid": "2916d287-3ea2-49b7-af81-fe89bec55db1", "comment": "Malware payload (AveMariaRAT)", "value": "d8e59f5547b1b1eea71877b3571fdfea22027b66e4e1a0183fa4494a50968fa2b1c96519529a0764511d38daf406174b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636646, "uuid": "54435b2f-c6be-4252-93f2-0c9015691cbd", "value": "T175D401023933C357E559DBF218B414C12379428468FCCA6C1CDBA9F5BD2AF2456A7B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636646, "uuid": "230c189f-3026-4542-bb62-2edb2f21707f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636646, "uuid": "6bf9c8cc-0127-472b-a21f-13dee5fb49a8", "value": "12288:UIQC6DCM2vv/cfx7gZhIg1dH0OolTwi/xO7va1N:g52vcfx7gZuWSFxwi/xOLa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636646, "uuid": "46ba18db-8c14-4f1e-8abe-c16a473f6af2", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636646, "uuid": "ef20ef2d-84fd-47b0-a604-c270ad821e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636646, "uuid": "46db8681-f999-4305-a448-978c311f667c", "value": "SVR003884884835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c0ebdf-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620460, "uuid": "33a2d43d-8014-4ef7-9bb9-efbf1dd05db3", "comment": "Malware payload (Mirai)", "value": "fa06c1e0c9b437382046389096303466", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620460, "uuid": "2ba4e5b3-a87d-4770-9880-a825aacb576e", "comment": "Malware payload (Mirai)", "value": "a376bf188ee62af9babcd137a2c28a2309a2e2f32c7fc346a957ccf84d3e46f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620460, "uuid": "79622a79-f744-4ecd-a9be-e1703df94693", "comment": "Malware payload (Mirai)", "value": "4498d73a29d2ca877768490f5a98bba0b524fd4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620460, "uuid": "dca9d1f6-8782-4250-aac8-cee9bc9eaecd", "comment": "Malware payload (Mirai)", "value": "f663494ac17e2f35a6541a5fe984a63b5ba4df3e1547e2a6f5c2e2d65298a9f4cb5b4b8c0b9a4849924f7734484c7c40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620460, "uuid": "b59e69d5-0b1f-48b9-ac3a-c3ed161c4902", "value": "T18C3495215866E213C0E7FFB9FFEA76856319F3568B8A6303A1A0116D0EF595D182FCC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620460, "uuid": "5de5160a-c488-4669-b2b4-0025679671a3", "value": "3072:X8siOMS76m65hwVZghEcTa7qw9xWS94EgcCVFu/WOUpUwmyQ5tRpNtR:RMg6qYEuaWc14PFukiwmyQ5tRpNtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620460, "uuid": "3f7307fa-6e2e-412c-a409-7e812ebb4d63", "value": 252087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620460, "uuid": "51eb2c2d-539a-4244-bd3d-4b13a8edc0e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620460, "uuid": "47748625-2f17-4911-9ffb-19259c49cb9e", "value": "fa06c1e0c9b437382046389096303466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b31f018-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623286, "uuid": "c42a40d1-3c17-400a-8b25-414088ce61dc", "comment": "Malware payload (Amadey)", "value": "7cd82a6f42c772700a241ddb89f89466", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623286, "uuid": "3ed00ba4-9caa-4aae-8285-c6f2b45037bb", "comment": "Malware payload (Amadey)", "value": "a3a98f1557d23a9d36bc9488ba04d1de617c85d860b4b0a8fd0a917921c63422", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623286, "uuid": "2eb8dc56-12c7-485b-b7f2-1ebf2f4dfc56", "comment": "Malware payload (Amadey)", "value": "71c05af59e51e22d8593d67847cf7904d8154541", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623286, "uuid": "f567de0f-99bf-4b34-ba65-153dfdc20126", "comment": "Malware payload (Amadey)", "value": "fa9370ffd57b6a132b2d3f4648b6218c6366741b7dba28fa8555f9e9152cdedee861513d461a459813aab4016d63198a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623286, "uuid": "d14d4d8d-0a4b-446f-bb3c-3834774f50b4", "value": "T117060101604C5E2FE439787677EC5553F86C94B8DB090D4962C62CEFD99EE83F2A298C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623286, "uuid": "e4a6d35e-a6b1-499a-886a-6adc2a2c26bf", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623286, "uuid": "186c72f9-d9d8-433d-b24c-dd4e4cbd55f9", "value": "49152:iKW2210LtCYO7YywkOq18HPDsLG+HW6t3FE2zGRLry93roVwRS566QINPkGj4OFw:0ALdAH5VGsZr4BkINNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623286, "uuid": "7298c13e-37ce-407c-8eb9-9179140c302d", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623286, "uuid": "a423bda1-520d-4cd4-8f5b-a9de8f9268bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623286, "uuid": "87f8d48d-a89e-4d27-b68c-f9c768c353b7", "value": "7cd82a6f42c772700a241ddb89f89466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725f7c94-1be3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637418, "uuid": "c0a8c61a-9e19-4e99-a2e7-11eb4db852b2", "comment": "Malware payload (Mirai)", "value": "bbe65b78d9efaf2700271f4d44dc4eaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637418, "uuid": "2855c812-44e1-48e2-b71f-c18905976a57", "comment": "Malware payload (Mirai)", "value": "a3d4cf53a6db901e840b145ee21fd779789e26c34eaa182a4a53ba917db8b422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637418, "uuid": "e9632e48-795f-4b27-a9e9-bc15811f3d44", "comment": "Malware payload (Mirai)", "value": "9fa624737743d1471696c32733ffdd2a4fa5b846", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637418, "uuid": "8c1da6fe-d6c9-437f-b610-b069df74c1e1", "comment": "Malware payload (Mirai)", "value": "920154dadbf19a383a3a96886dfb769085c31f1b9f5c8b844842a36bb3d97ce4f32cfb01a541b2dfb840c194380a999b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637418, "uuid": "3d2e7575-8cd0-455f-b59d-ecfe4c0cbdfa", "value": "T121735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637418, "uuid": "9dcc92bd-a358-42f1-9f27-2f82d249d9dc", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8m:YwfdNu4cmZvFqI3w7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637418, "uuid": "b1b76b27-c021-4d77-a324-6c267a325b14", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637418, "uuid": "3bcf4d89-1742-4eaf-a8a9-72cf48a08a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637418, "uuid": "c7e78f1c-e29a-4ebf-a4bb-c5886d728f11", "value": "bbe65b78d9efaf2700271f4d44dc4eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41db9894-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688622304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622304, "uuid": "b6ed9c55-871e-4b00-b09c-b239b08c9d83", "comment": "Malware payload (Loki)", "value": "7785cc11c6dc5c4dd65d2e0fd5569bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622304, "uuid": "9d5dc0b6-7bcf-4cce-b0eb-bf2b8fa93b6a", "comment": "Malware payload (Loki)", "value": "a40abc8cce8837364bf0de1c12ec7f43bdb3c5806a518556ecfd1d9db705bc32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622304, "uuid": "84fb733d-d921-4d18-9042-e4802610a768", "comment": "Malware payload (Loki)", "value": "55dca38021e1f811caa0a02f90acd2a79d51da10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622304, "uuid": "1f7f95c0-bfbd-4f86-93b0-30c106aede37", "comment": "Malware payload (Loki)", "value": "ed1404f26731759fd742deccf32c144ea3f7441840340df2ff71d40afcc21f5d4f69fc652145dd60421186bd90c55aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622304, "uuid": "9ddcc434-4a4d-463e-81de-1191f9a0eef5", "value": "T16FE46B3C1CBC7623C174F2F58F9CD421F25095AA3E60DE2765D3989A461EA0269C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622304, "uuid": "3f0ffba4-414a-40d0-a659-0acb800cf192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622304, "uuid": "af685704-964c-4b13-9d88-54a49b4f1d22", "value": "12288:2zYNjhnjhgDr4uhrluqkOIADjkmyL867DnyiJ9LTmxaox6V:2z4NnNgDUKxk+yAcyi/iHx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622304, "uuid": "57d87711-4c6d-4f7a-add7-dc2d4a25eb87", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622304, "uuid": "624d8312-c020-43af-8344-4d552e95af62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622304, "uuid": "f160feb2-d8c7-4d00-bf97-90e23ffcd95c", "value": "UPS_1Z311036W7939223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d9162f-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688652275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652275, "uuid": "2bee3a13-5f3b-45c9-b23c-ae5d9f694981", "comment": "Malware payload (Amadey)", "value": "e72d5a62353e5292c47d43f7f4c12d5e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652275, "uuid": "19f70b39-06eb-4e32-9dc7-f89c18b20aee", "comment": "Malware payload (Amadey)", "value": "a43fd88555cc10bddc599799de4df4b12ef3e8b2020c82054db9b9882ebfadec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652275, "uuid": "186257fd-d90a-4667-ae40-689db2178182", "comment": "Malware payload (Amadey)", "value": "66d5c3f8e0ad42ebf44dec27e213b2d7dbd7d7a6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652275, "uuid": "9f3ffe1f-4c83-49d0-9b61-77582844f81e", "comment": "Malware payload (Amadey)", "value": "a6ec91f2ad71ff3bb4bbd721462ba52ef1c3abc70aec0331df0e5ac4e2f3ca7cca46b5b4d9cb69f16bc2cd4a3f00b1e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652275, "uuid": "e8a81c3f-3d27-4d3b-8f5b-e18e6a67150c", "value": "T175B402333910A963E449D93195BA54C0F768E3FB3AB242DBB258E0356F5B2D2D32532D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652275, "uuid": "622c98eb-8e9d-4c66-9ba2-16fef592b439", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652275, "uuid": "2ccb372b-4a33-4565-8247-f10504d54a1d", "value": "12288:UZA6fv3aRdnQgvaRbPEOFn5BGVggMw27XqXV4j6CW:UZAQv382gebPEOFnXGVtE/j6CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652275, "uuid": "d367cfa6-af34-42d6-95b0-97796eb97dcd", "value": 513864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652275, "uuid": "535096ac-815b-416b-93f4-8e7c47595862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652275, "uuid": "0052c43f-4629-433e-aec2-19dc4ecd46d3", "value": "e72d5a62353e5292c47d43f7f4c12d5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e306d693-1c1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661229, "uuid": "b9948462-6a49-45a3-b432-8af39848d659", "comment": "Malware payload", "value": "9c49848c51bc348164e7066e941f4fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661229, "uuid": "d97605f7-0324-49f3-a54e-d977e302e243", "comment": "Malware payload", "value": "a466d38458daf4be776032a593de6d2f0b4f49514f1e970aff2d280dd821ae6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661229, "uuid": "5f1f8cdf-7e94-4747-8017-356a25dcee03", "comment": "Malware payload", "value": "eb864d7fc2725a06616ba909c098f7cefcb30687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661229, "uuid": "4583ae26-dd83-41b7-910a-39543078f54a", "comment": "Malware payload", "value": "b97a67fbc3d59f484a3c8cf5ce6872020aa92a0ca0e688c85ac11a29a0e45413c2f0e7e34f197026159b0f1dd437f7f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661229, "uuid": "d367f369-0a3d-41d5-8d20-923c4e73246c", "value": "T1ACB6014AE38C9AA3DBAD89BFE1D1665143B9D03B8367F3067CCC4564382DFE5891214B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661229, "uuid": "232b446b-79ba-4c89-889a-522086ce7fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661229, "uuid": "6f63b05d-ce83-43a2-8ebc-360e371510f8", "value": "3072:mKFsfkHLVzsUI0O+1xdFrDDBQATywgQiQiBJVGAgu7LyI41xfZ07/qDZKSz6/Vzs:rAgmUVxd9TLqbNjhgjAqDZKc6/xsOMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661229, "uuid": "79efce84-791a-4666-bff1-a2975c7e230d", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661229, "uuid": "33801ef6-9356-42b3-a8e7-ec080322ca30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661229, "uuid": "1c3fde33-34db-4cf8-a789-5d6cddab644d", "value": "Pearl8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cebd10-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1688627352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627352, "uuid": "10a97cc4-2a95-4e99-b961-7f9240137902", "comment": "Malware payload (DarkTortilla)", "value": "891c191dc23469da5ba9f9283a1bbcd3", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627352, "uuid": "ce413268-cb33-4c8b-a8a4-9058c49afcd2", "comment": "Malware payload (DarkTortilla)", "value": "a4a20370e05d441bebe127d804200ca02be07daf71dcdeb89c4c83a022550834", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627352, "uuid": "8ce8a28a-ffe2-4c97-8abc-bb4d23974993", "comment": "Malware payload (DarkTortilla)", "value": "b71b91b2aa8dbe82dc6d970d20f99f29cc8da034", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627352, "uuid": "b1daceae-fdd5-41e7-af38-6aae8727eda5", "comment": "Malware payload (DarkTortilla)", "value": "4502514cf44ec2afbf2d4c6e1c09a4b1e753d1a7df3390da8c8658a2107dc528ea2f828a09dba7afabe0f2f797e91424", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627352, "uuid": "ca0876e8-6acd-4d69-9452-40e487a118ad", "value": "T14C35CF360B496F32E4F926BD805238952BFCDD920122EB972EF931E406F7A874F75215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627352, "uuid": "9ce721d1-88ee-44b5-b5f1-35cda4c20438", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627352, "uuid": "aa881519-cde1-4ea1-bbfa-0f8e4a7c7599", "value": "12288:2bt12i2c9b20yCX4q4aYLaTIChKKYJfmuf4vcfKKGqC+:pLWITWU4kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627352, "uuid": "9f1ce5fb-e26f-41e9-a751-9dbe5715576f", "value": 1152760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627352, "uuid": "5f7b3a0f-160b-41ac-a736-ec1b243cb767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627352, "uuid": "d86ffa85-50dc-49cb-b618-bdc995c7f087", "value": "Ticari Hesap \u00d6zetiniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9833199-1bcd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688628169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628169, "uuid": "8adfa5f1-7d99-4221-8a8d-0c4ecc8ecb45", "comment": "Malware payload (Amadey)", "value": "a21737dd9954af5df8e7fa1f8a46f6ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628169, "uuid": "5f79cc39-92e2-4b13-a598-76819314530f", "comment": "Malware payload (Amadey)", "value": "a4b50177024e69c784b742dc2b2006c8e01df47686cc76c31934d0af7c367855", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628169, "uuid": "f2836609-3c87-47b3-b1c3-50e1afb1b7f6", "comment": "Malware payload (Amadey)", "value": "aebe932da1cafd44cdd862ffcaa18e7384814e3b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628169, "uuid": "0d064348-f8cf-4d7c-b09f-49eee4c7463f", "comment": "Malware payload (Amadey)", "value": "c73c33b5da21117523bb5e360b8053e167e6c8f4c7443175d3ce2fa2c1875b12201c14b8b05edd8c11deceaa428082c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628169, "uuid": "40238388-372e-421d-8c9e-77337adc4bfa", "value": "T18D160119606E9E9FD43430B027DC1993F9ADA8752B0F4E5062C2ECDFD5ACE81F69198C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628169, "uuid": "6ddce4a3-d0de-4632-9a98-9b4b20408bc3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628169, "uuid": "426a18bb-0dc5-434d-963e-d9e41f9ae58d", "value": "49152:NUnfEBgMlG0njP0G45eDeSShhwK1N1Y5B8uvZiIzFduGMZmUK3kbN/cjLkO6p2J/:Np0dv108M8IzHuDQrJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628169, "uuid": "9843e1ac-6d4e-4ad6-bba8-ee9c239fad65", "value": 4049736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628169, "uuid": "31ab44a9-5f43-4941-aebb-8e0a638eeb39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628169, "uuid": "1f0f004b-7730-4d29-9cfe-b3a42292be5b", "value": "a21737dd9954af5df8e7fa1f8a46f6ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4af125b-1be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688639328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639328, "uuid": "2ce84ed1-16f4-4c94-a1fe-53d78280991f", "comment": "Malware payload (Amadey)", "value": "90245e5126539d8bc952c30efad9eb2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639328, "uuid": "3798209a-a68e-451d-bd46-58e802a130ce", "comment": "Malware payload (Amadey)", "value": "a5222ff2697107e04e42f0750baa8126a0a6407c528409aebdba4e0454c0d647", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639328, "uuid": "f0b6d527-b977-4cf7-ab45-58449c9e977c", "comment": "Malware payload (Amadey)", "value": "ed35e3ccf9da999a2c4b7a115eacfa789a180de2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639328, "uuid": "79604be6-fb9a-411a-8743-4284d071024c", "comment": "Malware payload (Amadey)", "value": "951934c85eb0638c06927dbdedadfd5d64ac409c38f662a54e6f91fdc6e47a0bf468244060a9697aa7ab0ffba98a8156", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639328, "uuid": "f6244828-5cbb-4420-a814-72ef593afc7b", "value": "T164160108606E9E9FD57434B52BEC1893F9AD6870271F0E4022C6EDEFD8ADD41F29198D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639328, "uuid": "1541f440-4aa2-4d8d-bef5-f40c7905ec6f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639328, "uuid": "dec16fbe-f954-4591-a706-05c156e6692d", "value": "49152:haVwz9IWxDvE+DomnkzYAsY0M0T686oYabeSCTx00HXHFf0KG0YTR77dGFiYC7f4:wCNS0Mt803SgrGphDGdYZp6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639328, "uuid": "3f2f04df-c66c-4065-bb29-787377aecc50", "value": 4060488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639328, "uuid": "dc31cc0f-c81b-4559-b8e6-76f218e5fa76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639328, "uuid": "0b596ca0-dc5c-4c33-9d45-2361a860a058", "value": "a5222ff2697107e04e42f0750baa8126a0a6407c52840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35c8273-1bea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688640641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640641, "uuid": "7425511c-1b74-4976-b7c3-f54a5e3e96ac", "comment": "Malware payload (Formbook)", "value": "562da9c60bc5400f50ad0a3b2c3b10c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640641, "uuid": "0b9b77b5-b48a-465c-a4c6-c23f84333f9e", "comment": "Malware payload (Formbook)", "value": "a5bbf13f56f953eb2313a2b3d2c0c06d14bc1455a06f01ec91a7f4e2e3757297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640641, "uuid": "0eaef172-1d67-4e61-8699-f8f96d2e7e61", "comment": "Malware payload (Formbook)", "value": "46f05ccc922423ea13d1834f6d928533625f0874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688640641, "uuid": "725099cd-f634-4d76-95d6-523499fe6f05", "comment": "Malware payload (Formbook)", "value": "c9cb82e396f24c07426a1b7549fa93ac4c7c8dc2070dacdde087482cd6c29651978aa810bbf6ac5574aa616e5910cb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640641, "uuid": "50db156c-6ead-4952-a5b3-86640cc49f7b", "value": "T16A0512687AF7460DC45A7FBC2C445079CAFD66947833D22B6FA7B888CD06B160EC1663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640641, "uuid": "0af73c8c-18e0-4487-8cbb-4893e192cd9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640641, "uuid": "6989791e-fefb-44a2-8020-579bb583ab58", "value": "24576:h/thewlqB6p29F04yDJhtYXfJ+PNNdez5n9D10:Ve2q8p2u4ckJ+PxezxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688640641, "uuid": "8848d264-da28-4353-a115-7bcfaa6a41ab", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688640641, "uuid": "57d1446c-ad34-4448-9e4e-b0fdd1c92bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688640641, "uuid": "a050300e-64cf-48be-8de1-c27c81f6e12c", "value": "a5bbf13f56f953eb2313a2b3d2c0c06d14bc1455a06f01ec91a7f4e2e3757297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f1852-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688652103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652103, "uuid": "e7284392-c857-4aac-987c-92010c1cbfc4", "comment": "Malware payload (Formbook)", "value": "6ee259d86cf64cf1a52ce0bcd7f4ab52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652103, "uuid": "d8b70d1b-90ce-4bb4-8ec8-a340abf654b6", "comment": "Malware payload (Formbook)", "value": "a632288c7ae62bee60155ff916cd70e7ac14183b7789bcf64be9a186c0b75b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652103, "uuid": "f8b07a26-37ac-4530-a940-9ffb977ad7d2", "comment": "Malware payload (Formbook)", "value": "63b625e949d3f42d0156dc07a052855ee9cb03b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652103, "uuid": "480c0ede-d5ae-4342-b253-e5383e440b89", "comment": "Malware payload (Formbook)", "value": "3134530c20898a29fb3755ee1d7eaae09f621f2289103bd8c29b19ef5f299801a916557f84c77536e7a154e085ac43d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652103, "uuid": "34750063-42f9-471a-b3e6-3eaf7723eaf1", "value": "T11705E080323A2967EAB9CBF60250627087F52F5FA55DF6D84CC6B0EB52F4F814652D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652103, "uuid": "e821e094-00c5-440d-b3c4-f093bb69776b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652103, "uuid": "668e8262-a863-430c-9aad-39a1612ed8d3", "value": "12288:BlKnueEXqXdVP6GDahvyO7JC6Goq+hXg7XGAO6eSkjmubAS4SXZAS:W34qXdViG+KOE6GoqXbHOfb1bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652103, "uuid": "c57413f1-15e6-4bc6-bb44-ccaf5b33ec81", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652103, "uuid": "9a4e5d68-2cf9-495b-b4cc-8ef361426010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652103, "uuid": "15f6c271-ba6c-4cda-bf73-5d800fc11a83", "value": "a632288c7ae62bee60155ff916cd70e7ac14183b7789bcf64be9a186c0b75b0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26c639a-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674435, "uuid": "c241ed17-c3b5-422a-a461-d867ea6624d1", "comment": "Malware payload", "value": "497dfe70f6558f592636356c663feba0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674435, "uuid": "53969a6f-fbb6-4402-8779-e10a68fe7ef3", "comment": "Malware payload", "value": "a6343f61a74b6dd4944ece328fa549deb751ebedcc13ce49c6bf3bd81d27a3a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674435, "uuid": "e5f76675-75db-4b6d-8807-d7902faf4e8b", "comment": "Malware payload", "value": "759330949a503683c14bebd638a9b39c4866e486", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674435, "uuid": "eb79aaae-aa25-418d-9402-5f601594f48e", "comment": "Malware payload", "value": "fc2da3872ef5abd15a76ace33c72e287c92f864c152d7c358380322a21bcab494c495d9df178899cd23602688e301616", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674435, "uuid": "cbaaca57-8dff-41cd-8a3b-2ebf9631d4b6", "value": "T15BF32BC6EB427E27C1C26BB5FBDBD24533E3971093DB23059558AFF02B4BA990E16109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674435, "uuid": "6e7302fe-a0b2-43c0-b51a-851192791984", "value": "3072:cr2/YHWvGKa0rWfklJfPCeVi0y3Sj8SvrkHM/96VxebbGv:oKGKa0rWfkltCeXYSvrwM/96ViC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674435, "uuid": "9987f04c-4004-43c4-8b81-16571cd552fd", "value": 158889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674435, "uuid": "e47d86b8-4d39-4bf3-9bc7-e8c0bbe47d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674435, "uuid": "a0eed9e6-8fdc-4384-8a70-bf8cc93b28de", "value": "armv7l-20230706-2013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2686833-1bee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688642330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642330, "uuid": "a29e102d-9435-4f05-ab4e-d7567edb27be", "comment": "Malware payload (RedLineStealer)", "value": "f46f844ace4ec5938956dc8a3969147f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642330, "uuid": "a32b9a43-7cef-4fbc-8485-0e71291a3575", "comment": "Malware payload (RedLineStealer)", "value": "a70dcb6e63a36afa9d791fc45c9b5383b1f45a3589fccc9d7bb5ae1fcdf12b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642330, "uuid": "09fd63c1-c1e8-4959-bbb2-5a7204b5e6ed", "comment": "Malware payload (RedLineStealer)", "value": "86c094d6ed60af2e4acad10e14d02a28066fadce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642330, "uuid": "030facba-5c91-4efe-b2af-0e9eb970d685", "comment": "Malware payload (RedLineStealer)", "value": "255560116eef2d09baf63aa6a7213f27f8676c437235e5c842b1d5f65dd153db6795be48bed86ad12f99809b2329e077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642330, "uuid": "8fdc8c68-ae29-4575-b4c6-4d28950fddd9", "value": "T17C55AD05A09D1C5CC572E7B2BADC23523EBC8474291DA13992E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642330, "uuid": "034c145b-306e-4066-9073-dae26a553ffc", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642330, "uuid": "9e403db8-b4cc-4b7f-914e-3eb8cffc931a", "value": "24576:u/8t1MvGbfl9RD7UronbZXqiFsRa7lORqodaD:uUH+uflYrqNXTV7lORqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642330, "uuid": "06814046-d998-438e-9b4d-4a7797e8bd0d", "value": 1343821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642330, "uuid": "89f34c0d-894f-4782-be45-8eb47c7b1f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642330, "uuid": "297bf67b-085d-435c-96df-279409b04f92", "value": "f46f844ace4ec5938956dc8a3969147f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eca211d-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623641, "uuid": "22e9b612-0156-4019-b0c1-0446d7169381", "comment": "Malware payload (RedLineStealer)", "value": "a1cf5416d2b02d57aaa25b8a4f6564c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623641, "uuid": "d4eeab85-8ecf-4e12-975a-7f688ffa609f", "comment": "Malware payload (RedLineStealer)", "value": "a7c5ae0ef626b8f38843a107a4773bbb01c724bc2d5af7a7b3f7a1fb23de2656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623641, "uuid": "9f5b7003-1e7e-4ede-9f57-c59c910ddd67", "comment": "Malware payload (RedLineStealer)", "value": "70297fe8be05d09e07a3e251277482fad1451236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623641, "uuid": "482e4446-b26f-4ff9-9a53-0b01c74e3e50", "comment": "Malware payload (RedLineStealer)", "value": "3daf35bd1b91e10405376ff0d82487dd09f587419dee64abc8b73ece603dd93c35cf27b16a1719e482a295aef7ef2380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623641, "uuid": "5fa20f02-0b8e-4554-9c8e-734a739d91f7", "value": "T107060100618C5E2FE53A79B637EC5457F86CA074DB091D8121C62CEFD89ED83F6A668C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623641, "uuid": "5f8a93ca-ea49-49e8-bbe2-c6de3940f8bb", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623641, "uuid": "2cfd9334-7938-4700-8bfc-18ca37b617d2", "value": "49152:XeKcX2pgdky69OYv5WL67Y0hPvqJbm6hjeXxvh+YJiGIzCvNuVVr7UErzxOC+am9:6sIr2hM7GItrzT1sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623641, "uuid": "7ba95f16-3f3b-4c0c-adc7-f82f08922e5f", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623641, "uuid": "a797549a-7364-46dd-ae85-7847a3d70c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623641, "uuid": "91127f98-0f22-4af2-884b-b954c7372d32", "value": "a1cf5416d2b02d57aaa25b8a4f6564c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b848bf8-1bc7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688625407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625407, "uuid": "902150ca-1469-4849-8a1b-8d477ef6b1ea", "comment": "Malware payload", "value": "c9fe07dae548a05c069d25760f955b02", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625407, "uuid": "1f9f545b-f393-44e6-a897-a6dd76b8b6c9", "comment": "Malware payload", "value": "a85928b874ae58448f62a9d32aefaa22ef4d38a8d83dbf43e6d70edde43fcd61", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625407, "uuid": "6ca77ed7-86fe-4de3-bbf5-d560fd734602", "comment": "Malware payload", "value": "51a984811f1e05753c43c7da9996a50de69ee8e6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625407, "uuid": "b156a69c-cea1-4f39-b989-3495d24031d3", "comment": "Malware payload", "value": "11a6c01bf41239788925b7c5f6c40a88e90133bfeeca9a4fc72a93a11d5cd913d90708a3dc62c64678ed404d7da3fb58", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625407, "uuid": "b4024cc6-ec12-4c93-82ff-5f2aa77e6609", "value": "T149C3120F1F597658C873F27A84823E6324946BCF91D2C9DFC1C48A19A131BB5BAE851F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625407, "uuid": "8c21a8aa-fe7e-4024-b375-1cf0b4bb1e68", "value": "1536:lhZBTbTbWnP/C5MjWI61sHuy/AXiGAUNoOVeTKVI4NDybxchwYGdOUeMPuvN9LlH:lbBnTbuPqp1sOIAwOs4ND2xdlwcGNm7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625407, "uuid": "23cc0472-0b7a-4ef0-8a21-9caaf3ea0406", "value": 121360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625407, "uuid": "8fb81e86-064f-4947-89c4-d6508c324dd1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625407, "uuid": "0997f036-2e5d-4084-97c7-f1264aa581ff", "value": "fa04c0ff08f0567eb93cb2110c2572d8d736e41f202ffd1f5517b4c90d31a90d.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361d6178-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610259, "uuid": "c8f7487b-5ab1-475d-8b9a-680b8518be5e", "comment": "Malware payload (Gafgyt)", "value": "cacf26d2a12dd1aa3544a1301d780feb", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610259, "uuid": "a2441e0c-a0e2-466a-82f0-fe0e8c9501f9", "comment": "Malware payload (Gafgyt)", "value": "a8953ef7762527aaecf8fee8d1ecbb33c5ae5927c32ecc89111a6ac0c1466e18", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610259, "uuid": "2f826ecb-550c-4213-9837-388487b3651c", "comment": "Malware payload (Gafgyt)", "value": "1daaa55837aff2d3644e2845d0e96dcd69ee7322", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610259, "uuid": "cf6557c8-6269-4d63-bc4e-fea9c87513b4", "comment": "Malware payload (Gafgyt)", "value": "bdd1cb57887c585ab2c98d3f11a91dd4302bec246c1b7cf04dd34a31cd21848e231d3a53e25a291de2c9b1fe4c2afb56", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610259, "uuid": "334fdf25-4d2b-456e-af85-1ec1e04cabd7", "value": "T1F58208117692D8BCC45DC2F8255FB93AE536B42D433A378A33E0FE278D4BD117A2A844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610259, "uuid": "3778500e-2ee5-433f-a4c8-e7ad6c069ad1", "value": "192:GWKBHwaDyss4sj6+eLa037wJd/0opaiKnRVVI2Aq9G0lmcaV+9JC3gRC94uZdbOv:YBastsrV/fwiaVVI250V+PXRcH7V94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610259, "uuid": "b193ee84-545e-4600-89e3-e981db3466a6", "value": 18728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610259, "uuid": "25e7f52f-a1d1-4e99-8d9f-3146bbcc74c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610259, "uuid": "7c56f66b-77ed-4653-a127-f09114fb2e08", "value": "condi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c8d5e-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623664, "uuid": "3551a5f4-7c06-43ca-bd94-2b7a33822c88", "comment": "Malware payload (RedLineStealer)", "value": "bca2cc9a8e0726850632da71cef4cdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623664, "uuid": "a1c9d861-f82e-41c8-8196-34c90fe9e707", "comment": "Malware payload (RedLineStealer)", "value": "a91e653671ff6c8c14c6514c6bf4f59caefb5579de34a93107f67d8ef9ed36c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623664, "uuid": "39354490-14fd-47f7-8a1d-fbda27f12e7d", "comment": "Malware payload (RedLineStealer)", "value": "162aa793f61003d58f617ac0d3433d3653de5d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623664, "uuid": "c1c9526c-b7d8-4119-b03c-169ce3ff4b17", "comment": "Malware payload (RedLineStealer)", "value": "e5043d56a1f71185e5f4643b78096ca5c014977f9cad58feabaf112581d4c09cca05d6484bf2086d891f3e6b4a421bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623664, "uuid": "13d948fc-683a-443d-b0c5-2dfa211fc680", "value": "T1AE560112281C0E5FA57638291FDC58637AAD53685B130C5231D2EDEFEBADD84F681B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623664, "uuid": "e7514021-be22-4c0c-bac7-9ce001e88323", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623664, "uuid": "3a30760d-51c3-4282-a37a-6c702acf9b4f", "value": "98304:CRWClsWwL7MZfTjRIZQFZHZ6tMQJO35YJgIWizbB:CMClDu7MZfTjRIZoHkUYXDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623664, "uuid": "756646b8-6f11-4058-86dd-e5c55802b557", "value": 6003016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623664, "uuid": "e903d5d2-d09f-4a00-906f-c1f442ebde6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623664, "uuid": "ed1f12c4-5bff-4425-8db5-9282fd283d17", "value": "bca2cc9a8e0726850632da71cef4cdd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcd91f3-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648661, "uuid": "dc29c3d3-9499-470d-b121-a83fd8e42001", "comment": "Malware payload (AgentTesla)", "value": "34d78052b393d9711cf9979f747bf7f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648661, "uuid": "3681e2db-a721-4c51-a456-0aa22e73ca47", "comment": "Malware payload (AgentTesla)", "value": "a92a423153bb0edee96e63ec0fd0318de189e23cebb79a63c91279866362761a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648661, "uuid": "b47db0a0-4497-49fa-aa95-de6b675da32e", "comment": "Malware payload (AgentTesla)", "value": "eb5056582d16bd405d174ff80b50232a4ae9ae2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648661, "uuid": "3b0da121-85a0-4015-96de-99cf7e776f8f", "comment": "Malware payload (AgentTesla)", "value": "137e05fb8e0516bc2f7d1b28702d373509a5adf94bc9d6d73fb6e4af20ee0430fdaf001846dad4200694ac110e963f8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648661, "uuid": "6087aaa3-75de-479a-8a74-1482e2c5a5b7", "value": "T149F412AD17F7992ED8463FBD4D602AB0D0FC4689B177D60B8FA3BE58DC11B084985AC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648661, "uuid": "c7c6fd61-5f9a-4ab5-adde-f21e697eb92b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648661, "uuid": "921e0545-fc1c-4438-987c-e36468f5e0ff", "value": "12288:E/UPWR28Le0cY+Yg9fb9iVSSu9TLQaTzKLxmqDGXu9SxWs3Oyuf:E/Y+xL9Rk9mu9TLffKtD39CWeOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648661, "uuid": "143abe9c-057f-4439-a829-58194797c116", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648661, "uuid": "0c30c364-8e8d-4ed1-9186-7b110838c66c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648661, "uuid": "e49cd1be-0aba-449c-b894-c33c81861162", "value": "a92a423153bb0edee96e63ec0fd0318de189e23cebb79a63c91279866362761a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda3e698-1bcb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627344, "uuid": "62b74974-60d0-4129-bc2d-8b22d0b42631", "comment": "Malware payload (AgentTesla)", "value": "65982a041d66aab0de8ec6b6f2eb7440", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627344, "uuid": "584c61af-0115-410d-9f0b-09e4d6ff7a23", "comment": "Malware payload (AgentTesla)", "value": "a934e117e87f62078b86928005e6aea5b65598d4af3366c4184614e5a212bf2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627344, "uuid": "810f1d6b-0343-48db-a1c8-001b91121773", "comment": "Malware payload (AgentTesla)", "value": "cf55fee5bba782a410db72e0e41474173a3c3373", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627344, "uuid": "034ee2aa-a4e3-4c11-9a51-0495717798c9", "comment": "Malware payload (AgentTesla)", "value": "b6fd5f51128c92b22266a0171e8cba7860638c321f223ae14d9b649088fff343bcbb99a065ed79f1e453aef5501e9aa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627344, "uuid": "03182188-96e5-4ee8-a653-27155088c853", "value": "T1F8D44A3C18BC7226C170E6F68F9CC421F65095AB3D65DE3769D3989A061EE0229C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627344, "uuid": "5c511324-8add-450b-89ec-6dbb9dcff1f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627344, "uuid": "802a47e8-b1de-4498-b89e-0593c2e72d27", "value": "12288:F0hboYBQwQdkdjlpu7wSNAVmpU+6K0CIf+3qs:OmxWpu7HA0pIf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627344, "uuid": "11c599af-3f02-46c7-bc20-7910a39c5710", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627344, "uuid": "9677aa0b-11ab-4217-ab3c-73fdd434434f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627344, "uuid": "fa3da85a-b762-4ddb-ae43-c6b7e5838a5e", "value": "Solicitud de cotizaci\u00f3n LM-23-1552_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d3408f-1c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663440, "uuid": "9e169e0b-7a8b-46fd-9f75-b2de38cda2cb", "comment": "Malware payload", "value": "42654b2d18f4bc0e931da0a192b53975", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663440, "uuid": "54671fe6-0b8d-4a20-80c2-a7b4715d260d", "comment": "Malware payload", "value": "a93fa90a744a8c44f1612348d5502cf81b836724275dc3367733ddac3e978f66", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663440, "uuid": "66dc8b45-39ba-4764-98eb-e136e5bc60e2", "comment": "Malware payload", "value": "bc4a0898d23c5888bd5a9546a5941cacaf97c8cb", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663440, "uuid": "f7d5a185-91bb-433e-ba6c-25b3fc96f44b", "comment": "Malware payload", "value": "16e87a59bdf78927f719a5291ce8db9d009bd0817b54c64fda4579f3aca8392252f43771f96832cfa778df5339bd4edb", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663440, "uuid": "639af494-17b5-4579-9f0f-7200b65175f1", "value": "T1CAC45DA633AC4D02E86D4BB543A1C2768B26ED6B1405D34B44DFECFB3677386D889247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663440, "uuid": "5dd3e62a-f4e5-40cc-8bff-2e62c99d1961", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663440, "uuid": "4a66c320-d38c-4e7d-a15b-e5a43e13452e", "value": "6144:BVAfLY/uWV7aKfGDP8Y8zkCamXe2M8flY:BU9P8ECakeZ86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663440, "uuid": "b1730ccc-b2bb-468a-9bd9-f241942b5196", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663440, "uuid": "06997dcc-1265-4902-a30e-c623f20d8c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663440, "uuid": "dc319a9d-e7ac-46a1-9a7d-4d353bb9ed17", "value": "Evolion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0704518b-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622635, "uuid": "fdf923f6-f420-42d7-a1fc-12c8f1b7a7d9", "comment": "Malware payload (RedLineStealer)", "value": "41013bfec057f01c73255ed53fb0eaa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622635, "uuid": "f3946df7-8316-4d2e-83be-0a44554674e5", "comment": "Malware payload (RedLineStealer)", "value": "a984ca54efa3ad1a8c7947035d0528fe0b481cac658ae97d8b6d9b7e57a92110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622635, "uuid": "f4757fdd-5370-4dac-a0cc-2fc61a77bdc5", "comment": "Malware payload (RedLineStealer)", "value": "ab2fbea867a40f29ba5cf8fd3ef9e16ac4bd1220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622635, "uuid": "3fe4d835-072f-4ce1-9054-7607fead9df2", "comment": "Malware payload (RedLineStealer)", "value": "b3a4a2c2822227ea54153f0261421ce38ecc71e472471f051d59a3bd57d22d1f9ee9d9f6445c1e58beb154535de89c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622635, "uuid": "2db92a77-7a43-4335-8412-d4c7bda9f6dd", "value": "T172060102658C8E6FE43A353537DC4853F96CA474DB090D8622D62CEFD89DD83FAA658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622635, "uuid": "9ca0341a-b7d4-4380-925c-4e110f6bd59f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622635, "uuid": "ca6a9dad-160c-4418-816a-d8d435e4b29b", "value": "49152:s6psz8PbxQyeMjwxjNeghvfEgJTqEQe8aIDkvklFKzi91NdZUUsCLfXCh0KECuJQ:XfSyuRBmEdIxjgUHXm88bjd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622635, "uuid": "05e432fb-6e7b-4bd5-a71c-fe032835c319", "value": 3770184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622635, "uuid": "5b887f17-fdcc-4577-a650-16519e6c92c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622635, "uuid": "228a097a-aa94-4378-872f-76114072a057", "value": "41013bfec057f01c73255ed53fb0eaa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3328e21d-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688648049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648049, "uuid": "d51242c1-48e3-4233-8203-85e8895f9f59", "comment": "Malware payload (RedLineStealer)", "value": "147d87b81bbf97bc6532ae9c480c6250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648049, "uuid": "e8b08f16-3227-4d5a-88f7-8a24b9dd4b29", "comment": "Malware payload (RedLineStealer)", "value": "aa46c78978d744edae1170acdc7a518ff42bb02eba66a52724d46226b15c4633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648049, "uuid": "660c552e-e801-4e1d-a56d-2b39e5c402c2", "comment": "Malware payload (RedLineStealer)", "value": "c195aed67a5d15ccaad95be9b6c4eb31c7662ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648049, "uuid": "7c253778-326e-437a-bb1b-0ce3edc9fbc6", "comment": "Malware payload (RedLineStealer)", "value": "aaebef5d107a7edbbba970ce922fb4afd7d6e44f32dedc07b3c873299c5643f20092cf0aa81f05e1ea2285c97b55c726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648049, "uuid": "fd9649a4-ae73-43ce-8d08-266b0ff467ca", "value": "T106060111605C8E2FE13979B977EC4457F92CA4B4DB090D4522C22DEFD49EE83F2A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648049, "uuid": "50cbdea6-08ad-40bf-8d64-06ffce26e917", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648049, "uuid": "7b462794-39a4-47df-9635-e349cb4fbb9f", "value": "49152:eiGFL5UbuCUmq/DDVOVhbN5T5PwoBmHQmU2rTYDmtPF1+yvz8pFWrn6JxSOEJFH2:uyoGhmHID+PZXFBhOvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648049, "uuid": "53e8ec33-6ae5-4fd8-971b-cc91f45455ee", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648049, "uuid": "e0f601b7-fff6-4661-bec4-e28594604ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648049, "uuid": "d9e427c6-8722-4f7d-a628-8a9200172c65", "value": "aa46c78978d744edae1170acdc7a518ff42bb02eba66a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be4829a-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688636575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636575, "uuid": "82df64e1-06cd-41cf-b85f-d5f39d861357", "comment": "Malware payload (AgentTesla)", "value": "14252cb2350e20c3654e7f9f314ee631", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636575, "uuid": "62dffd71-2fa5-4ac8-87be-a0f461acbd71", "comment": "Malware payload (AgentTesla)", "value": "aa4d7c8a7bd3a5690b8b2dc1ed9fc3bfd40981671b3642625fa3c7589bf459ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636575, "uuid": "0f2367f3-9e72-4e74-9d8e-f578d155db67", "comment": "Malware payload (AgentTesla)", "value": "fb83b349b7132496493e261c33a0d82aa9a0d54f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636575, "uuid": "454de412-d451-40dd-9b50-e3881f630e0a", "comment": "Malware payload (AgentTesla)", "value": "3a664067fcf9761727ad25ce8b64c4455607f151e3240f1ed3c38b6e0168888d5becd6b1a4a5130e9b1b6fdd85709673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636575, "uuid": "c32c950e-3999-4d3e-b3b6-43a1e55757ee", "value": "T16884129859F1C0ABD43309B15E3B1FB9FCBDE62A89B6A04B17546B1738F2062474E770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636575, "uuid": "737feb10-1068-4ea7-8c03-63a750795101", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636575, "uuid": "c99de5d1-b7cf-4530-84e7-fff59d1c4d7e", "value": "6144:PYa6gNvFUZMVtAlLHEjn5UDg7Q9Qrlia6MYbpupWzYUewKhSbfQlin6Wu5Vx:PYuNvFBVKZHzOlOfbpVDqQbfQwn6J5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636575, "uuid": "4fe2d4c6-172f-4631-890a-31bc53117c5f", "value": 383256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636575, "uuid": "1e39c623-a317-4abb-ac5d-c40698b7f136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636575, "uuid": "c521f4af-fc4d-49b7-81cf-e5ed09132ebb", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5af7f9a-1c3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688675327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688675327, "uuid": "7bee97ab-84f5-41fa-ad71-7d333ba84f25", "comment": "Malware payload", "value": "08f9795cfd17fcf4d68b2b850c72d1d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688675327, "uuid": "9679683b-179d-4460-bd20-037f50c1d202", "comment": "Malware payload", "value": "aaf3435f348a57be68f3fc95650c704d97684f1b664dac9194aa7738203f8ea9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688675327, "uuid": "897943dc-8315-40a4-b3f4-29fab10eb0ae", "comment": "Malware payload", "value": "f6848b00a29f97c75f1ddce81c16fe93e27e87ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688675327, "uuid": "8c17cd6d-cbb6-4b42-986f-9a687988deb5", "comment": "Malware payload", "value": "ef8cd3ea6240979c41c2282b8f0271f7fcc2a85e07576bca3a87cf59a4f2e820945d29e1d3be914b0ff2a61f04e64fb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688675327, "uuid": "3d2a2883-9bc4-41e0-bec2-3e3d595a9f7e", "value": "T16E448C5074C0C472D57A2C345634D6B10EBEB8311EA0DA8FABD4197A8F366C2E625B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688675327, "uuid": "b394a150-5102-4fe5-9aa9-930722a7554e", "value": "14eb01c0e22ebf11683c275de94f4a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688675327, "uuid": "a84fc688-f99c-44ff-9989-510cc097d839", "value": "6144:1cMqpeIGoxQzaUEk6NtsnQhbqYUdmbJIUYgcJ7ulblQwrviw:1WpeKxQzaUEkitsQhmYUdmLY3ulbRiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688675327, "uuid": "f986ad75-8588-499b-9c67-923db19ca5b3", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688675327, "uuid": "f53aac81-8452-4cdf-bc0b-242a218b1e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688675327, "uuid": "19c7d373-c458-443f-9b49-81790c2b45ad", "value": "SecuriteInfo.com.Variant.Zusy.475489.11967.27995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91241635-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623296, "uuid": "9eb74b39-b6de-4883-8680-2a0919d25214", "comment": "Malware payload (Amadey)", "value": "8a969ab0684c24c0b68010e235bd5348", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623296, "uuid": "e168aa02-e436-49ef-abc9-057050e04925", "comment": "Malware payload (Amadey)", "value": "ab29159af214bd4861f68dd80dd03dec86d9fed15c628d7a641925f9a0fec452", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623296, "uuid": "cc186f70-c673-4bd7-8561-57d1540c32ad", "comment": "Malware payload (Amadey)", "value": "c41b265db88bf13e345c18b9badb2ed13448a504", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623296, "uuid": "826d1551-8f9a-4481-b93e-8f1eda16ee8a", "comment": "Malware payload (Amadey)", "value": "71c9050acca419ce64ddaed9a38040fdb3438eec2948a5301d4acf9d571b05b2fe8122844270273cc9dfc120fa04e575", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623296, "uuid": "0abca134-aaf4-4f78-a99e-e93bd3835c5a", "value": "T185061111608D4E2FE43979B977EC5517F86C90B8DB090D8522C62CEFD98ED83F2A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623296, "uuid": "e2e53748-4628-4f56-adaf-6106913b9eb2", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623296, "uuid": "4c358ab6-c4dd-4758-8cb5-2231354e6dc8", "value": "49152:FWBgTOliz6p1i9gdNN4j+TtDx/nsCLHn2wFpQ1zInlB2X3vArDzZJCAny/zaCzFs:khfjeoAHoYLzVLG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623296, "uuid": "c7349541-ca5d-4e00-9728-37c0a15603c6", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623296, "uuid": "b0eae1ad-7f44-4aeb-839c-3b04c5921ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623296, "uuid": "6635216d-065d-4e4b-8174-a63d8e41151d", "value": "8a969ab0684c24c0b68010e235bd5348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7281d-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620440, "uuid": "987d81ac-6cfa-41e2-92e4-8c90f315f5fc", "comment": "Malware payload (Mirai)", "value": "b0e258d9195005d7933ba4fc450c645f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620440, "uuid": "b6048062-99ec-4a71-82a5-e087e2789023", "comment": "Malware payload (Mirai)", "value": "ab9c02bb562e0f0bfc0351c62b535eaa9a8368b03a268d6fbd282bf9310570c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620440, "uuid": "d471498f-c0e9-41e4-815a-3584bac73acc", "comment": "Malware payload (Mirai)", "value": "e3c9f44af90f9a19e3820567b91a69cbde313c3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620440, "uuid": "95b5b7eb-fe45-43ab-b537-4ff0776533ac", "comment": "Malware payload (Mirai)", "value": "32c09568ea07efb63af41fd2921adbe95517e05f80f448db03835eba0bf3ed04f7228b5d95e2060a3e77eaeea3684bb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620440, "uuid": "a0ffb1f3-9653-4ffb-b14e-b380e0abca20", "value": "T1A63494216866E213C0E7FFB9FFE67686631DF2424F866303A5A4105D1EF595D282F8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620440, "uuid": "4c329c58-27e2-4d11-8cb4-b2dbad5d2e7e", "value": "6144:fWnErSIViM4keLOaDkd8aJEQvPCeo3bXy:fEM4kEA8aJE2PCeo37y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620440, "uuid": "56500454-cae2-4afc-824d-5016e58c8ef1", "value": 237989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620440, "uuid": "6030f704-53fb-457b-8b63-ccb568a0e9dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620440, "uuid": "02b1ca92-1ec6-4fdf-afc1-8ae706089b0f", "value": "b0e258d9195005d7933ba4fc450c645f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e5c8f6-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624400, "uuid": "e22c6376-2de1-43c3-9175-0576c95b003e", "comment": "Malware payload (AgentTesla)", "value": "d92574e49d6bef6503038611fe5cfb31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624400, "uuid": "60e1c375-72a5-4f29-afe2-7cd03ddc6390", "comment": "Malware payload (AgentTesla)", "value": "abe4e9779d399b488d7faf17febacdec241eda6ea49ee4f2c2f707876f4737d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624400, "uuid": "886fe02f-b546-4304-ab39-c53702906bff", "comment": "Malware payload (AgentTesla)", "value": "8aa766c46820c6c6b9607433f019d4a003b4764e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624400, "uuid": "61a62773-0e44-4335-90b8-ccbb7ded9ce0", "comment": "Malware payload (AgentTesla)", "value": "0525c9fee3a17909206843f576ff1c794ccb3c9f328ee9e9a5480fda6f8d9c5a7e02d273f1b076d76af19ae51a3900d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624400, "uuid": "1ea05e2a-1f02-4eeb-969c-332e51514ff1", "value": "T18F15953F24CAAD27D239E2967430EA5DF212B3C637674B4AF7C21661843236937E119D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624400, "uuid": "083bf393-7d03-473d-b7a8-f8b948c9d0af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624400, "uuid": "b7234fd6-3634-48f7-beb1-46825aae3b39", "value": "12288:lqCV7LnM2Nt53sKrAGwex46rZKLulEZMIG/9KTEZ5:lJsGwn612wEZMIG/9KwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624400, "uuid": "f82a443d-2a95-44bc-9c31-b7802b3c39d1", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624400, "uuid": "30fc4695-2ffd-4041-b941-8d7c09324295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624400, "uuid": "f2672689-b486-4199-b8cd-b302a3f16bac", "value": "UPSCBJ1901700131.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9eb3c5-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688652337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652337, "uuid": "bb7e264f-56aa-43fb-b1a6-a492c57889d1", "comment": "Malware payload (AsyncRAT)", "value": "1bab753dc5456a59934eb21f4de89a4f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652337, "uuid": "913229be-46fa-4289-b8c3-3c5be15c24d6", "comment": "Malware payload (AsyncRAT)", "value": "abf4d22525f5eda1938e398e4fd1c266a350d8d5b7c19f9a72e2291b1966d946", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652337, "uuid": "eb5a38b1-52a2-4a84-83c6-a39c9790cae5", "comment": "Malware payload (AsyncRAT)", "value": "3c42dee0f89c0f9e42f3bdb9209a90dddfe27e86", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652337, "uuid": "c812bf5b-a9e8-4350-b17f-8212496b24e9", "comment": "Malware payload (AsyncRAT)", "value": "1cedea1029357718f0226068e3172473072f64679b05144aa8d98840e36059c1a10c80ea5a941a6770d73bde1a088d25", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652337, "uuid": "7dbc9dfe-e873-4545-9471-de0a313a816d", "value": "T14636E743F49F0A9ED4A237794C4B2325623CFC26DAA67A5F5716D3243CA39C46B19F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652337, "uuid": "48e405ad-5aea-44cc-a22c-0190719665df", "value": "77b15ecd8e584dc77fc9e421a3ea6e0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652337, "uuid": "8b8fa5e9-372f-4f90-92eb-538e42eaa681", "value": "49152:G9TUg5Hd4/py9PH4lDIBMT1gP8Gos9JC//6u+RUl8Pud+9kY+BihNnymbtabi3TU:wFYlwMuAbE3TnidZ91hhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652337, "uuid": "92a60c37-3be6-4bd2-a632-ff977f5ca4bc", "value": 4913807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652337, "uuid": "3e0abec1-3b6d-43b0-8027-0dc3643be53f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652337, "uuid": "492dac35-5753-4581-8d0c-b6c144ff5383", "value": "7B4B83E4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7af17a3-1bde-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688635414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635414, "uuid": "5688ebec-37b3-49ec-b5b5-63207a7ebe9c", "comment": "Malware payload (AgentTesla)", "value": "8e418218ac2b17ebc8f96a9f245c2850", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635414, "uuid": "4b7663e1-6c27-4074-abd3-915b5ed64791", "comment": "Malware payload (AgentTesla)", "value": "ac7241d053bf5ff507bdca963f36e762237aa8489970f7d04792bb8170e172ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635414, "uuid": "df2b3725-34eb-46a5-a991-0c55a67700e9", "comment": "Malware payload (AgentTesla)", "value": "305a0a5079777f42031a932045ddde63aa5fd5d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635414, "uuid": "43bac25f-b18e-4f1f-8394-a17460df89d0", "comment": "Malware payload (AgentTesla)", "value": "c4705eceee92db5503f71b8af3da43808cd747acbbbfab589247711502cfba46af305db1e4590a6a9fdf7c52412129f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635414, "uuid": "04ebc06b-2ed0-4469-84ea-6352f8e002b8", "value": "T16905653F14CAAD27D239E2967434EA5DF252B7C637A74B4AF7C256A1843232933D108D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635414, "uuid": "a540ad0a-97da-491a-8f49-7149e7913638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635414, "uuid": "e02dc7fd-d92d-4bf6-b8ec-15737a192b11", "value": "12288:c77LnM2Nt53sKrjeGweE8KqHM+RAmc62n3pW6DlCmCLRAtIrdRrfZE+Yeso6CqRK:keGwrfq3R32nU67UR4IeNdCqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688635414, "uuid": "84517b4e-cf3a-411a-8f49-9b250d289479", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688635414, "uuid": "4ee65507-e0cb-4b18-826e-ec4eded40ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635414, "uuid": "c94dcd43-78ce-42cb-800b-8ce907dea730", "value": "ar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396dd645-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622720, "uuid": "0770cd1c-b1b1-4d20-b4e2-50c3f56dfbc7", "comment": "Malware payload (Amadey)", "value": "70b3117163ddcd3db18aea2befa78f3a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622720, "uuid": "ae1b8aeb-a5f7-49dc-bf21-2d325e3ff6bd", "comment": "Malware payload (Amadey)", "value": "acc93a63162466ec646d8cb0ebb9a86134c1746e667411493322eea4149ac219", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622720, "uuid": "5237a9f9-b19a-467e-abc9-34caff4f900e", "comment": "Malware payload (Amadey)", "value": "b0942d50d24fcfce8b18f7bf84524e587c5f7d16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622720, "uuid": "25d400d5-a4e2-404e-a175-c53a7c42d7a5", "comment": "Malware payload (Amadey)", "value": "61318a85ac9c45dbaf5377bc7cc0fbd1e78e53fdd23134e21ebe96cefb855b65f6db8e15c539e831d5459aada3cb8b8a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622720, "uuid": "42162f0c-720e-4629-8a38-2a6e77f8490c", "value": "T1DB060101658D9E6FE03A357677DC4957F96C88B4DB081C4622D22DEFC48DE83F2A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622720, "uuid": "83e38a86-d844-4f23-a64c-a689f822b198", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622720, "uuid": "3a40549c-2d3f-476e-99e4-47469b63ec98", "value": "49152:3qTQMnjnimsOpqnbPiHcKKoB42qlYWS/stirLMriXmJjjs+T8c53RZqLR1ZGDBEX:pGhGLwX2FLRGDfb7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622720, "uuid": "1c768cfe-d3bc-483a-9835-cc2c26a09804", "value": 3759432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622720, "uuid": "540604fb-b89b-4186-a25c-b4d3131da257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622720, "uuid": "4a998aa6-b012-498d-a01d-95a47db8594a", "value": "70b3117163ddcd3db18aea2befa78f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9207b6-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648303, "uuid": "edaf7493-f4d3-4bef-a9ef-eba7cd44a909", "comment": "Malware payload", "value": "0dc41a1ef0581137b6aac0601c0934fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648303, "uuid": "3484486e-f418-43ce-8ed2-c54b8cea6c1a", "comment": "Malware payload", "value": "ad7296bddfdea74b0552d8db540d33cbddea413e41872ac92ef2d72cc4ff5987", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648303, "uuid": "9c99ce9a-d685-4e0c-9018-3b67b9ac734f", "comment": "Malware payload", "value": "297b9e50f8881b4ebec7b671b58064cf76155dcf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648303, "uuid": "f83834e0-9306-4c8e-bf6e-2afc3a7bb07c", "comment": "Malware payload", "value": "1daa6688eb5496419fc5b81f587d6d03ed5b5b02719fdb48fbabdb22a6185f8a856b9e4e01841001a3f9cea8615870d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648303, "uuid": "cab2ef15-9583-4183-bd6d-6c5f323c55ef", "value": "T1EDA319C76A537DBFC5C7EBF4A7EAE12044E3B8351B62124473D8EDA14A1EDD82918248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648303, "uuid": "cb3349f5-aaab-4424-84d9-9712c487e2e4", "value": "3072:Bgbf1BskqPX9FTXVe0yaFqq1qq1bq2qqqqqqqqqqqqqWqRqSMqMue9aGmkbGLIGt:BYfbBqxV8YmkbGLjvjSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648303, "uuid": "57398e84-efef-4757-b671-110ec8292306", "value": 101777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648303, "uuid": "cb83ebc4-f1e2-48d7-a772-40fa01a28779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648303, "uuid": "b277bbd9-ec36-438e-886b-1214a2696ba1", "value": "x86-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccba625-1c11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688657112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657112, "uuid": "8e454282-c39f-4a80-b359-a958dc064ae9", "comment": "Malware payload (AveMariaRAT)", "value": "247054964499405f52185f24b4d011b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657112, "uuid": "f564cd58-aa22-47fb-810e-05729be78be7", "comment": "Malware payload (AveMariaRAT)", "value": "ae8635ca2e1ddd94610dfeb8d18ce3e037e890927cb1ba3944bfe4ff70f4ce17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657112, "uuid": "8263c68f-b19a-42c9-abe3-eb78aaac94df", "comment": "Malware payload (AveMariaRAT)", "value": "a072c1197d90b8113fd0a85bddae0f37fa4d6550", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657112, "uuid": "0c71c93a-5bf2-40f1-b1c6-c3d17ecb12cd", "comment": "Malware payload (AveMariaRAT)", "value": "8d02862949f557161bb732cbacae3ad9f86a62145069ae858772691ba7202a3550223db8c8a25cb0b1737e28f98bdb66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657112, "uuid": "078531fa-bdf3-4452-8646-dd9ee2cc9868", "value": "T1745402543B90D812D6B207311DB9D2FE6EE5BD22ED9569033BC03F9F78726918A0E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657112, "uuid": "8d1f1d28-9dcc-48ef-873b-7c1add3a8132", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657112, "uuid": "005c9c6b-4e85-4fb7-b578-05de2c43f597", "value": "6144:AYa6/09Vj/dY0A4fPsfGafr4SM7rshlsdu3F0a6Y98E:AYxKxW0q+dnM2w2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688657112, "uuid": "f6b1492d-891c-4021-bf4f-c6dce4687de6", "value": 291061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688657112, "uuid": "085df2ae-1104-46b7-b94b-8e9a3dd13566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657112, "uuid": "d9009038-6f8d-4148-880d-49c8fb6dc645", "value": "247054964499405f52185f24b4d011b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f9d1b9-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623358, "uuid": "612c3c90-ddad-43ce-b331-416662c0ca0e", "comment": "Malware payload (RedLineStealer)", "value": "93437843ba53d6d195412892758c73d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623358, "uuid": "cf250909-4d37-475f-a00c-2cb64ea02281", "comment": "Malware payload (RedLineStealer)", "value": "aea91f771903462c6a8fe0669d1d2e2bdc6bd390700168647ee5fe5e88f842a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623358, "uuid": "5ec43bbe-a2b6-4405-b013-9a18dc653027", "comment": "Malware payload (RedLineStealer)", "value": "def71b5baf47d51f59d11f7dd5c0536fc50bf2d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623358, "uuid": "2e425464-ea80-4766-af72-ae905795df37", "comment": "Malware payload (RedLineStealer)", "value": "1fb24413c2da6380ab8bedf9c1ffaad8590866940a319e71d0082b2e871f1f083ec1552484a174c01da043bc460fc9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623358, "uuid": "e1488ccc-d989-47ce-a643-f866b0faed67", "value": "T1F4160158616D4DAFC830367527DC1583F9ACA875A71F0E0126C2EDEFD8ACC81F6919AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623358, "uuid": "cca0bc26-92c0-45e8-bbc8-b04217130bc7", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623358, "uuid": "efda0909-f9d9-477c-a0bf-e668bdbb6a28", "value": "49152:3+IHujuazcTy7kd7PMB/70bx46n8Jr6jN232wo8ZkfLqmQUXjoEn8lcZmLyidBgK:uxTqJWD2Vxju0DidICjl4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623358, "uuid": "6b56712e-edb7-4c2a-93fc-2739edb34323", "value": 4071240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623358, "uuid": "2a9f6594-7a97-4784-93f7-cd52b53b74be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623358, "uuid": "f37b192a-ebef-4e16-8309-27cbe7ef0990", "value": "93437843ba53d6d195412892758c73d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6af79b0-1c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688655572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655572, "uuid": "ab11cf27-f07c-4efc-a121-7f16720c14ea", "comment": "Malware payload (Amadey)", "value": "4396748c1e8eb00cb06e2a26d1e9396c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655572, "uuid": "7e8bd418-b0a1-4969-b56a-8c846df0f38b", "comment": "Malware payload (Amadey)", "value": "aec700c7e4eacf5a85c25132ba01a34b38489c0fcbc713e647ac4ee7b594ae87", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655572, "uuid": "622371bb-1b13-4c6b-87db-ebbd9b4ca450", "comment": "Malware payload (Amadey)", "value": "edd2d8ff8ff4da989b5c490419c5019f18673574", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655572, "uuid": "502df41f-4b90-40b1-9d5b-d6eff13d4f70", "comment": "Malware payload (Amadey)", "value": "4c2340f80610b0b7272d444d58d463bca4fa5a6cfafa3ac3ffe8b90de606448600ec0bf675dd1fb96669f1414668ee88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655572, "uuid": "c7037fdb-a113-4a05-8624-a27e6d153ebd", "value": "T15BB402333D209963F099D9319A7752C1FFA9E7A93AB981C7751CE0385B632C1D738229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655572, "uuid": "0a50f615-7d4c-4326-a6f5-e0d5b70ef9c9", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655572, "uuid": "8e9829b4-d07a-48af-9c92-9873c13892a6", "value": "12288:QI+aBfvtaRdnQgnAAEFCXrzYXNfUjy9O/TCG:QI+kvt82gnbEF8PY9fUjtuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655572, "uuid": "8f9db860-3e80-4dac-b395-19d061e43645", "value": 513864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655572, "uuid": "f0769351-3f2f-4973-87e5-cfa22b149899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655572, "uuid": "691a6276-8a1b-4b6c-8694-87667f0d7646", "value": "4396748c1e8eb00cb06e2a26d1e9396c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5229ee-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688647526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647526, "uuid": "25e7f8bc-79a0-43aa-bc7f-c6adc163e49d", "comment": "Malware payload (AgentTesla)", "value": "2e7b6983b3f62c143462140fd50bbf45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647526, "uuid": "1d2688e7-1788-4f3c-be40-b03a82e2689a", "comment": "Malware payload (AgentTesla)", "value": "afd6fe04ebb90493a7a100c61428525c755575dac5f2cd377c549b19847fe7b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647526, "uuid": "dc70e347-d6f5-4192-b361-741c80a2f826", "comment": "Malware payload (AgentTesla)", "value": "a056695079c1992130d5fd2c4578ecbaf691af1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647526, "uuid": "86a4d69d-464d-41c2-9759-1eed978cfecb", "comment": "Malware payload (AgentTesla)", "value": "2cefcf40733ba4b9287c6469a7c6e01efabee11142dbeb8189fc8127f5156023f0f8cd5bc116ac5e8839094340766dc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647526, "uuid": "48912dc9-0a27-4e5f-90cb-cfc91dfeed8e", "value": "T157067B43B64785E1D64A9BBAC19A782403B0F48367D3F919368E33184E4F7B62B49D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647526, "uuid": "51666231-72e3-4d2d-994e-793cfd65e82a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647526, "uuid": "21b1360b-b301-417b-baae-9a92f1571252", "value": "24576:9a08wUSfwhJR0BsD0Qk7bfVLr73C2AGlmG3UK8iyNeawdOo3VZj2n8BFROscNQOX:9aKUqzBI0aGlmG3t8iyNeawdOIID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647526, "uuid": "8ded71f5-54a9-40fd-9b42-0507acd95874", "value": 3795968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647526, "uuid": "4198d033-252e-4dbd-a594-fc063ecd8de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647526, "uuid": "bbad0492-018e-4755-b285-f09a3b156053", "value": "PTT-20230706-WA00138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0ea670-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688645679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645679, "uuid": "7581f288-e3e5-40b3-a7b7-19089af89096", "comment": "Malware payload (RedLineStealer)", "value": "2e6d49ceb7f0c23faf8715fb342ec614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645679, "uuid": "bc3de2b5-fcf4-4964-985b-40e809f8138e", "comment": "Malware payload (RedLineStealer)", "value": "b00fb7f1b8de6fce87397f9b6a09bcb33ca82dc41a78a7bc59d9a9e0758026e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645679, "uuid": "4008453f-fda4-47ee-9b28-9664394efd93", "comment": "Malware payload (RedLineStealer)", "value": "8e47e72271ad78e4f6028b6235ef7f7367f392f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645679, "uuid": "d66c303f-3a41-4f81-8aa7-d9213438649c", "comment": "Malware payload (RedLineStealer)", "value": "b621a4ff49e82fc195ff48c669b850d313b88f8deb86ac66459a8427203f64ee5845839978556b8b993354a159a79b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645679, "uuid": "f5938a9a-dcea-4ba1-b5ce-7e3f5c64061f", "value": "T1521512217181C676E4A7117045EACA36AE3975720764D1D7F39C1BB6AF213E2B33A2CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645679, "uuid": "8f4430b9-94ae-4cbf-9b00-5af39bd9f076", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645679, "uuid": "19bd2439-8653-43f3-a5bb-313dec467807", "value": "24576:8k70TrcZVt+v6xNik4p2NE/bgJRevFHh9Gp9P9fhvAM:8kQTADAq94pv8J+4pLfhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645679, "uuid": "6f782100-2d27-42fc-9f27-86531de801c7", "value": 920128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645679, "uuid": "73f11c4f-c36b-4fbf-9d55-c1ad3953d06b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645679, "uuid": "904dccda-a332-4e43-b8c6-c0799737d413", "value": "b00fb7f1b8de6fce87397f9b6a09bcb33ca82dc41a78a7bc59d9a9e0758026e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67e00f6-1c02-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688650820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650820, "uuid": "a86b7c38-e86c-42a5-83ba-1e1b17b7c9d7", "comment": "Malware payload (AgentTesla)", "value": "758f5c1f99738cc2a59a385ce63e9a21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650820, "uuid": "2913a1d1-9ea6-4e98-a464-2f44c0dc8f30", "comment": "Malware payload (AgentTesla)", "value": "b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650820, "uuid": "fde117f4-7204-44ef-a1d5-8ef88cd90dda", "comment": "Malware payload (AgentTesla)", "value": "22c825fcdc8c78a5f4339ae98754a423ba67a2a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650820, "uuid": "bb6c51d0-9dd3-4dcd-826e-c8285e518dec", "comment": "Malware payload (AgentTesla)", "value": "e34942303e918d132230d7668e81eb2167ba92020e151acc0ebdd663c217a6b90bd5aa670cec27347e3b9ce9d0967f8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650820, "uuid": "e16cf04e-700e-432a-8445-73afa63d57d0", "value": "T16584233427D2E02BEBD65B721C721595A9F8E82769B08F0B67803BCCB6631C2540F776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650820, "uuid": "8a51bf64-b242-4f09-8849-c8076b909448", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650820, "uuid": "56b237fb-7d93-47e0-9738-95c26fc94dca", "value": "6144:/Ya65Gb4fu5qu5/9vkkq4Bd1QO8E2qtDAQMynxwAC+wNkm3iiI9kcZXUgApaYIno:/YDGbgu5qu5/9UWUO8EfkQBxK+weiWRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650820, "uuid": "5c3ae9ec-c173-49b3-ad84-234dea2ed6f6", "value": 381694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650820, "uuid": "939ec239-4945-4d42-b030-25ded72443a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650820, "uuid": "fb5f2690-4925-40a3-ac1f-a40d21ec0e8b", "value": "Remittance slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95d88d5-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688652113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "bebb24fd-92f1-495e-8d6a-1036ecb13218", "comment": "Malware payload", "value": "acc451f7b0de769d8e884c81b522b3ff", "object_relation": "md5", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "8f6d8bcc-5db1-43f4-9876-846c5f6e01e0", "comment": "Malware payload", "value": "b08740de7bd8d6805ca2c3c8be1db69fbb7aa9bd6aad1c0582881e4196574aa9", "object_relation": "sha256", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "8b536250-4790-4670-be1e-d4702d28f58f", "comment": "Malware payload", "value": "db472e86c3c53ebbf8d74d049fbd8b5b4c8d7261", "object_relation": "sha1", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652113, "uuid": "cbf6cae0-d49e-4e38-a0b1-80d60c77a1af", "comment": "Malware payload", "value": "1e162ea3738bdab83d109f959ccbd03b687842fc121ff32fa837ffd013719619b2a258fba966b24342ce70089cccc466", "object_relation": "sha3-384", "Tag": [ { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "41c7c71b-09a4-4882-a39d-207e0cadfd6a", "value": "T1F9E533941499AE4DA13A393EF5953FC1A734987B3ECE9963C8F26E92423F2B48404953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "24f74c61-3e64-4d6e-8754-11e709b0fe0e", "value": "49152:Ppoqy+V5dFzMyrC5spMND+MljwVvcf/3THxHWcH1UvzS3ikVPL4eGfbS+4RrPE:PyqfH/lSsqaKq03THxNKzdkVPE2dVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652113, "uuid": "2fac4454-a1aa-4b47-aa17-755e07227106", "value": 3038712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652113, "uuid": "7cffc270-7da6-4338-9db0-08834a2016f6", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652113, "uuid": "0187e844-1ece-48eb-8c18-3b207a2b3a9d", "value": "Pearl Land Launcher.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cc4ad3-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676995, "uuid": "ae75dddb-7de4-4fa4-8566-e783a5d1f21b", "comment": "Malware payload (Mirai)", "value": "ff9aea05e140a3c3dee3712d40c8c9e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676995, "uuid": "b1f56ecb-8f80-4611-873a-4dc11855e39c", "comment": "Malware payload (Mirai)", "value": "b146924f7a47ddf4140c77df7e61f0c619dc9675b5089aa5464dafec1c131808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676995, "uuid": "489ab8a8-9650-4713-a078-406aa8370262", "comment": "Malware payload (Mirai)", "value": "b121faf1452f43d779f88bfcce8740a9827b452f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676995, "uuid": "53395f02-6467-4d54-b30c-3ae7cba719f9", "comment": "Malware payload (Mirai)", "value": "d77bcf170a6c0071f88c7c83a80b90489372b9fc1dbe308758e849cf8bc6646db22396e8371467ab045c1bffa45eafde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676995, "uuid": "ad60f9f7-a6f5-4661-8f38-78f8b2270d8a", "value": "T1C6C2E030E681CD1DCBFFAE715C40F1D52BF20ADD31A2BD8211E76A365E26643A414AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676995, "uuid": "64e079ab-47f0-4558-9041-b370dde77f47", "value": "768:2Gpu+dLCvMRLPJNT9IU4vFlr1oclxsBk4uVcqgw09f:2GpuSVDeJ91HwBk4u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676995, "uuid": "4cfe9fe4-469c-4d4a-8091-60cb1a79464c", "value": 27408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676995, "uuid": "2eb39d43-5511-4531-9f0c-3de95fd9cc42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676995, "uuid": "281f2c14-ab86-4f0c-8b99-a32ce00580c8", "value": "ff9aea05e140a3c3dee3712d40c8c9e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c613cf-1bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688649094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649094, "uuid": "766f317e-6f2a-45f6-89ed-4bed6ef3178d", "comment": "Malware payload (AgentTesla)", "value": "4cef89c53899f9fe141b3b9218ed51d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649094, "uuid": "c98cf9c8-b157-469b-91f2-941793478a11", "comment": "Malware payload (AgentTesla)", "value": "b17c04d1848850e6b4db0e42cead0fc2489ad64f4d9345632df03b0a176578e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649094, "uuid": "f1c97d71-57d3-4a41-bec8-771fa7dc0bec", "comment": "Malware payload (AgentTesla)", "value": "5f08434517c99c90165338b15af8ebbe73d33c69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649094, "uuid": "fce41aeb-ed2a-4479-bcf6-9b097089b030", "comment": "Malware payload (AgentTesla)", "value": "0ef32cbea4c1857e57cb05d0bd672ae5a9f633e18ecabe0e07eb518bb892e7c38b0f128210c01eddffa17630f9536b62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649094, "uuid": "24d42b48-235e-4859-b932-fff47083097b", "value": "T13405F12833AA9B5EC4B67BFC4D125634C3F96D923073E34A0ED374EAAD35B144891693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649094, "uuid": "b9be2036-894b-4d67-affc-e5c3d15beb95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649094, "uuid": "8f45f3e3-738d-4ed9-ae5f-33c15cdc59f7", "value": "24576:8p1mOV/NOajA29DlAJzujomAyAHrtiQaRJ:8pUOV/NOaB9DAmomNAHrtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649094, "uuid": "e5e0c9f5-cf37-412b-8412-96efa2a88653", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649094, "uuid": "11b1fa17-76e1-4709-bf27-ca160ea90df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649094, "uuid": "8710d9f0-a9ca-43d0-b590-cb1fc27bf4a1", "value": "b17c04d1848850e6b4db0e42cead0fc2489ad64f4d9345632df03b0a176578e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e898534b-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688654367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654367, "uuid": "1aa399a8-1ec2-4b9f-a49c-6d47c768c8ca", "comment": "Malware payload (Formbook)", "value": "995af99408580d7fc0646715b7415b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654367, "uuid": "b2a0b6e9-19d7-4bee-9068-a5954eb7e64c", "comment": "Malware payload (Formbook)", "value": "b1c7d85b71168a227630f11b74f10aead1d659a5ac9353bbd2a64f89a4f09561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654367, "uuid": "f87ba882-5cc5-49f2-9de3-31805995a835", "comment": "Malware payload (Formbook)", "value": "9bdfce77846bfa373a88373b009df76d1bae191e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654367, "uuid": "a5b09219-16ff-40ab-b819-38e81341cdf1", "comment": "Malware payload (Formbook)", "value": "1f92e0d6d23f7dd543520929945eef39637fdbceeb2b4261e662d821692b476ea6cef1474e9450bc097e8507c6b1ef1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654367, "uuid": "285a412c-b06d-4f71-b7e4-1ce72f118684", "value": "T1C47423A096F4E0A7E4E357322CB778A95FE1D83538F8450A27645B9EF52F740A10D3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654367, "uuid": "a05c7f02-531f-45cb-948b-aae1a0fcf47d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654367, "uuid": "e76d99a6-6783-4aa4-9174-a37aef27ff6b", "value": "6144:/Ya60G4z100ZEfEWCTCC6aXpJoubyFp/Zm4uhLZDGNZEQ:/Y6G4zlZEfEZC7gJoubim4u5A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654367, "uuid": "975280d2-a2c2-4644-b6d7-c3812bfdd16f", "value": 370001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654367, "uuid": "31733a19-8483-4ed8-859f-5456ff66a699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654367, "uuid": "c99efcae-3c12-4b05-b2b8-e104d51cc1a8", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22775.910.6254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37baf0df-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1688652352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652352, "uuid": "6aca1ee9-1046-487c-9496-b30dc0e80461", "comment": "Malware payload (CobaltStrike)", "value": "695caae62d5a1a9bdc1e790ce3bc61ee", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652352, "uuid": "c8f9421e-447f-4e42-8068-ebf57a00949e", "comment": "Malware payload (CobaltStrike)", "value": "b225c6740e94211a16770e0fd1f0118b78a99f428bb7e7d4943b3e290c30b985", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652352, "uuid": "c8b5d649-2b63-47b7-9af8-bd26e09f775b", "comment": "Malware payload (CobaltStrike)", "value": "0f00988c5f9335dab5bc11bd51493dec7a132800", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652352, "uuid": "35594acd-d9c4-474e-9930-0c5199f45e6e", "comment": "Malware payload (CobaltStrike)", "value": "4cb42ec4cf9e64442f68bb853e2b019c84b44eeb19c0eccc832240de419a9d253ff791e47ed11362a02ce7c6fe0a4b96", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652352, "uuid": "0c4343a2-84eb-479d-b464-5b6710c46d60", "value": "T1BB858EBD979418E8CE4A95BAA4747D9071AA746306C7D28D53ADD6F31F0F23ADE08F00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652352, "uuid": "d4655d71-c336-4c40-969e-6c246f881f1d", "value": "150594ae68d49d802470cde1805e701a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652352, "uuid": "fc6d8b2a-4246-4da6-97aa-9c4bf82d881f", "value": "24576:v29Hyaz8LmHcCM9MBVGdsdq61rbTi4Ya:vQdMsddZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652352, "uuid": "b2e0e961-d29b-401a-9cb8-fa1f38a94e31", "value": 1838080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652352, "uuid": "1d4b3528-f921-4f7a-a7ea-e8401353479d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652352, "uuid": "4eb359b7-c624-46cc-920a-bb7546a0227d", "value": "6684B744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417d9dfc-1be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688639054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639054, "uuid": "814acedc-a3ee-48e0-8207-a58d162527ec", "comment": "Malware payload (Amadey)", "value": "9d933713ad92f28d144b0b93b81d8d8c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639054, "uuid": "76f3e4ff-450a-43aa-8d5b-84b0d64f7008", "comment": "Malware payload (Amadey)", "value": "b3adcbe386d1fe211f6cf5bcab2637bdcb5ce23cc477c5313278b3b17d74ed5a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639054, "uuid": "359e0719-089f-4eae-a25c-02c2be7d19fc", "comment": "Malware payload (Amadey)", "value": "1e26d5e737a07827c9eefa2c8bf986644dbd29e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639054, "uuid": "1efdf682-ce5b-48a4-ab19-b234205bdbd3", "comment": "Malware payload (Amadey)", "value": "ddb3fabdbcb929cdda6acc0f5db3ac0568e15c5b8049c85e1a45eadb4ce8354fcf01238f4991f9bfd64f0e5ce6a269d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639054, "uuid": "41b91db1-041b-4fd2-aeac-c7d34fec3ed5", "value": "T113060111654C5E6FE53A397677DC0827F96CA4B4DB090D4522C22CEFC49CE83F6A6A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639054, "uuid": "7241b197-892d-411d-81c6-91383e9c23dc", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639054, "uuid": "70da73a7-744b-4c03-ab75-12f5fc350718", "value": "49152:TDw0ePIERpD92Qr0NP8IkKCr6U/PU+xgulHmkfddR2sNhf45lAxXARbn9TePVWYl:nNpviqgZalAx2ByvrhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639054, "uuid": "c6eeb33a-524e-4782-93d5-520527fbfb87", "value": 3763016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639054, "uuid": "219c7f9b-5faa-451c-a0fa-1b4bf7815858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639054, "uuid": "8a3183ea-95d0-403c-85f0-bb3bf26e8d89", "value": "b3adcbe386d1fe211f6cf5bcab2637bdcb5ce23cc477c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40608a25-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688651937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651937, "uuid": "14dc30d5-2445-4d53-af85-209483a4b35a", "comment": "Malware payload (AgentTesla)", "value": "642b7173c7eae0e63516a4bb32e48460", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651937, "uuid": "296a4dc1-080d-47e6-b1ea-5239df6a268e", "comment": "Malware payload (AgentTesla)", "value": "b3cd9244d9b558968bf4b52e8c25a54b2b08a2d0e941c517e1c2d91be1e61e31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651937, "uuid": "3ff10da4-1b69-4550-8d28-ea1c8c002b9d", "comment": "Malware payload (AgentTesla)", "value": "0e1eb41081cca7eacf68625aaa5f42291ec86cab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651937, "uuid": "2592bb8f-9abd-4f1a-99fb-e2297b9044a0", "comment": "Malware payload (AgentTesla)", "value": "3eb5c5047d850e0c50354c336705ca4bc6b995146d4e40d47a2b515678f0cfe96eb2fc66ae30528b6e1e63b4eb6e4e0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651937, "uuid": "848473d6-37ae-4174-a248-e041bb55830b", "value": "T14F05E041323E2A63EAB98BF90250527097F63E5FA52DF6E85CC6B0DB52F4F804641D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651937, "uuid": "f6d33b42-4784-4f98-9f24-d6f66d256d58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651937, "uuid": "413c137d-4fd6-4ec9-b971-8fea5b75cbf1", "value": "12288:JlKnubEXqXdVAzeKnNRVInNDo+RRgPd2UKkUbcts:u+4qXdVAzJnH+nRS1Obc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651937, "uuid": "97ffefac-43c6-45b0-8a7a-f86d9dc8a01b", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651937, "uuid": "5becaac8-7ff1-4555-8cb2-fef44f6b4a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651937, "uuid": "84b5c6b3-6e28-46a5-bf69-7d946524baf5", "value": "b3cd9244d9b558968bf4b52e8c25a54b2b08a2d0e941c517e1c2d91be1e61e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66499f59-1bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688635680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635680, "uuid": "4a2f7043-7672-4efb-b1e8-30e1f4f63e29", "comment": "Malware payload (Formbook)", "value": "011515ef4a2427c1d358800b71000618", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635680, "uuid": "ef9e0744-7b3f-4212-ba70-20fe24765eef", "comment": "Malware payload (Formbook)", "value": "b482a1a6f6a6da0c077a2b67ec5d09db2e74008e36727236e5abe1540f3a9dac", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635680, "uuid": "c295a054-d2e2-440a-b613-b2407019e238", "comment": "Malware payload (Formbook)", "value": "ad28e2e281065323d3f05bc56f7ec71a93d4e005", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635680, "uuid": "96e1164c-fe58-4b61-b231-27a8744545bd", "comment": "Malware payload (Formbook)", "value": "177d352e7bd15810414b970588d00592771f483dc2a6f785ad160c3985699a05f2d014b3e1918abc6b4e4b2c624c29f2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635680, "uuid": "de231099-22e2-4318-8878-4d40f849f7cb", "value": "T14174235CD7B95C8C99FE62EC602E10E2AEFBEBE456F804A20580B3657713486E710DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635680, "uuid": "a0835271-4038-4298-91bd-cdfa2db73a72", "value": "6144:SVDGs1FdEWtd/5qWJLh97lqkxUm7DariHAD4jVmDW0pRtYq:4D1zEOdhqS7kwUI2WHIW0ftx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688635680, "uuid": "3c9b86f1-db37-43a4-a796-4831d29c2a8d", "value": 340189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688635680, "uuid": "fb26770d-b363-4f5c-a288-a856ba5d8927", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635680, "uuid": "cf2049c5-9e7f-4503-8a95-0a8d67715318", "value": "CURRENT#SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97997fb1-1c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688664968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664968, "uuid": "ab3fda78-df7a-4872-87af-a0a810cfeb8f", "comment": "Malware payload", "value": "bc81ebb256d2b351dde5f0f4b2bdb87d", "object_relation": "md5", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664968, "uuid": "cd88891d-45c1-48fd-bfb6-5b02df807bb1", "comment": "Malware payload", "value": "b501cbd56784283e0900fcaaf8589ed264d104da5a688e9d9f6b0a25cd88db79", "object_relation": "sha256", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664968, "uuid": "a6c5b777-0bb6-4b14-a1dc-6e255f110b24", "comment": "Malware payload", "value": "62a3f46fb35536be09556eaa32ce6bb49919165b", "object_relation": "sha1", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688664968, "uuid": "d7b38598-465c-41bd-aa0d-1ee15fcdeb58", "comment": "Malware payload", "value": "4840984e644a3f4ef00234eeefde85659918176512967349769d116d8a5ce7a7774f5dea83056a5125c15df729d76f3a", "object_relation": "sha3-384", "Tag": [ { "name": "BrawlEarth", "colour": "#175A35", "exportable": true, "hide_tag": false }, { "name": "FakeTearingSpaces", "colour": "#F0E108", "exportable": true, "hide_tag": false }, { "name": "pw J$~U9vu(Wl8%`wq", "colour": "#60AFDB", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664968, "uuid": "9535655b-1f10-49b2-96e0-009cfd06bb6b", "value": "T11D863374204D1BFD2A3671DBE4416C912CA53EE1EB3B132BE4AB4A37610ED8D7A16374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664968, "uuid": "3e968587-aa7f-4df6-8690-68a18bdeb6e2", "value": "196608:UK14pssDj6Ug6lshL+144sB8dN4Qt8EpvzvdSeMBBskHEpKn:UPpDjO6lR1Ts+rWEpvzvHMHskkpKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688664968, "uuid": "ddcd6204-9538-4cc7-8de9-2961e76a98f0", "value": 8263302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688664968, "uuid": "9f6b493e-d9a9-4975-8fb0-b91f8a51eaaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688664968, "uuid": "f530a8b8-21f0-4e89-b925-7e396c216820", "value": "Game.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44394325-1bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688635623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635623, "uuid": "1b4907f3-1796-4a2b-af84-1a5b7434eb87", "comment": "Malware payload (Formbook)", "value": "de3784614ddbe92275fafab66c027aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635623, "uuid": "fc9e3d41-7c8d-45e9-af63-a1bacc0bf2c0", "comment": "Malware payload (Formbook)", "value": "b67aa8dfe6ff4cd4478be74edc93000fa290ac31c7f869c8191220ef40239f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635623, "uuid": "31bc61c9-6117-45bb-9c5f-bf6ebded8849", "comment": "Malware payload (Formbook)", "value": "aeeee66f418b4bb439a0be66a88c11fb4c66dd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635623, "uuid": "203aaa46-7a1a-4fda-a7d5-ace7cddd7bf3", "comment": "Malware payload (Formbook)", "value": "f861de06b99afcc34535bada8009ec92cbba5012a7d1b1e43df045264c41df1422c4f826e2af742296292a3b67f464b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635623, "uuid": "575de0bc-5c27-4551-93d0-18ad440454ee", "value": "T196E401226D33C35BD428D3F6187550C523B8835424BDD62C2CCBA1F99E2BF149A67B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635623, "uuid": "11443877-d9ea-45e7-9452-8b7a47b88460", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635623, "uuid": "aab12ef9-7e09-463c-b9ea-0d3c28db3363", "value": "12288:k9C6DCr1lBB5r2EA+DrQyHtUWWFhB1UtfwidcP77av/:Uu5d2mfnUDhB1Eoi+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688635623, "uuid": "a7f55e2a-2c86-47ab-8dbd-b8aed24b275f", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688635623, "uuid": "f09ec818-7aee-445a-a527-4cb59886dce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635623, "uuid": "4546ca69-d0b1-414c-83a6-cfffda14a2f7", "value": "Quotation 64908132458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aa194e-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637155, "uuid": "867d3dfc-2d35-45ac-a8c1-2609fb504537", "comment": "Malware payload (Mirai)", "value": "f83b910754198b6cd22feaba668ad0b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637155, "uuid": "b4f63903-3034-4ee0-8676-82740d979895", "comment": "Malware payload (Mirai)", "value": "b6e7ac150d6255182405aebbf6ef2f7c5dbff31db9cc0df7383d223f6db79040", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637155, "uuid": "39bf5d95-3935-421b-98d7-98248f1c4ce5", "comment": "Malware payload (Mirai)", "value": "a4280768e0ebc32afe101dcfde0f05846ff80a43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637155, "uuid": "a6e3d820-0e50-4307-a7a3-a6bfd85d54d5", "comment": "Malware payload (Mirai)", "value": "4a281157c4bfcf2e86d6a544be8fd7582e8704a8dfa02195163504ae690b6ca5a965c27c1d98e2666aca59f33b9b23f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637155, "uuid": "f7bf7dbd-efd0-4b39-b9ed-d95c01002098", "value": "T14CC2D030A6AE18B587600572F7B856C9BB534F7DF9FE3C90114087EA3C429096DEA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637155, "uuid": "5ec5bb12-25ce-4e37-9f8f-e5c71c2cc6ed", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE5iFHhymdGUop5ha:A7soTAZ3alkXLvFh8nNEEFHs3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637155, "uuid": "9b580001-733e-44dd-80ef-be2ecf05ce8f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637155, "uuid": "87c93483-7e07-484a-8153-ade5c6565416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637155, "uuid": "ee784e03-d148-4112-9761-032a3278e8f6", "value": "f83b910754198b6cd22feaba668ad0b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cea853-1bd6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688631706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631706, "uuid": "d2139c15-c4cd-4bff-b78c-c12a32932549", "comment": "Malware payload (AgentTesla)", "value": "90707b0665185a001fa43462d62060c2", "object_relation": "md5", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631706, "uuid": "3e7feb7f-9dcd-4045-8d3e-2c1bb694e5bf", "comment": "Malware payload (AgentTesla)", "value": "b716a4534c6aca30f595573e629c08c48d7cc37cabfcbee88e04bbaf809421fd", "object_relation": "sha256", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631706, "uuid": "c3b47c9b-348c-4695-a713-71cfadd79fd3", "comment": "Malware payload (AgentTesla)", "value": "9fccb1a33b9e29f0762e9222eb998eb6f2ae9f33", "object_relation": "sha1", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631706, "uuid": "bdb72323-bfc8-4bd2-b0a8-c9c330d9b7fb", "comment": "Malware payload (AgentTesla)", "value": "2a6f828dcd42f105bbaed49a7c3c5e9056def5c7d9ef2ad5218d9ad433f0ffb46e1d6a960281665f1a67d1fc924b5d55", "object_relation": "sha3-384", "Tag": [ { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631706, "uuid": "89a1e541-7bff-4c3c-94d9-53fb991d1650", "value": "T119326CAAADC429BEF337503594AD1354F3B8268392299D0F7B30A954C77718EAA10E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631706, "uuid": "7d149784-0d4e-4ee0-853b-6052e7e0017b", "value": "192:rya0NmhTxWhARgZVPCK44AG9xXSJ+Ej7BJYfKwwKyEcFWY3cWe6gHK:ryXmhTxWhANK4499xXSJf7BJYfqmY3nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631706, "uuid": "bcc5a581-ff4e-49af-9611-eb60339ac0ab", "value": 11085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631706, "uuid": "8e1b4e26-407a-4f97-90a3-dde2dc03c48d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631706, "uuid": "b50682c9-7839-4444-ab8c-6891b24f087f", "value": "Payment Slip05072023_PDF.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f87819-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688652220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652220, "uuid": "b0de91a3-6ccc-413b-9e01-9fe379e9ff77", "comment": "Malware payload (SnakeKeylogger)", "value": "e4a2682a7fa9db84cec9f798853975ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652220, "uuid": "060aa363-0fcc-45bf-9de6-eb07bfc0f11c", "comment": "Malware payload (SnakeKeylogger)", "value": "b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652220, "uuid": "64af520e-d200-4287-9663-6bc66868296a", "comment": "Malware payload (SnakeKeylogger)", "value": "a0256f4b6c8ca83d7be9449a51ebd76dd752c4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652220, "uuid": "790106dd-b639-4352-bae9-6f117b4074ed", "comment": "Malware payload (SnakeKeylogger)", "value": "cf80fd79b653ccc58ce1453ff10660afc12bc10cce5ba7025dcb3eaab1c06cbeddb2367b0c6e85b02a69bb4a84ceb081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652220, "uuid": "e444df90-17f6-49da-988c-55616c8264cd", "value": "T1C5F4024496E98717D9FB53F8A56195304BB2B85A6536E34E0E83F0DA2A33F108F01F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652220, "uuid": "c25b69b7-c557-4ad1-a97f-3ca253c043ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652220, "uuid": "42e26baf-f53a-4829-93cd-4503164125ce", "value": "12288:KmOlVKI6coWDpqY6NmN4u/yC8FWwTJ/8Oa+1nI1X6VEGEXqXdV:POvKInoWDcY60NDDCWqJa+xsS4qXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652220, "uuid": "4ae46691-2939-4cc1-bf20-7f891e1a41cd", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652220, "uuid": "a1f0792c-bb3f-407b-b11d-d8b66a82a2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652220, "uuid": "97747db2-d33e-435d-84d0-2103c9c6f002", "value": "b77e4e01d790970d4933798c036226efe9d1e0cad9e12c7de1679c65741fdf51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63088e62-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688622789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622789, "uuid": "9fe37eb4-ce87-456b-9232-91aaf4be50be", "comment": "Malware payload (Mirai)", "value": "d7b1ab46b22fecd041cf2063270aaec8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622789, "uuid": "1854a852-b73d-463f-bf1f-bdb4e27bf06d", "comment": "Malware payload (Mirai)", "value": "b7a7d31f27637d6f6938b443fea4b786d4387a662042434d043ca9579de08bf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622789, "uuid": "d80c03f0-8dff-4d63-88a5-4d9cdfe6a2ca", "comment": "Malware payload (Mirai)", "value": "49378d0cdf361d87cc0ca55b50806db3c2ab793a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622789, "uuid": "26f483d3-75d8-4653-9b54-89704b6447cc", "comment": "Malware payload (Mirai)", "value": "0b7b326dfb3acca56b6064472c34ea0c1b4098ccc48177eb7b26ec99067110a4ba5e705f8bf6b92bdad2419536a6cd90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622789, "uuid": "133d74b1-8e17-435c-826f-d9edb7105c1a", "value": "T1345301E5C5932A71C472A27ACC5682C073588ED4CDF574293E44C27ECA68AD1FFFA146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622789, "uuid": "9f9fd099-5421-413b-9205-09c21b0ee138", "value": "1536:ugN42sF83bOyeJAVu4w1UCpilrCYmMUsU6kisQZCcMT:ugN4XtJAMx1UCkVCYmHsYgpMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622789, "uuid": "7437f73e-134e-4ede-90e4-eac3903d3529", "value": 61784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622789, "uuid": "51d9945a-9329-4f73-bbfe-331004ad5829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622789, "uuid": "15e61eaa-92a9-4c25-b18e-66d570d327cc", "value": "arm7.nn-20230706-0553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf5ffa4-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623262, "uuid": "dd79dff5-4270-4ea2-8b7c-a6310365cea2", "comment": "Malware payload (Amadey)", "value": "897799cc0b6e18d8d976fc8282eb2aa0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623262, "uuid": "62d9514c-c6e8-47c4-80ce-c15bbb827b0e", "comment": "Malware payload (Amadey)", "value": "b7c5cbc9b03a80a5df47ec2fc6f030b99e30645be5b1116623f62f53413cdbd7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623262, "uuid": "0e16f2b5-ce59-48b3-87a6-00dad06ebe16", "comment": "Malware payload (Amadey)", "value": "d03e58449818857651a8f1af0e52fdaf597fc901", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623262, "uuid": "846819c7-870a-43b1-8dbb-c20e2c44dc08", "comment": "Malware payload (Amadey)", "value": "705c8883998f7b62baeadf4214f88f02ed985ca2ee6d0e6605ab87c3b8124980e84109d411bf7fd956e6dff51db37b08", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623262, "uuid": "4fc3c6d5-4624-451f-95ba-4b2947592d14", "value": "T16F060102245CAE5FD13A363177CC46A7F82D9470DB1A1D8521D22CEFD8ADE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623262, "uuid": "aea2e4c1-afa0-43b9-ba9d-e5a711b5df3a", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623262, "uuid": "b3a2e1f9-d693-4928-9a7b-e5163be76c9f", "value": "49152:70dzDQuuVaPB+pqNSdZ5d5gIXpNOyFm5cac8DjDlVujleVuwAaQ4Yu0xwqNbzo6w:c6F6VvlQeVG4njK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623262, "uuid": "7ef224ff-bfe0-4f5c-a14e-1fc203b86c90", "value": 3780936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623262, "uuid": "b9577ebd-995d-405a-aa4f-63658c0ab8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623262, "uuid": "13cb31da-bb7e-4c67-9d37-09265767228d", "value": "897799cc0b6e18d8d976fc8282eb2aa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d2639d-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688652570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652570, "uuid": "a208d1bc-17a3-48ba-b214-409014fca86d", "comment": "Malware payload (RedLineStealer)", "value": "b84ce58d1888ed9d825bc67eba360e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652570, "uuid": "fc04f798-3ce8-40bc-8c19-509f244938fb", "comment": "Malware payload (RedLineStealer)", "value": "b7c682b78e3d244d9eec10441d7fc1db9a95b448c512c323412b3f18c0419c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652570, "uuid": "33d942de-cc69-46a2-b605-ca5c38bef59e", "comment": "Malware payload (RedLineStealer)", "value": "278f61a7fb336e02e312740b3bf5a12f8847eed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652570, "uuid": "6d46b7ec-d489-45e4-aae2-1a94ac2fc339", "comment": "Malware payload (RedLineStealer)", "value": "ae9dd2f9efd0e7cb0182f0745600791011fee2e5225fa8b350a94249ded62602a0e43dec5322941933f20d0b8e57baac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652570, "uuid": "1b052f1d-329c-45a4-9090-c50223b8dd41", "value": "T1C1F412333810F953D08DDD70A47615D0FBAAE3D53BA681CBB219E03A5B871E1D72876A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652570, "uuid": "68b564c6-8e34-4ecb-8fec-f1fecf5f6ef4", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652570, "uuid": "298a9770-be99-480f-a71b-723f027b96f9", "value": "24576:8zH4bv682gvIsUOnl1RiwwlzOzHx1nyn4MLGH5vTSGdkG:4HqDpIbOR6lCF1yn4MSPkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652570, "uuid": "6138615c-e7de-4e3e-bbd8-1c3b11814018", "value": 792392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652570, "uuid": "82ebc686-706e-469a-a0dc-af40f6a7b8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652570, "uuid": "0bd09a01-2673-4db0-9d16-f37d530a31d4", "value": "b84ce58d1888ed9d825bc67eba360e7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d7e7c3-1c05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688652193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652193, "uuid": "c9a3ee60-0719-4674-831e-5741f3de9c24", "comment": "Malware payload (AgentTesla)", "value": "1254520bdcfe7dd96d9378aba95656e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652193, "uuid": "67dde379-b65d-46ea-9a0a-1ac09e9ed16e", "comment": "Malware payload (AgentTesla)", "value": "b8192f1fec7d9734eaa25fcb5a51e7b38ac904c4e3b6db13373e028496f5ea9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652193, "uuid": "31b500e8-b849-4c47-ae32-ae6f60836555", "comment": "Malware payload (AgentTesla)", "value": "55d31bae2143de44cb8fb2fcfa7745f2c8da042c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652193, "uuid": "640e255f-63ad-4146-890a-d049b9be392a", "comment": "Malware payload (AgentTesla)", "value": "4cb6c4d8472f60a4fed0137633aa8d85616437e6dd5ff039dd4a9dbc0121ac5b3b6810b727fac0ef339f96bafa617eab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652193, "uuid": "17a596d0-1063-4efc-b03a-d1b3cd953081", "value": "T1D1F41245A6ED9706DDFB27F455A05A300BB2F4AF6436E31F1E8170E66A22B008F41F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652193, "uuid": "961d25e8-99ca-4ac9-a995-ace444049cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652193, "uuid": "1326dce6-f8d3-4ed1-adcd-2eed9b2fd56a", "value": "12288:+bLXAndxtHYn8OvvC3kgn/yxPSTs9QlreP7TPsD4TYN2/WEXqXdVi:WcnpHhcwXyxS3lqP3U40cu4qXdVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652193, "uuid": "4d2624f0-c5b9-4fb9-8086-8edb80f3fa74", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652193, "uuid": "a2a8cfb6-4ac6-4de6-a11e-3b2da74b6671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652193, "uuid": "a6873672-716a-4f38-9624-f8cf3680c8bf", "value": "b8192f1fec7d9734eaa25fcb5a51e7b38ac904c4e3b6db13373e028496f5ea9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee8d7a-1bf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688644142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644142, "uuid": "deff5a2c-beea-48ce-9477-1d44a80b11dc", "comment": "Malware payload (Amadey)", "value": "ef00963a8d959f064973184ca224a6d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644142, "uuid": "c2c6404a-78cf-4ec0-b695-a54048742622", "comment": "Malware payload (Amadey)", "value": "b874b14962e5bfebb329e4b339942bf3cfc23074c014b0b3618c5591e2b25222", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644142, "uuid": "1f8799f3-3841-4926-9e7a-62eda2266083", "comment": "Malware payload (Amadey)", "value": "a02d7cdca5d29e2d0ad36dbc8b73388c2b1921d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688644142, "uuid": "a8f2a135-f934-4ada-9c7b-cc0a35407ba7", "comment": "Malware payload (Amadey)", "value": "4033ade6bcfe9c434d58bef179065ea65540d2a0cdebc3690d68011c71c3a801422478a624e7a5ea2bfac6527907e550", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644142, "uuid": "670e4752-10bc-472d-aa56-3b57db05ce7f", "value": "T1E5060111554C9E6FE13A387677EC4827F92C9874DB480D4222D62DEFC48DE83F6A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644142, "uuid": "2447809e-ad60-4ca9-b6f0-2c0da5ee70dd", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644142, "uuid": "45c88bd4-107e-4752-8b20-30c1d50d015b", "value": "49152:iTQMnjnimk6pqnbPiHcKKoB42qlYWS/stirLMriXHcerObUsRXJjZ+4X1DTF5OOq:BGdGLwX2TPZjx9uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688644142, "uuid": "f39690e0-2171-4706-a90f-bc5a5bd701e7", "value": 3759432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688644142, "uuid": "3bb59504-f70e-45ae-b2b4-b8b5716efabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688644142, "uuid": "8c06f8dc-a6b4-42ff-8917-6c4df4ae7ba2", "value": "ef00963a8d959f064973184ca224a6d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66321218-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645558, "uuid": "e536c518-4f07-4434-820d-a774ae1b0d2c", "comment": "Malware payload (Mirai)", "value": "145b92f3a43d51989a684b4061dfb6b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645558, "uuid": "5bf8bf49-ed78-4cbe-9ff9-7888d90ab0f3", "comment": "Malware payload (Mirai)", "value": "b8b9c65b640af0fe7ffa4d0288e708a05013d6d18aa03ec4e0a8c913bfffbc99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645558, "uuid": "f418e60a-cc0c-4109-904a-ea0ea4f29395", "comment": "Malware payload (Mirai)", "value": "c1a4ad557889456b47ea5065794abc02f541cc09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645558, "uuid": "d3b57f65-34a2-47d2-84c2-7d86c8b40387", "comment": "Malware payload (Mirai)", "value": "851149514294dc8a9ead824fd7a7a5dd436996309adf09806d244a9094c295ae9c3c055ea5a5a4600de169640fdc1b2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645558, "uuid": "22376ebc-760c-49f7-a92a-46069a548ecb", "value": "T1F4F34C46EA818A13C0D6177ABADF42453323A764D3DB33069918BFF43F867AE0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645558, "uuid": "b113da8f-0e73-418f-a119-8dcb49741e89", "value": "3072:0dyDBBI5FYyaqlAzdpUEEt6BG401dDOZ9M/9PdWYnR:0dwBI5OyaqlAzdphE5JdDOfM/9gYnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645558, "uuid": "2d60f06c-3ec9-44a6-833b-1b5b76107675", "value": 159989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645558, "uuid": "91e5faf5-99ad-4bc5-b5aa-3c8902e25e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645558, "uuid": "c2f1032e-6d14-42dc-a4be-4bd3790d279b", "value": "arm7-20230706-1212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507caf2e-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623617, "uuid": "898ef75f-2078-4b8f-b265-d1c02f9d40c6", "comment": "Malware payload (RedLineStealer)", "value": "9822d7055f623c02be89c466157c1f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623617, "uuid": "6f7923a1-df49-495a-96bc-c1a4c45c0552", "comment": "Malware payload (RedLineStealer)", "value": "b8d645118a225f896ba8394e4529a89dc106afcbf975791cc9a539615fb3a2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623617, "uuid": "cfe25c97-76d3-4c84-925c-a9f1c597e2e3", "comment": "Malware payload (RedLineStealer)", "value": "1278d357f316a16b86ae51e259ba9b76e34930e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623617, "uuid": "ed806421-e08e-43c3-8b8d-1dd85406876b", "comment": "Malware payload (RedLineStealer)", "value": "67157117d878f2900fc2bb4ad02ca8a4ee44b2cd26cfaecaee73fb497d88f5decbea0f97becc30abda41603124e1a82a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623617, "uuid": "1829e8f2-d01a-48e1-910a-e83014cb254b", "value": "T13555BD05E09D1D5CC572E7B2BADC23223EAC8474291DA13952E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623617, "uuid": "e70d14ac-bd51-462f-8471-2bc93768edf3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623617, "uuid": "b2216216-8c55-427d-ac67-ef44d6051276", "value": "24576:REjP2YH2PjXBzAgNUYzXHpzqedjKV+hBgme7SIj2wTi6:RwP78bBcgNUYzXpzZdK+f/t22wTi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623617, "uuid": "6a367fdc-cac6-43f0-bead-d1cb5e6577e2", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623617, "uuid": "334a7bd3-8fcf-4342-aab6-2f7f81640af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623617, "uuid": "7492fe2e-93ad-42c4-b067-feec4d24f7a8", "value": "9822d7055f623c02be89c466157c1f2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3adf51-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678638, "uuid": "33ab1b96-f2a9-4e7e-8ae4-d7118d2dd16c", "comment": "Malware payload (Mirai)", "value": "13bc20df3ca6bb93d0fe7fb80af0b5e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678638, "uuid": "7640f0ea-9401-4bfe-8361-169b1ac1a05d", "comment": "Malware payload (Mirai)", "value": "b91d2049f4fd852cc599a0b39559cc28d494b4eed92fef91227f754a64e76179", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678638, "uuid": "da668977-50a0-4aa9-b791-6f9d26baec7d", "comment": "Malware payload (Mirai)", "value": "c3b36bca868a080900f616a3b5ce467a00ddfb27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678638, "uuid": "00692417-1e81-4e35-ba1a-5deb295f162d", "comment": "Malware payload (Mirai)", "value": "d2e8093b7d14cfe46235f10c7c4abf4608254921a187f0598345591fe47b0db793d61884e700d29320c4d943347203e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678638, "uuid": "08937660-b7ae-4e10-82b3-7dcdd21f65eb", "value": "T1A9A3F7C2AD427E33C2C2EBB6BBEFD14837F25614979B3301A5D96EB04A1B9CD1D19214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678638, "uuid": "b7abf536-aa26-4a83-bb5e-3f55bcd2fa5b", "value": "3072:oYx8LhK7FbrJz49a5OlZSn/AehfB+jrVW4:KM7FbrJzwa5Oc/AehfBcrVW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678638, "uuid": "ec12e7f7-8983-41cc-9bf7-f15ca7f28194", "value": 104554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678638, "uuid": "5efa8074-922a-4c95-8980-e4d610d0b8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678638, "uuid": "48eca567-83cd-4de8-b7dd-2e8c13c71953", "value": "armv5l-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef92283-1be0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688636070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636070, "uuid": "be6f8e8e-332c-4f61-93db-74dcc2013c3a", "comment": "Malware payload (RedLineStealer)", "value": "3213c8f79b9b8bd0efd633a3b684e378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636070, "uuid": "a7e56294-8f3a-4082-861e-1a1b77abce96", "comment": "Malware payload (RedLineStealer)", "value": "b9389667ed0df2dd261f0346fbecaa6666cc5538889d1035172df3beba444c03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636070, "uuid": "d28612dd-1541-4385-ae73-75eec580e21a", "comment": "Malware payload (RedLineStealer)", "value": "828c8cf87560a58b5a91cb05df3d1991d73eb61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636070, "uuid": "3296bbda-8c15-4c39-bb97-de7714496ecb", "comment": "Malware payload (RedLineStealer)", "value": "d561800ed8929f63c983323feebaf4a8270f36e7ecc37a871aa4d8c8955f4a8d49a225c108220704d31c8e0f5eb838ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636070, "uuid": "2e7e2097-09b0-42b3-a605-a73d8c07cb50", "value": "T1B2D44A2074848172FDB22CBB02DC7D6134EDF4A0071F1AC752C90AEAF664DDD6AF659A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636070, "uuid": "c2d74bff-69fc-45dc-855c-3fc6b4bb3d43", "value": "95efca35ace17089d4d21f38582f355c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636070, "uuid": "a0c7c150-4b17-404c-928e-52afdced1372", "value": "12288:0RlK4pzqXx34DSF32JKWqSX3sIMOut5dpgUm60nhH3:bN32ko3rMJgH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636070, "uuid": "3be6507c-9a11-40b7-bd03-677fbed364cf", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636070, "uuid": "2ea1b7ad-c690-4c0a-8a24-18f9639429d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636070, "uuid": "5688bf75-98d1-489a-a097-33a57e533d0c", "value": "Cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0323fb76-1bf8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688646251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646251, "uuid": "e5abb4f1-0ded-4e15-94bd-12d03006f263", "comment": "Malware payload (RedLineStealer)", "value": "472621f585e12f33423331d3d13aac41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646251, "uuid": "d3eb8654-d83a-4232-a272-b0e8bed19e0e", "comment": "Malware payload (RedLineStealer)", "value": "b95b45ca5e00473ba37e902a1a77052c66b294ce430c85e36c7111bc3dbbbca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646251, "uuid": "d37f3cef-0f5c-43b8-8959-975d06a7cabf", "comment": "Malware payload (RedLineStealer)", "value": "a11143729797a20087eb9805bc0e866a921651b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646251, "uuid": "aabba901-e988-4844-8159-3e66f8af50e6", "comment": "Malware payload (RedLineStealer)", "value": "95ab242de0af7fc54143b2a435da498c5ca50480c4d2a35f725c91216a334ac66ca0a962a3ffc6a2a67f1856349bb14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646251, "uuid": "117e2b50-49ba-4e70-b070-0971b3c68bca", "value": "T1E1160129106D4E9FC87035B027DC1A93F9ADA435671F0E4122C6EDEFD8ADE81F69099C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646251, "uuid": "e63c32e2-e86d-463d-882b-eba1ead38c82", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646251, "uuid": "6ce26681-b70e-4651-a720-9a6aacb92e07", "value": "49152:q0Njo+zFuW/Ywy0QGiUmsYscsrybs2nvLrG5hbKLvGL2o1EVoQ6xhPUa2nT6kOdH:/zbjQd7uObLGLKmlWTqpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688646251, "uuid": "54cb99e2-da20-47b1-aced-d8ed78ccbc0a", "value": 4075336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688646251, "uuid": "bdffc775-fae4-43f2-9a4a-a9815447d68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646251, "uuid": "5d0cd71e-2558-40f3-a03a-c813c879c2d9", "value": "472621f585e12f33423331d3d13aac41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526a48fc-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622332, "uuid": "aa2a3b53-cf00-4552-b788-281fd0c211ec", "comment": "Malware payload (RedLineStealer)", "value": "15981698fb266b00ee73df62faa5aefc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622332, "uuid": "f1f10bee-85cd-4a80-9cae-9b5f0d741be2", "comment": "Malware payload (RedLineStealer)", "value": "ba03f5ac59a9db2b52f7baafd8f4162277d1a5dda22b5d5fb6183587ae236370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622332, "uuid": "6b89b0ed-bcbf-43ab-8c45-5d161f9e9877", "comment": "Malware payload (RedLineStealer)", "value": "2beeb371f18f076d79091ebe5a886f8786906490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622332, "uuid": "da0af91d-a88c-455b-95da-bafde5e7b196", "comment": "Malware payload (RedLineStealer)", "value": "4b94d69525c30d8c69ad43d885e2b5328e2d2b04305ba55a72200f640f82e80f40fe9f21581d9a8c2512b69392758834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622332, "uuid": "cfffdaa0-aabe-4ae8-9429-8076ec0bb476", "value": "T125160129A02D8EAFC075357527DD1983F9ACA430671F0E0126C2EDDFD9ACC82F6A159C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622332, "uuid": "4d17bfbf-1228-4f01-919e-30a4e31fea68", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622332, "uuid": "606f69b3-6f8f-4786-8044-3caed9427c64", "value": "49152:TO4DJlhMCZ9KgcR/UqFK2udzbwfALTYaut0KUmMRG69kvrEDnKjQZQ/7AEmd8jw9:nhojnaPutCmJ4IAIgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622332, "uuid": "b007d53c-03f9-4dd1-b760-dedf5c224773", "value": 4078408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622332, "uuid": "a64d51f5-b98b-4d75-9e15-a6c738b05edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622332, "uuid": "14ae12c6-3eef-4fe6-9d8d-4e4131a2b891", "value": "15981698fb266b00ee73df62faa5aefc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe48d9e-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677055, "uuid": "57cc210a-43d1-4072-bb07-250e2cb1ea6d", "comment": "Malware payload (Mirai)", "value": "1934c826db484ed2a0af83ebd292338b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677055, "uuid": "17c92f3d-4598-4cd0-ae68-3d267725168f", "comment": "Malware payload (Mirai)", "value": "ba933019d66cc231294184ec7b97e30877308346530bc8b387ade671757d374a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677055, "uuid": "c4baf432-fae7-4ade-be13-a7ef0f21bae5", "comment": "Malware payload (Mirai)", "value": "86a01130346caed9dc722951795b522c4c8cb3f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677055, "uuid": "184f517a-65fc-4844-af4c-d980998a8c3d", "comment": "Malware payload (Mirai)", "value": "5390c51a4dc30b3c68b5c8c812197a1113135c93256eb69408e259a1035c87fdb9c8838c9def8820316e9065a01b8906", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677055, "uuid": "5a194519-b8f3-40cf-80c5-f7c60f5eb8e9", "value": "T1F7634CC6B412AEBDF5CFE6BD84210E09F824721150631B27B767FC93BD331A5994AE06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677055, "uuid": "d074e4e9-f4f9-41fc-86d1-40d601743c98", "value": "1536:sqpbAGR8FKY4rKdximdjXRlFKBKZx2L8y/qnze/8w:JbijXgiICn6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688677055, "uuid": "cf85a490-0fa9-4e33-87db-2d351dc802d6", "value": 67500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688677055, "uuid": "923a1de4-6c4e-4728-adb5-e1661f846676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688677055, "uuid": "c178ae4c-ad87-4aa2-a140-f44132af40e4", "value": "1934c826db484ed2a0af83ebd292338b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43e23ef-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622953, "uuid": "3f840aaa-b120-40ec-867e-ee029e6a96df", "comment": "Malware payload (RedLineStealer)", "value": "55fd14935b77b2141be37cf0f6988815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622953, "uuid": "2d4bdc97-14ba-44ed-839e-643a04e93bcc", "comment": "Malware payload (RedLineStealer)", "value": "bbc45ab233236c2136b0696b8ad599353b16e25bc7de5b44fc8907b4c7c72268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622953, "uuid": "884f7231-47b4-4a74-a366-03092bc2b884", "comment": "Malware payload (RedLineStealer)", "value": "bd828ac324ca8b0174484574c13619849c8c6623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622953, "uuid": "4bd9d6a8-03ba-45f9-8258-dfdbaa661fa0", "comment": "Malware payload (RedLineStealer)", "value": "6e88daedbf167c0c2151a2088e9021cdbbfd4348c1a06253d2f3dacf89b2b7fb26ec5e50ab9f5468ebf73d20964f72e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622953, "uuid": "4a59ea5d-4fd3-463c-b27a-b71344103ac4", "value": "T17A16010A605E4D5FD63134712BDC5693F9ACA4342B1F0E0126C2EDEFE9ACD80F691A9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622953, "uuid": "61cf12a2-ef22-40cb-b4f6-1db081ae6eb8", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622953, "uuid": "bbbd174d-c4eb-4f3b-8b71-19210be39b32", "value": "49152:6GvAhmesr4AZ2YxwnMs4gmzfne/2/yxChHiyJ+PPrI7MYPhRqYt5xyYBcP0MUuEc:6nMmYvzfe5x+CyJW87MYpk1zJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622953, "uuid": "46c581eb-c8ae-41dd-89b2-13e3e2c1305a", "value": 4085576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622953, "uuid": "5c7f0461-b78b-408e-aab9-cff38fcd586f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622953, "uuid": "4302efe5-8053-439b-9dd2-af1b14ce85a7", "value": "55fd14935b77b2141be37cf0f6988815.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6da16b-1bb9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688619584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619584, "uuid": "25aaa2b4-687b-4ede-b420-adc0a8093c53", "comment": "Malware payload", "value": "d99e30f57a3397bca775f68acbff0a45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619584, "uuid": "447e23fb-57d3-4040-876e-3225808745f3", "comment": "Malware payload", "value": "bbc84d8113a62bb1be5ccc252f23ad46cbc02d2aa14d711f81b31196bf17773d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619584, "uuid": "10297100-f320-438b-8f0e-402863ae32e8", "comment": "Malware payload", "value": "fc7eb700a15e3f5b23ffb0ab9b7423bab4145f5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688619584, "uuid": "3f01ead9-f91c-4933-bfd6-f7ddcb480860", "comment": "Malware payload", "value": "f375a3322f6e43ed38d41295d334f76359956b682e48e688024288e063da16efe6b9179ba7288993fcbe464cb5bbd0c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619584, "uuid": "0cd9bdd5-8e33-4b1a-8ca2-fd7180d32f04", "value": "T14F448C5078C0C472D57A2C345674D6B10EBEB8311DE0DA8FABD8197A8F316C2E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619584, "uuid": "495174dd-487f-477b-a1a0-db7cf3501657", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619584, "uuid": "8aa40f8d-1c23-4062-aee9-8cf56eb02c51", "value": "6144:7wEmDpM6FAWMVF7WZOWfU+BPBdmJJgZY6/RRuFLqbo7jJE:7bmDC6FAWMVFyZOWUAPBdmkY+uFLOoPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688619584, "uuid": "2edc35b3-a182-42b6-82c7-245ed2439351", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688619584, "uuid": "a4a4a8e9-e529-4fb4-b4c6-272938fccb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688619584, "uuid": "bb8621a7-8f1d-46f8-8595-0ad71db40871", "value": "SecuriteInfo.com.Variant.Zusy.475489.15701.13653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa18b78d-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688661563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661563, "uuid": "1ef87787-def7-4b8a-aee5-f0820fe8278e", "comment": "Malware payload (AgentTesla)", "value": "671c069ce0dc53ade06388a310f44b26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661563, "uuid": "de45fd15-b3ed-42f1-8d23-6bfee4db3e3f", "comment": "Malware payload (AgentTesla)", "value": "bc60b1409a79cd008bd4f8a2d6337a391a93bbdfe6eeac374c1defedcd8dbb30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661563, "uuid": "4affdb16-8a24-481e-a775-c7970f2a9eff", "comment": "Malware payload (AgentTesla)", "value": "cb6b9bc9826a6f5cf037b3bdf4863d83fac2f0c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661563, "uuid": "14ac5255-0f79-4a8c-9573-79952d1e9043", "comment": "Malware payload (AgentTesla)", "value": "478ae040dc644110ff753f94a35ca15d1b88c8a467d19ed57122ef5f77c0c068a37fcf1f762f49fe3b85f2c2f817d8c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661563, "uuid": "80de2121-f3b3-4329-912f-6bed1afd431b", "value": "T13443B831F895845EDA2C72FB58E0C9EE802C1838E98111B6F57D0B0EA5BCD3BD13959E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661563, "uuid": "06f47928-5a10-48ec-9d39-0ce470e69dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661563, "uuid": "8c7ff961-7279-4299-ba9f-f6b4d6f51f9a", "value": "1536:tDK6/IHynUYwL+T777777KnsgQlVnvoChRYjKKP6NEPFb6OQ3ZvtbdRJ4Ag9A1Ia:tpl9h4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661563, "uuid": "03ea1523-1eae-45af-a5d9-74fc58a2536c", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661563, "uuid": "824e0ac7-e2fd-41e2-aefe-2d2fb6b9a011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661563, "uuid": "f9d9d827-e307-443e-bb9d-b296afde3826", "value": "ORDINE NR.2220271_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be66cc2-1c19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688660681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660681, "uuid": "3962543f-8ccb-4524-9754-9b013bffbf4b", "comment": "Malware payload (Formbook)", "value": "dce6885f904647cabfc85acebe23abae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660681, "uuid": "4fb25ca7-3fc4-4034-98ce-ea57659e712a", "comment": "Malware payload (Formbook)", "value": "bc692450679bd50a88731eadd17d16cdab40a7f15bf632b24984f075bd99bb0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660681, "uuid": "ae51c8c6-3e68-4a67-86ad-0575710ebd7d", "comment": "Malware payload (Formbook)", "value": "bdeacd25633030ebbb9ff310baaa283211368a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660681, "uuid": "d2629686-a0e1-43c9-95c7-402ec6ff932f", "comment": "Malware payload (Formbook)", "value": "752147211f61c502b6f8f897eec2c0ed9fbe63a074880447a66cd7218eb05df56181e77cbd7aa3b378e578b9a1d3d153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660681, "uuid": "f8051e87-53c6-4645-acac-be8522b93294", "value": "T1607422259350C42FD8F618B12E3B579A66F6652634A4C36B27B01F48FC278C2E90E7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660681, "uuid": "4f980a74-71b9-4399-be5f-dd0858792c05", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660681, "uuid": "11eadb08-7159-4035-be9a-8d8eda90b9ff", "value": "6144:vYa6p8bLYVMsCBJP3490xN8t20eXt0waTATBGcem01n2+K6tPKB1EWa2M:vY7a+MsCvo9Aat2Pt0h+G+01n2+K6tSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688660681, "uuid": "40335576-6429-4165-b5a5-738481914151", "value": 352991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688660681, "uuid": "c91dd39e-bc26-4c63-bff7-02a637d70a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660681, "uuid": "ce0caa63-e620-41a1-bab4-9e0343978246", "value": "PO20230607002pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8518dd14-1bc9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688626283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626283, "uuid": "5a3ac1d7-b5e9-436c-a3ea-8f8c504a48ae", "comment": "Malware payload (AgentTesla)", "value": "9024ed9423885c42335a151dfcefc576", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626283, "uuid": "6d1fff6a-550e-4932-bb0a-591dd9b3442a", "comment": "Malware payload (AgentTesla)", "value": "bdc3b394b6fa647e13f3b728786c14a58e44af9f174563550a7bab578303d1c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626283, "uuid": "de0c513a-60bf-4fa7-b24d-f05e15192527", "comment": "Malware payload (AgentTesla)", "value": "79e677b68313d7866199bd1b48e39ec0fed164df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626283, "uuid": "ae4e5128-b4da-47b1-89a0-723c482b18c4", "comment": "Malware payload (AgentTesla)", "value": "6bbf8c171fd9dd1a1f7532d1f03c426468279b438e28624256d0496b946e164425a9990df08e42ee9de52dbaa005ef04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626283, "uuid": "7114a614-105d-412a-9095-1edc7e7d0f25", "value": "T11B64F203719ACCE962D2BA67415BFD784BF7F9C9943D927A44CC4A0E87D290C89067E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626283, "uuid": "b63e0c9d-bd39-453b-8ae0-a32e1d2e3cf4", "value": "384:zBBcRvxarYgnF600/tKx3y4ZJDlIh6dJhq:zBBnq6DlIh6dJhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626283, "uuid": "007692b8-919e-4133-af62-1f656cf614e7", "value": 326730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626283, "uuid": "36b51fb6-84d6-4828-aa4a-c45dbe20cafb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626283, "uuid": "6ee81d39-9945-4249-9ee5-d712ea187fe6", "value": "IFE Gmbh,and Engineering Request for Quotation (RFQ).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58ac300-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623438, "uuid": "816c3ec5-7614-4a82-bafe-ab2a1aef0e42", "comment": "Malware payload (RedLineStealer)", "value": "aa3f0c47fdff4809bb8335be30932cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623438, "uuid": "75219947-505a-4760-8e20-6fc188081046", "comment": "Malware payload (RedLineStealer)", "value": "be235a602e6bd6371e9aba4f52873a667c8960b852800e8d10d9d6f85c5ec3cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623438, "uuid": "f04a5e53-b50d-43a9-b862-76c525485a2f", "comment": "Malware payload (RedLineStealer)", "value": "525d3e73678f29812396ce50672de1bc8c85b503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623438, "uuid": "a0d7e521-702e-4052-93eb-f82d27563e74", "comment": "Malware payload (RedLineStealer)", "value": "2efa3714a1b0b6e75a8a248901abe5c9cddb1672019deda2c17d60e832cc62ae0542c35703c22a53350a87b9def943a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623438, "uuid": "b7906751-6ff5-4a30-bc0e-ee2e8c549d3d", "value": "T14F560102285C4E5FA17634241FDD459379AE53681B170D9632C2EEEFEBADD80F681B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623438, "uuid": "ea2336ec-7a96-48bd-8845-3377fe6f156f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623438, "uuid": "83a9ef65-444d-4616-8547-f9135280748d", "value": "49152:N0IOQsSdaGSkwLHfUNN3QqfSRCqpPUsAPapm80/yosvw5gDifE5q87vBXcO4DShF:NJO+dQcNCx4THsQJMgaGShmfVH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623438, "uuid": "cec88136-94a7-48f1-a25d-696fc13c5055", "value": 6003016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623438, "uuid": "ef4ad237-84bc-48f5-93d8-fe0795b1dfab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623438, "uuid": "872b709d-9410-4061-a86a-3757069bfed5", "value": "aa3f0c47fdff4809bb8335be30932cad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65250a2c-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645556, "uuid": "57372dd2-27fe-4538-8a71-ea1a94bfcdcc", "comment": "Malware payload (Mirai)", "value": "1cf82c75654158db84587bd0db0a38ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645556, "uuid": "f65f7e02-5529-43e8-907e-a9f3924cd83b", "comment": "Malware payload (Mirai)", "value": "be3a69462f11b489de1f912bde00c598773d3ff4de0163c9c6c47d6de24ca2f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645556, "uuid": "60d5f462-e100-4a3e-aae0-b86b7adec0cc", "comment": "Malware payload (Mirai)", "value": "e73dc36e24f611ec93b3a44cdc63786487e961a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645556, "uuid": "8b596355-c00f-4fb9-afd9-0cbf36f23178", "comment": "Malware payload (Mirai)", "value": "2c3c11b0233fa3ff4210a8eb93ad718bcc0d021b1e2c2ca959567cc170cf84631e00cafeed25d16ce653834f800e82fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645556, "uuid": "1484739c-a0a2-4dc5-8cae-00633d9d14d8", "value": "T13C735B07798081FDC5A9C17447ABB639D43375BD1239B2AA6BC8FF1A2D45E201F6E9C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645556, "uuid": "e022ebe3-6437-4dbc-85d6-0aaca3182c87", "value": "1536:VRau7290/ffHPU94DS+XHWxOIyKoMtauGEEJJqYLd++:faui90XfM2e+qOIyKoMdGEE6YLdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645556, "uuid": "b00aa488-3ebe-485e-811f-38a6685f8da2", "value": 73952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645556, "uuid": "0f097cb0-00a3-4312-af62-4994ae4e7908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645556, "uuid": "1dc105f3-6da0-4f63-aaa5-da761dc1ac75", "value": "x86_64-20230706-1212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cc8ce6-1bcc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688627435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627435, "uuid": "4916448e-df72-40ab-b90e-202252d590f0", "comment": "Malware payload (AgentTesla)", "value": "4739121cd5077ea718c8c197a3b50fe0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627435, "uuid": "a3bde29b-6397-40e1-be3a-8b51cc0d7cea", "comment": "Malware payload (AgentTesla)", "value": "be84687edad29eae1d7819714c65881c1c8bd2bb9170c58f8b5fe5a34ef2a664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627435, "uuid": "2e845efc-30c2-4042-acdb-a3e1c968617d", "comment": "Malware payload (AgentTesla)", "value": "cb077c00e196b5a5274c308bd54eefa8edbc6f67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688627435, "uuid": "c2c0c078-5b36-4144-800c-7b141135ae4e", "comment": "Malware payload (AgentTesla)", "value": "2c0784230d9af847f0e1d1de0db2ca714185e2e6cd1fba4e2c5adaaef3cb95b86f63a5a0221cff4aeb117e16d3c09299", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627435, "uuid": "90a12d83-f815-40a7-9da1-073fcc5c1c3b", "value": "T1B305743F14CAAD27D239E2967424DA5DF252B7C637A74B4EFBC216A1843236933D108D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627435, "uuid": "f20fe378-29a8-4cc8-9ea2-8116f92a6db7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627435, "uuid": "918957a8-eb04-4078-809f-8e546d1ec638", "value": "12288:C7LnM2Nt53sKrBKGweLM2D0grLEco2MKnsTfieA4fd79WUG0xXm33K:IKGwIlEco210A4fl9WUGQW33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688627435, "uuid": "463fcd91-270c-4ca8-9022-3f2b694c90af", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688627435, "uuid": "c7be65d7-0729-40e2-a2b3-4476b0344e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688627435, "uuid": "9834d6bf-f124-44ab-9550-bf857b8ea327", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0140699-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623456, "uuid": "20e25eb4-cd8c-469d-a672-505dd0fd74a4", "comment": "Malware payload (RedLineStealer)", "value": "a3b6b528af910acf9b83917eaee5bc17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623456, "uuid": "321a08fe-6e7c-43c8-a9f3-6279516ba3a0", "comment": "Malware payload (RedLineStealer)", "value": "be8f4b7d913199117f54d000f49c72dc3acae68e03fc1c1e5901e2dc7c3025cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623456, "uuid": "ab366fbf-2c83-46be-860c-f41919528848", "comment": "Malware payload (RedLineStealer)", "value": "396b02999cb95146e42731ed51cf31f1b5e506e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623456, "uuid": "3cf590b2-8e85-4271-8944-16e40d8f1cab", "comment": "Malware payload (RedLineStealer)", "value": "ba3c9e052f6a8be424d61389a1cdb0b445af098032024c7a363465ce612a9ad5da99107c6cd166e51af1010cb7a0525a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623456, "uuid": "70decbb9-1d9c-4f55-83a1-9128a4b95117", "value": "T1BF560152281C0D5FA13539251FCC589369AD67B91B130D9231D2EEEFEBADD84F680B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623456, "uuid": "0ab32fc1-94e7-4a23-9209-fbd1d1c8769b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623456, "uuid": "83540820-9d30-4150-be5a-cff62382ed22", "value": "49152:7gUA2358l8Gf2LW71aywD195BuOF+v8lc9r8pzUbUXbBPZ0Ueigv2MYPUuAvBUPn:UF22toWXO2h4QglGENsuAeIPyeCxiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623456, "uuid": "8034e76b-d012-4ea5-9f48-d51f6eb2513c", "value": 5999432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623456, "uuid": "d9fe9b7d-8699-4835-914c-ff69d7c64c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623456, "uuid": "6a06eaee-c7c9-4707-9c29-a062bb9a1fef", "value": "a3b6b528af910acf9b83917eaee5bc17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf60f79-1c11-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688657407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657407, "uuid": "2cd1beab-ef05-4505-9a9a-cc919f18e016", "comment": "Malware payload", "value": "3d4c28d1f511a9aae8bdd8781daeb1db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657407, "uuid": "39bef9bf-96a8-4510-b3db-9aa994c4beb4", "comment": "Malware payload", "value": "beb6eb545dbf839bc274acadc7b5ca0f2984ea750c4ffae19b0ca78f2e74922f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657407, "uuid": "a71d1f06-a8d3-40f7-b833-f7b699e7d4a5", "comment": "Malware payload", "value": "84de2a4278d1954a3a25721e1b55a901e818ba4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688657407, "uuid": "5073480f-3bc5-4d81-9f69-d4897a1feb1d", "comment": "Malware payload", "value": "2484472c542d71ac8baf760d4bc6bdace9beba02787a0256998be995868aee376640c31ccd1f004c4451b09f6a23cd4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657407, "uuid": "3fb38634-f7a0-47dd-b781-42ee5cd002b2", "value": "T1BD448D5078C0C432D57A2C345574D6B00EBEB8311EA0DA8FABD4597A8F366C2E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657407, "uuid": "70cbd022-f91c-46e4-8796-93d4d4aa14b9", "value": "14eb01c0e22ebf11683c275de94f4a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657407, "uuid": "9d6f1532-041e-4316-a813-b04b657e4172", "value": "6144:5nqz32YGozQzaUEk6Nt8/Uh7mYkdmTxIUYQ8BWuFLCJrxhS:5A32azQzaUEkit8chyYkdmrYSuFLchS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688657407, "uuid": "ff955177-4b52-4cee-b0e6-f2a4994e3eef", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688657407, "uuid": "4bc6c740-9a0d-4220-8061-eb08429b3d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688657407, "uuid": "309d9013-e97b-45ef-b243-9b68cfb71764", "value": "SecuriteInfo.com.Variant.Zusy.475489.28142.21899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c728318f-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623816, "uuid": "df0e69a6-0b86-4295-83b3-27d0e0b4191c", "comment": "Malware payload (RedLineStealer)", "value": "c9d2d645e4db68b1bb884721c87a7e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623816, "uuid": "65d14517-a554-4154-81af-60975b8ed142", "comment": "Malware payload (RedLineStealer)", "value": "bf43b2ce9e643cbd94489b65cafb994f9c82ecd6af8522d4392980cd01f93744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623816, "uuid": "45e502f0-27ee-4f09-ac06-75e97cc38ed5", "comment": "Malware payload (RedLineStealer)", "value": "1c4f19f1dd94ba47852284ae4c4041f54c17e345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623816, "uuid": "dc28856e-9c5f-4b9d-b46f-e106319c990d", "comment": "Malware payload (RedLineStealer)", "value": "eb5cccaef5f4ac16edf535941519c7e8030c619a0037384f77bea20be2a295cf957a99f9e893a887e32f7b7271bd44fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623816, "uuid": "4ef14d72-3c15-40b7-9116-38881c9f20ce", "value": "T155160149A02D9E9FD671353027DD6993F9AC68302B1F0E0022C2EDEFD9ACD81F59199D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623816, "uuid": "a0d0d2e3-49f4-4d1c-91d0-f816aba00d31", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623816, "uuid": "ced534d6-bfd0-456b-962e-953b2a51f073", "value": "49152:GxDcQyqkHskPuKzhrb+WkM3CuBDF9UiAtTZhj8MKRH36LpeXbgYL/rYwAFzyXbUj:asMhadq48pGILjJGeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623816, "uuid": "3a46033a-bdc0-4ce5-a899-748d23ff60d2", "value": 4092744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623816, "uuid": "c04e2e6f-6cf7-4019-9c0c-126d97faa910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623816, "uuid": "31ebf667-216a-49e7-80a1-dff7d2a4ab25", "value": "c9d2d645e4db68b1bb884721c87a7e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93453e69-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623729, "uuid": "e15a603d-c03e-480a-94c3-f20a410c7e2e", "comment": "Malware payload (RedLineStealer)", "value": "bd3c84e52436874b057f2a9764cfbb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623729, "uuid": "87c4a18a-4dc1-49f0-ba91-d346665b6e0f", "comment": "Malware payload (RedLineStealer)", "value": "bf7e4ade7ada19b91250841a15214a8d27e3a93c38d5f0d23134371aa1e3ab5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623729, "uuid": "a02874e3-d68a-40f8-a3d5-ce6d0135bb80", "comment": "Malware payload (RedLineStealer)", "value": "d589ad3b688a830a564d8dfa13090d23d0668781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623729, "uuid": "5e6f93fc-2338-4dc1-a4c9-ac809db98ee5", "comment": "Malware payload (RedLineStealer)", "value": "382a58c24a6d6ede0a955a32b838f88994e207b908d167980a2240a6391ffd22876cfe70fba52fbb43d54b08376b22e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623729, "uuid": "10e5b605-5418-4254-8a7a-15e3801198f0", "value": "T19655BD05E09D1D5CC572E7B2BADC23123EAC8874291DA13952E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623729, "uuid": "e4d290c1-2154-4c0f-9193-b8505087d854", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623729, "uuid": "4d511eb4-9632-41d8-b21b-0e14090584d3", "value": "24576:8ZjP2YH2PjXBzAgNUYzXHpzqedjKV+hBgme7SIj2wTA:8JP78bBcgNUYzXpzZdK+f/t22wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623729, "uuid": "1b0d532e-69ff-4233-8b26-f26c76ed0ab7", "value": 1343823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623729, "uuid": "1c5d9c87-4971-4e6f-94bc-b336c62134e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623729, "uuid": "d4e036a4-f318-4871-8173-6169fc3455f0", "value": "bd3c84e52436874b057f2a9764cfbb64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8965b151-1bdc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688634450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634450, "uuid": "cce6a222-2074-4af4-9e45-b2603bebc618", "comment": "Malware payload (Mirai)", "value": "ff9eb359209063f546ba2ee17897c310", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634450, "uuid": "ca4eadd9-b596-47ad-85dd-d692ae226a9f", "comment": "Malware payload (Mirai)", "value": "bfb3b8179154dab4da69ffd796ae221c532b58ce08d7158402f17d3ad475abfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634450, "uuid": "ccf65ab4-80f5-4152-9389-823464becfd8", "comment": "Malware payload (Mirai)", "value": "2db1c2753a07e29e1163b94ec0781ee69bda21ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688634450, "uuid": "5a60b882-3535-4f13-a5d7-d4de4be0b715", "comment": "Malware payload (Mirai)", "value": "f9faaec37c0096d505a9379dec4e029f02338d1347462c28bd3f1122f65008cb5745cf6845b401e10bba5804762131b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634450, "uuid": "ad6e1bf7-dacf-4d15-98e9-4cef5800c357", "value": "T1D6432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634450, "uuid": "0b2aa464-7501-49a3-86dc-ed869bcaa296", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwH:RqtmZPuutfbltZFBSJsBcfDSTFI+BEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688634450, "uuid": "8b70d481-1dd0-468b-b823-de0bd3257611", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688634450, "uuid": "d8735c52-f795-40c2-8d7b-6ee2892e048b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688634450, "uuid": "acf4e1d9-04ab-498a-bff8-9ef629ee28dd", "value": "ff9eb359209063f546ba2ee17897c310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dc26fc-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624343, "uuid": "5c36180c-0ac6-420f-98e3-7c51c71d4437", "comment": "Malware payload (RedLineStealer)", "value": "f2b99175e6c4fe35d00896924b73a7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624343, "uuid": "8f5a0f86-9d1b-43cd-b6fe-723c931a08c7", "comment": "Malware payload (RedLineStealer)", "value": "c0ca6d265e4207218bd4cd04bcea365316787940adeb6545a8213f4e8b452f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624343, "uuid": "39b4883f-2e2a-489c-9b5c-887ff47513e7", "comment": "Malware payload (RedLineStealer)", "value": "25f0dffbbb3f238d3450a723b0234ce304eaf409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624343, "uuid": "ec6b0eaa-2f06-47b8-8ef6-3dd4101a0123", "comment": "Malware payload (RedLineStealer)", "value": "b0183fb11e2adc7976c59149ea344ff02ee7822dc33a36fa569c3c8e61fcd348ea8fbe0e747bdae65c078abd3debe1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624343, "uuid": "43a0eaf3-c368-4de8-a7c9-a74afebff80a", "value": "T15D55AD05A09D1C5CC572E7B2BADC23523EBC8474291DA13992E21DEF95F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624343, "uuid": "4ab3f2cb-bb5a-408a-ab07-af173d43b9fd", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624343, "uuid": "eeb83a12-c677-46f5-b8e6-8836bc6a25c0", "value": "24576:Z78t1MvGbfl9RD7UronbZXqiFsRa7lORqoda:ZQH+uflYrqNXTV7lORqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624343, "uuid": "b40735c5-bd29-4467-aa06-bf584ca7f7ab", "value": 1343821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624343, "uuid": "0b356176-c88e-4efa-bf7b-c9e33a2786a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624343, "uuid": "f1a6a746-2729-4e65-8f06-39d6b5d10a26", "value": "f2b99175e6c4fe35d00896924b73a7ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0fd64d-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688624331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624331, "uuid": "d9c07c7b-740d-4f89-81aa-360c3ab6d682", "comment": "Malware payload", "value": "2c462e43fb0a209088f17fd3f1275b6c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624331, "uuid": "1dd9e448-8952-45ee-afd5-c1c19c868ca5", "comment": "Malware payload", "value": "c0ea504893aa6a18d19a90c03542cb5843a30008bb09b253998047f4a975e7ba", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624331, "uuid": "9fdb4354-068c-4617-bf17-b77166f71a97", "comment": "Malware payload", "value": "a4b25369f7d65ca770f50b2022e26d30b77ee082", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624331, "uuid": "fd0ff188-1b2e-4588-9f40-5b883ca310e4", "comment": "Malware payload", "value": "6c2efb535eb403d00dc06e487c5d72ccab4fd025282797aa12e2c4be74b3c89dfbafe53f5a68a259d1f7488ffd903d11", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624331, "uuid": "426f3c02-f525-4e84-aaa9-d96adc967c26", "value": "T1B623F2AC61139BF929A894107CE8FB9343DFC586346C19F293C75CC580FC7A73A1A666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624331, "uuid": "74ad1c4a-0867-4ddc-b580-c923d191f2ef", "value": "768:ZM1ubECPB6Otk8KZKorqq8qG7Z/kpnMOnn47sXBVuxn4C3jY6CkVFbyOZdtVRqyE:i1ub7Phtk8q507E4blY6JPqyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624331, "uuid": "f4ca54b8-a4fe-4b8f-a560-33374cf3010e", "value": 45616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624331, "uuid": "a0d7d258-cbed-448e-8c91-9ef8d822cb8b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624331, "uuid": "f2032ea8-b26e-408c-850e-491fce441da6", "value": "b159408176c1c5ba380a4bb99b8ca025bf9db2f955351ba23c7c911fb1d69f88.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9b65cb-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622347, "uuid": "3bbd6745-ba00-41f3-8756-168604ac68b9", "comment": "Malware payload (Amadey)", "value": "22ed6a0e3bb6560944e60baaa29f93a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622347, "uuid": "93c2102d-485a-4ac4-a8e3-0e8bb77db69d", "comment": "Malware payload (Amadey)", "value": "c1458478a1d009d92724138e5d3e637ac4e7396e498ee4d702ee3657905f5343", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622347, "uuid": "ec395ab7-3eee-4b93-a663-4ff0dfb32057", "comment": "Malware payload (Amadey)", "value": "3558ab384379513fff67c64e540e3778809b4256", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622347, "uuid": "b87876f8-4c78-475c-9557-761a8e7a9d0f", "comment": "Malware payload (Amadey)", "value": "8f72e27eb95f164b1e2123d0668069bd95a8be288c8e27c64058819fe2216817e97244fa42a7ec11a67165f519d351f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622347, "uuid": "c6bee81d-782d-4376-946a-25352f386d9c", "value": "T1A3160149602D4E6FD634397127DC1993FAADA8702B1F0E1462C2ECDFC9ACD81F69198D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622347, "uuid": "ef070f42-e7ad-46e9-9df7-889600875cd3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622347, "uuid": "97ff5b26-a1a2-497b-b02a-0e64bba3395a", "value": "49152:20DSfgZRlvXAcXWqKXPW0HV5qrIOCF48MP6bQVW2mlTZUlx4YBmdStzWqHf09uIS:m15X21lKY9WqF8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622347, "uuid": "0cd14010-8ae9-4cce-ac8c-53dc4133fda4", "value": 4093256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622347, "uuid": "91cc3b32-ce9d-4f72-9e46-cf109ca0ae1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622347, "uuid": "358827c2-4b03-404a-9155-114c481aa629", "value": "22ed6a0e3bb6560944e60baaa29f93a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d4b5bb-1bd0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1688629243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629243, "uuid": "e2e014fa-3f91-4881-aa6f-68cdab170bdc", "comment": "Malware payload (DarkCloud)", "value": "bb1ddeaae5f7ce25bfba00ac7d1b7130", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629243, "uuid": "6e60b514-571d-410b-bad5-4977eaec0a64", "comment": "Malware payload (DarkCloud)", "value": "c1725944985e772a05352396df8a4f1c2ead57379b075beb7a0b76c5ace344af", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629243, "uuid": "d8ebb080-d28a-4e38-b69d-19b763fe64dd", "comment": "Malware payload (DarkCloud)", "value": "1fd4537d304cba9d6987eb8af1d00088e5fa2f9b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629243, "uuid": "595ebbd9-cff4-4fa9-bc48-45bbb7e4fa49", "comment": "Malware payload (DarkCloud)", "value": "1ace045467a29c289b16def5c7dff6893cd3ecc04ff1d00c5c09259bfffa6df6edb8fd446aed3730fbce6b866a8f722e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629243, "uuid": "9f96bb6a-552a-46e2-8948-117dc1f4086f", "value": "T15535AE3C1CBC7223C134F6E68F9DC421F690D56A3E61DE2B69D39899061EA0265C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629243, "uuid": "52682a4d-c366-42ee-a0ba-2214f5aaff1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629243, "uuid": "2b310f86-4750-4472-9e60-97aa05bb87d8", "value": "24576:gzdNnNi48Zlk0VqGdzbGKcL29DmLUI9FOGYUQIjsTtW9dypg0w:idNnND6lxVqGdGKcL29DAU2/zQrhW9dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629243, "uuid": "c9f9d887-71e7-41ad-acb5-5386d663def4", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629243, "uuid": "6414e262-c885-4bed-accb-96b670478496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629243, "uuid": "2fac5ad0-0f82-4938-8022-b0df41471b35", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21244.19605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceccb67-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622967, "uuid": "453d4e68-126b-472b-b5df-94492bcdb394", "comment": "Malware payload (RedLineStealer)", "value": "45e58684084bc69dea0079642afc5b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622967, "uuid": "d841aac7-f0eb-498a-9509-df21b7ead83b", "comment": "Malware payload (RedLineStealer)", "value": "c2851981f6bfd01a243174df5ef1f49827232c866105e496e98b57f436f60108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622967, "uuid": "54c0baf5-b9ba-42c3-90a5-62198a8ea6aa", "comment": "Malware payload (RedLineStealer)", "value": "2fb661dc48762f6bf84dfd24a361104c6dfe8edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622967, "uuid": "5861bd50-2650-4a54-9402-417faaa11dbf", "comment": "Malware payload (RedLineStealer)", "value": "0ee4512ea06cab206eaad94bc5aa1ae61d75a46079e86551bd1e6fbb41e666825ef8893505e4242d855fb4530ff0a75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622967, "uuid": "0ff29279-f65e-465a-9bc4-93a6b30d7d73", "value": "T19255AD05A09D1D5CC671E7B2BADC23523EBC8874291DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622967, "uuid": "018de7e9-5167-43b8-8f41-f4c0c48b9f3e", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622967, "uuid": "4dce0b38-51c7-430d-9de2-76f4fd8094ad", "value": "24576:Zwi2dGfYU5xpaCozrddBehxOFEYjIj2l9Vu9Z:ZXg1CujB6AEYHPVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622967, "uuid": "378fb95e-524f-4cef-aa74-56b9097e5a85", "value": 1344332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622967, "uuid": "3656f92a-88c1-4e7e-b0d8-f84dd1e6a352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622967, "uuid": "d62c2ca0-381d-46ba-bfbd-1193a431cc04", "value": "45e58684084bc69dea0079642afc5b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab85b7a3-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688636655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636655, "uuid": "5017b7cd-505a-4b47-b64b-665094ac5deb", "comment": "Malware payload", "value": "876be153a230c332bb0e8dedc094a340", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636655, "uuid": "9574161a-0209-47ed-9f79-df52146f9d75", "comment": "Malware payload", "value": "c2a6ef0312aeb7a379f899eb834ac8d799b162c916dcdea4d2a923eeb57c237f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636655, "uuid": "fd20f9bf-384a-445c-8765-9a746d0474e0", "comment": "Malware payload", "value": "ec1bd16be3372a801c755882cb8d46b8b553eb39", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636655, "uuid": "35d2363a-9c8f-47e4-a791-9672be50197e", "comment": "Malware payload", "value": "7f4a9fa310ce15597b77d1a556deb210690e903f71509b47a5f54f7393dd502f94c1de680c4e8c3d76f1996d3ee097a6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636655, "uuid": "01baee4e-f857-4e18-a004-ba675e4a3253", "value": "T1520594C227FBBD430417537A331526F5993ACA65D9C998CCF5893D58F0ECE02BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636655, "uuid": "0c27eee5-435d-4a14-8d75-582b597a221c", "value": "24576:qgQURQzFYsc0CpgVUxIhrI/PUhtzMvrDGiaexbqlVsm3hPK7JRrFNeQ1btKd/n7e:XRQzFYsc0WgVUxIhrI/PUhtzMvrDGiaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636655, "uuid": "faabf9eb-07b5-4207-9e18-e64689b9a76f", "value": 803061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636655, "uuid": "cea0d83a-4ce0-4819-96b9-14c2b4984e48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636655, "uuid": "1e724ffa-9404-477d-91f0-8aa2d1654c80", "value": "Document#002173.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67222e1f-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645560, "uuid": "7ab66843-fa84-4240-a5c9-499c00b39399", "comment": "Malware payload (Mirai)", "value": "61a9ef78124bfa49fb7b37897d144329", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645560, "uuid": "07278881-e2a6-4c51-98d4-19f9d9b64f47", "comment": "Malware payload (Mirai)", "value": "c2eef91b3807e0e8c6cae5f7c2f59de61835f15966223cabbd13af8a3cd5b177", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645560, "uuid": "27e3b218-a483-4beb-9f85-53f30c05be0d", "comment": "Malware payload (Mirai)", "value": "31a171905c2abbbe08bd1e197a07e0fb22297590", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645560, "uuid": "78657dcc-3d70-4a65-a851-14cc758de292", "comment": "Malware payload (Mirai)", "value": "efbc8d970c92fb5ee0fa6f2da5fa777b77c1b607a4806ea34f50f00c82124a84d883ba28df7babc279baf8b1552f78e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645560, "uuid": "cce653ed-8c8a-4fb5-9f86-0da4e60f3ae3", "value": "T1B3833946BD818A11D5C513BAFA2E018E3313677CE3DE72129D10AF2077CA96F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645560, "uuid": "59e4efe7-c63e-4cf5-bcfe-9e89a433799f", "value": "1536:oUna8/ySIvb2pxX4Piu3NYpNzuFBVEG5aXsawQnMvif3G4U5HYQNs:BK/6HoP/xVEG5aXT3G4UpLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645560, "uuid": "c182a609-0b12-45cf-a85a-2d6b582c3d0b", "value": 87504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645560, "uuid": "998dc867-b818-4482-85bf-b9fd1c4434d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645560, "uuid": "1ef6e557-4067-4dc1-957a-155d98724d9b", "value": "arm6-20230706-1212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b269e8c-1bed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688641647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641647, "uuid": "586da6b4-6d9d-45e8-b540-31b8057fc694", "comment": "Malware payload (RemcosRAT)", "value": "e91b5280b65dfbe6ef39e4b70e2e1edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641647, "uuid": "bf3a64f1-4ad6-44a5-8f12-ece6fb870662", "comment": "Malware payload (RemcosRAT)", "value": "c322d551fe9fbd816dbfcdb273ead2c91045982721dd8cf540b51394dfee62c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641647, "uuid": "560bd5a8-c8ce-43a6-b6cd-8efe273cbe34", "comment": "Malware payload (RemcosRAT)", "value": "d727ff655c2af89cc87a514dde82dacdeeba1989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641647, "uuid": "ce387cbc-6d57-4ec4-898e-41f14761d0f7", "comment": "Malware payload (RemcosRAT)", "value": "22d0a52ab2faf5e5f5a35ff8a340cf76caf5c771b6ef10c9d8e0698aa7ae62bb3af5c4f789e29c4a6adc602e2ac7898f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641647, "uuid": "2f787bdf-bc3f-45cd-9bc9-df3f3ccec6a0", "value": "T139341258AB2ED859D1D4C6FC8514D6F222E95C7E0D2665CE1BD8FE2FFD27200EC910A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641647, "uuid": "245120f9-ae33-4e3f-a349-cf924191ee21", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641647, "uuid": "75bf34fd-d8d7-4403-8ce0-52dbbc8b7c6f", "value": "6144:8vGSN9gWuLpcBKnVBYAsmrzpyDfOXXVYB:8vbGWulcBKV3uOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641647, "uuid": "0acb45b5-19c4-41cf-8923-707d36d7d0df", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641647, "uuid": "6ee0d83f-875d-4503-853e-bc27469930e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641647, "uuid": "e3baab9a-f15b-465c-a8c9-d7b85c130965", "value": "bOe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4d3d4-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688654365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654365, "uuid": "430b5f1c-57d6-40c4-9298-35b445a9ad49", "comment": "Malware payload", "value": "f3988fcf1d4348e0f71022b513b964cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654365, "uuid": "c9efa44f-1240-4336-bb11-b1b777144a72", "comment": "Malware payload", "value": "c32338cfc3b63975693a3e49a0a2d4d08a832b9ecc65e6f18b25140790df2de2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654365, "uuid": "ccf929fb-db8b-4977-bfca-85b3ba6600c1", "comment": "Malware payload", "value": "e93061c33aadf7c7c70c1f077153a3c8446d08ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654365, "uuid": "823c3479-d3b2-4301-8fc5-44d9d1391d7a", "comment": "Malware payload", "value": "79002674eaa205b5633a45f583438af5f00f143333d4541e5e3260529dc2a8fdd01b6dd8dd980def1011215c4c73c7f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654365, "uuid": "dcc75833-aa43-45e4-bc95-40c896d8fc6f", "value": "T174448C5074C0C472D97A2C345674D6B04E7EB8301DE0DA8FABD8597A8F326C2E625B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654365, "uuid": "72c553f7-89b2-440c-b561-a8c1a34c957b", "value": "60a9f944f9f5c6653644f1538358ce64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654365, "uuid": "b69b8f73-a74f-4bca-b7d8-a6a610bb8b3e", "value": "6144:uZL+74MyFAWMVF7WZ+XvUerPFdmgxgbYSv4Zul7nbo7Vym:up+7vyFAWMVFyZ+fU6PFdmJYful7boph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654365, "uuid": "f41cfade-2076-49c0-aa69-81bacf6339a1", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654365, "uuid": "89541ce3-5199-4e2a-baca-c88b5d9fe6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654365, "uuid": "e34b17b1-03ea-4468-9289-87911cef6f80", "value": "SecuriteInfo.com.Variant.Zusy.475489.30987.837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a390189b-1c19-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688660693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660693, "uuid": "b961f7d7-ab6b-4d49-a66a-c97bc08a7cfa", "comment": "Malware payload", "value": "b22dbb54f7bdfc4308986b1cb4bc0fe2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660693, "uuid": "6cc39073-e98a-4126-a212-c08149897995", "comment": "Malware payload", "value": "c32a13f2ca98eb1cda57b99f86bffa2abc60f5f4def96b482c67c2d5ee20e085", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660693, "uuid": "c59ac28e-f131-4f7d-b4e2-a3f8e919ba72", "comment": "Malware payload", "value": "8363c8ba8999a5792d945509952f37fb4a2d9015", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688660693, "uuid": "ba26bdb9-9dff-43d2-8f12-56ff6b486c4e", "comment": "Malware payload", "value": "3bfca9835b3759766159829dc81303ee4efa91f9e7b86ea6e6dc636a0ade4d946776e6c96fb6fff1059b892a39f377ad", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660693, "uuid": "48eedac7-2040-4aa4-8bff-e1fd3b8af81d", "value": "T15671FA20431C6D57DB5F42FAE399BE8682E7F17619CE2680531AFDB6007B22C5E38592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660693, "uuid": "4398807a-4d8c-42bb-9ffd-b841c8ec8601", "value": "96:VR2qnVRPyCSSSwXKnoAohBSxYCXuIP3UzqpuFZtkkMl:GqnV9yCNXlAcwZRPkmgRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688660693, "uuid": "4fb5511b-d918-4560-abfa-8e243c5daf39", "value": 3522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688660693, "uuid": "25b93d3b-3399-4480-a9f8-12ab2c4df6af", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688660693, "uuid": "979d1e41-fd56-44b5-8706-1226b6ae8274", "value": "Topos New order 06_07.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb6ffd8-1bce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688628468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628468, "uuid": "84ed42da-fd35-48ea-898c-9db563e35fb3", "comment": "Malware payload (RedLineStealer)", "value": "f04e248c58bdc958d74a3032ce146feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628468, "uuid": "22f6a28d-f6f2-4418-904f-393683551abc", "comment": "Malware payload (RedLineStealer)", "value": "c3711ef3bbb070f22c785cc6753620ae37542ffaa6cf9b175c8a8286e968ec4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628468, "uuid": "33ba2602-2f64-4d90-9011-bd112903e7b6", "comment": "Malware payload (RedLineStealer)", "value": "e32c52dfa6e97983b77febdaf96fba930bae51d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688628468, "uuid": "ea07d431-f04b-4f8f-9b04-67790f80198a", "comment": "Malware payload (RedLineStealer)", "value": "b070dadf9bdbb0cca254affbcd47aed5d34f81d063ca1de04cfcb082864e2e3352cdf025c6b1cef0d4ebde0882cbc84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628468, "uuid": "2db68353-8c1b-4afc-8d21-d25d02968fac", "value": "T117560112290C5C1FA5B634211FDD0193B8AD53696B170D9231D2EEEFEBACD80FA9572C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628468, "uuid": "77036505-590f-4048-a08b-72c96dbb459e", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628468, "uuid": "258e17b2-59f5-42b7-b7ae-a322333c7b42", "value": "98304:YOVItWWoAug8GxU4HDwJPZSEjBfpZ8BDyDAibM:YOCtdoAox4HDwfSas1yDVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688628468, "uuid": "5cc481b8-7c17-437a-b62c-375049a55ee8", "value": 5982024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688628468, "uuid": "40ff2359-93f4-4a93-b740-a6c0a52951a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688628468, "uuid": "b9369896-c896-49c3-b8a3-1c1834705593", "value": "f04e248c58bdc958d74a3032ce146feb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ce37f5-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688624405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624405, "uuid": "376aed90-e20b-4778-be4d-66df0d22f18a", "comment": "Malware payload (Loki)", "value": "93dd7f656519d1de7e3a665cc291428c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624405, "uuid": "6443829c-730d-45f9-910c-7cce87a62603", "comment": "Malware payload (Loki)", "value": "c3d57a118cd5369dc4d9b50ef6d631ead1a0922f7074c861e2b6b02230fa6047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624405, "uuid": "13070176-18b0-4b22-8351-ab4feb8a28d7", "comment": "Malware payload (Loki)", "value": "095fe46a5738af6fba8ff36aa56b795f63df865a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624405, "uuid": "048e3b22-dc09-4463-84a7-b44f94f3ce75", "comment": "Malware payload (Loki)", "value": "ca0b672cce1d1616f955ca7675ab80cda4884596d117e2c5dc65a925afbd6a868474451c6fc3bd4c85fdfc531f89000b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624405, "uuid": "1dd2ac9b-6fac-4f46-93d5-eddfed9ab222", "value": "T1F1E46B3C1CBC7622C174E6F69F9CC421F654986B3E61DE3769C39889461EA0229C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624405, "uuid": "c6dd669c-2eae-4eea-9293-e071b0eee9b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624405, "uuid": "69112ad0-5333-41df-8e02-546a8728a133", "value": "12288:Ez33jhnjhANmFRrkF6dr3zU6QnBEKpqbW8RkJuPqk/N:EzHNnNAQFqsZ3QVnBxqyKQ0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624405, "uuid": "c85ec615-7e5c-4626-bd2a-2e83b1c85a36", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624405, "uuid": "fe089917-3b2a-4a2b-af66-451be43b83e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624405, "uuid": "982ef884-a173-4f51-a318-e587df7c8b22", "value": "UPS_Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e90a95-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688636892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636892, "uuid": "05dc968d-2e5e-43cf-84d4-cbbffd1c3c24", "comment": "Malware payload (Formbook)", "value": "83804c210ecdae26f284783ae9ed4cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636892, "uuid": "1cf2f898-9ca2-465c-bf01-1243c6c05c98", "comment": "Malware payload (Formbook)", "value": "c48c1d65bf3e58d5dc4b9876db6da4d90e93ca74b4b51cd35c7b7400d691c182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636892, "uuid": "7e6ec556-ade8-40ea-abdd-1bf1395c3cfe", "comment": "Malware payload (Formbook)", "value": "6f2d34c95b6d4313074ff8111ebbe27ab76fdb70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636892, "uuid": "8bf38546-f882-4942-be19-49f228a42449", "comment": "Malware payload (Formbook)", "value": "4ec832d5ecafd354319f7d2bfd4573573c7746c43991da1802f52e518dbc531307f4b5ddb6e38ace0d1b1f2db1061146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636892, "uuid": "ec932246-7022-48ae-9d2f-d2cf75a808b9", "value": "T1984512017BC590B2C0721C325A7A5B61B63DBE601FA5CECF53D07A6E9A326C0D7317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636892, "uuid": "ad2910bd-eb72-4457-b684-65f321029600", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636892, "uuid": "5c4e2c30-b97b-42db-9ea6-4fd7e0bef654", "value": "24576:wTbBv5rUk0FHSdWGawARX8l45tHwoD9sfBnX7SWXMdAfRd//PA:iB3aydWZRX8l45tHwoDaRXPMUlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636892, "uuid": "b17c5d7e-5add-4523-8d59-e8f3969207d5", "value": 1167479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636892, "uuid": "403b780f-5114-4367-9da4-108e0747d0da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636892, "uuid": "43c77e8e-389a-441f-8add-71e47807d8ac", "value": "c48c1d65bf3e58d5dc4b9876db6da4d90e93ca74b4b51cd35c7b7400d691c182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d5b39f-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648297, "uuid": "85e27ea0-eec2-4a91-8e21-1bce8cfbe52f", "comment": "Malware payload", "value": "3f3373a1d98d5b35922f09dd8e310419", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648297, "uuid": "d48dc951-b52b-4c59-b62c-59c5fea07394", "comment": "Malware payload", "value": "c4a27174f58097d6a203c21801f04a463790ee2a3adbb1ca13eb8da7f0ebb376", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648297, "uuid": "c5fb58e9-2f37-4964-adac-b9df11a269b0", "comment": "Malware payload", "value": "c87cbd0a21fbf5ebd3e7738193f8f13d2be2b852", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648297, "uuid": "24baf1f6-bea2-458b-8501-62af8af53998", "comment": "Malware payload", "value": "5558218f13a8fbdec12a7b667efa5143079520624c5330676a82d87c35d5c3945256524455b55751c74408fa74b93404", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648297, "uuid": "fbdd5fa7-1029-4c23-9edd-3eba4cbccc78", "value": "T130F32AC6DB417E37C1C26BB5FAEBD24533E39710E39B23059558AFF02B4BA990E16109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648297, "uuid": "35150375-23a2-49b9-8f4e-9c289ea795cb", "value": "3072:dn1Xs3ixHagCKLlEMZYolja9kbmWe/CSULM/9wgaWiAE2:LXsYHagCKLlEsljyD/CS8M/9MWiAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648297, "uuid": "15ea4e32-7045-4d9b-a740-9fc7c160456b", "value": 159179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648297, "uuid": "e7160051-ae37-4da6-9dfe-8db3b179e793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648297, "uuid": "d109657c-9f88-45dd-958b-9e8d46dcca55", "value": "armv7l-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6539e511-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688622793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622793, "uuid": "66ce64cc-443f-4057-9ca7-c650bc8b559e", "comment": "Malware payload (Mirai)", "value": "44c9f2090c93d9981997fd615941f0bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622793, "uuid": "ff54d528-1e48-4ef3-8ed8-e79fee785d13", "comment": "Malware payload (Mirai)", "value": "c530e6cdbd8fc90fcb2e891deef72ab74bc91b34096d09eb158ef97cafd00a67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622793, "uuid": "ed49066f-2b29-4d36-8dbf-587c63510a56", "comment": "Malware payload (Mirai)", "value": "02b1d075577ffcbe0cbbfbfd833d4e6faf2f5e0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622793, "uuid": "ac6f48bb-2215-456c-84f3-e99c7a833f4e", "comment": "Malware payload (Mirai)", "value": "705a1fe06686d200f9005378625f41aba49520e4223cd055a596630e339be7172bce101bc96d63107676814a9bc7ff49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622793, "uuid": "09b344d5-8aa4-4f8b-a0b7-a9c4a60c33ce", "value": "T13EF2E18253094631D4B16D71FDAD470CB3BC6CB5D0EA3871E758222EA5DE15097BCEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622793, "uuid": "d7b4f028-a8ff-4c7b-a9ba-0c09dda7b992", "value": "768:yVFM0uLSjmziSl6U9fnMg9ipFlmJ1YHO5aLytXVj3Utr:4FrSeSl6U9fn0pPHPLybmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622793, "uuid": "40bd7b80-fc50-440e-8d2b-78115a492b1f", "value": 36296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622793, "uuid": "76a622ff-cc17-4231-b0d0-c36fdefc873d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622793, "uuid": "707a2397-8183-4183-9394-b7d68ac4e393", "value": "arm.nn-20230706-0553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e5ae5a-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637122, "uuid": "46f65938-7d94-4aad-a25f-1562ea88d059", "comment": "Malware payload (Mirai)", "value": "2b191a519ee10892fc924679e58c1f43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637122, "uuid": "41ccf922-0889-4f0b-9149-96fa968102bc", "comment": "Malware payload (Mirai)", "value": "c5a020b16224d1c21d374f68e4796b0c82c864fe276a50a799a5d2fd4acc5532", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637122, "uuid": "91aef962-af9c-4530-980e-d5c2d41735da", "comment": "Malware payload (Mirai)", "value": "bfef6f961c821efcf489b3683791233ecb2d3159", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637122, "uuid": "254ad8b5-dc15-4c7d-b69c-42d3e9448f72", "comment": "Malware payload (Mirai)", "value": "9fb914f43159d56cd35a8aa03f13b52d904e7a7f9a8d5ec5540affb7680e281227829cd637697331a902406383c09973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637122, "uuid": "3d4c7056-1180-45e4-a4bb-073bce9cf8ed", "value": "T1A9E2F2A79371A052DDB82AF1F97E858B5B7D4B6CC27630E3171556182F9A0435E3C8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637122, "uuid": "0ebbc4c5-5140-421f-ba06-dafd47ed165d", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9Xyo2NT9q3UEL5IW:uorm1vpALgUJyofLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637122, "uuid": "d4ebf560-a738-48a6-8f2d-c9faded12516", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637122, "uuid": "56c1f94f-28a6-4afe-8c11-1f1a7376b9fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637122, "uuid": "586e6db3-8d09-467f-b4c6-a2ce1c45b4b3", "value": "2b191a519ee10892fc924679e58c1f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5d07eb-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624365, "uuid": "35f8af78-d4bd-435d-b946-4240390bf0d1", "comment": "Malware payload (RedLineStealer)", "value": "21b2b8906ea1ff28d5dcaaa6fc6d9d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624365, "uuid": "48b28c1e-99f6-4c49-8b0b-4d70b095ce79", "comment": "Malware payload (RedLineStealer)", "value": "c5bf6dcb03668fbb8c00847c8210b08fea20f4160429f936b9f82967f944ab18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624365, "uuid": "336c92a5-d3af-4b99-afb6-7d520681f0c9", "comment": "Malware payload (RedLineStealer)", "value": "e749cc40594d91d3a79e28f563813ba0054a12ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624365, "uuid": "739ba33b-82cd-448b-886c-b2a5687b00bb", "comment": "Malware payload (RedLineStealer)", "value": "190c5fc5a74a88edeef55e5fa641f516ba4cce8619382c04dc5fda74f2b2ce261c9b07a7ed037d533ff31e4492d21bb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624365, "uuid": "5e7472e5-0bc5-482b-abc2-92198a19b10b", "value": "T1B9060102615C8E6FE436363A77DC4453F8AD95B4DB090D8622C52CEFC89DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624365, "uuid": "e64af4aa-535e-4b05-86ec-0d205f676fa6", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624365, "uuid": "164b1b47-5588-46cf-859d-d7215cc8ba5f", "value": "49152:gUMSUuTrjNwrCvIGq0bqSOUMtHnOShaVZlTy4KqrYqvK/Bpv1RJnTtV24dsEWjbZ:UeYQeaFTy9PqYRrwIh6YpHtF3/cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624365, "uuid": "dfe12df4-fdef-46c7-b4ae-c1e170f8435d", "value": 3773768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624365, "uuid": "44d5abb4-3533-4104-b814-8b163501e4fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624365, "uuid": "fab175c2-6bea-43c9-9562-88dd1b62dad6", "value": "c5bf6dcb03668fbb8c00847c8210b08fea20f4160429f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7244e0bd-1c0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688655886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655886, "uuid": "742932e6-d220-4653-97c5-bd642492fc9d", "comment": "Malware payload (RedLineStealer)", "value": "32b7d57a7e6eab4932dd5b5b22fc99fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655886, "uuid": "f5cfd586-5b87-4973-a4f4-2ce884d702f3", "comment": "Malware payload (RedLineStealer)", "value": "c5eec83e0c42c18acdf0ae1888f94248a764e32f71ff5494041bf8d5b4193c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655886, "uuid": "0190f93e-7249-4061-93ac-1d30d0666d03", "comment": "Malware payload (RedLineStealer)", "value": "6d51c2947263d2dea1b8e4056c541b9efa6a5fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655886, "uuid": "3d6f045a-c861-4467-a5db-dec238de7fc3", "comment": "Malware payload (RedLineStealer)", "value": "20a8f4c47ccd83cd173d414fe8ca522dc5d05a01f9641344cd18cf8287ea0398dfd752edfbb493becc4fd684e111017c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655886, "uuid": "c1728026-6a2b-4343-b59e-47de1717d130", "value": "T1984439123C92497BCC29E73BE91A8E46FB15E10F512DCB64EB31D5B6BA43F450261E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655886, "uuid": "5b55fd69-3280-4ea4-8bb6-22507ba563c2", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655886, "uuid": "aab664a9-f3fb-4f06-adae-2150887f80c8", "value": "6144:vMf8QDBjPp+ly2WtzH7NrIrBJjvft5LZFL92hUPEIWz:NQDBbIYR0vfjZZ92hUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655886, "uuid": "72379d96-0952-4536-8575-ea5d59b53eef", "value": 260939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655886, "uuid": "77faa9a4-86de-44c3-a3ef-15b08066b136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655886, "uuid": "111b1eec-6b24-49b9-83c2-ff9d233c7bb5", "value": "32b7d57a7e6eab4932dd5b5b22fc99fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a920cac3-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623766, "uuid": "abfd64ac-d895-43f1-8784-bb2f9dab45ee", "comment": "Malware payload (RedLineStealer)", "value": "cc6e77f3b3d847eda0d8f5162317337b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623766, "uuid": "eac078a5-2f91-4010-830a-3992535e97c4", "comment": "Malware payload (RedLineStealer)", "value": "c620e34bdd1cd272c00b625621496a3ec6376b7a014e726d1ee2e7e37fa8e2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623766, "uuid": "7941008a-d3ec-4f79-80eb-3d0f265a8813", "comment": "Malware payload (RedLineStealer)", "value": "72cb7a1a3e067213cb8410d22869e11d4fcfff62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623766, "uuid": "9a68714a-8422-4be6-b1e7-9161f7396393", "comment": "Malware payload (RedLineStealer)", "value": "87bf9da87a5c6367421ed13ddc4ce4670658d4ee965ba35ca4ac83932e93b2c9f2ababcd1b1edd3efb950c5488b4cbc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623766, "uuid": "91622401-d48d-468c-94cc-34e0d6bdb37d", "value": "T128160118606D9EAFD57535B027DC1593FAAC6874271F0E0122C2ECEFE8ADC81F69199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623766, "uuid": "25e3066d-96b0-457e-8df3-6dacb1b17fc0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623766, "uuid": "f471df04-aa85-43b1-9010-5d863d585f13", "value": "49152:ppgFF+9B8dKeKT6Uazz1VYWLmlPxe2U8SxSbJIxNB2kj3YBEjemxkXIBeajldxOX:uKWUC/mlc9SubBj0zSla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623766, "uuid": "3c6c6574-986d-48ae-921d-8514f73ff7b7", "value": 4067656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623766, "uuid": "32143cf5-6370-446f-8e00-76045f78cf8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623766, "uuid": "488cae11-56f6-4e96-8882-1acd150f9bd4", "value": "cc6e77f3b3d847eda0d8f5162317337b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e75392-1bfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688648301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648301, "uuid": "fe59bd11-4109-4a62-aa2d-2906940ee12a", "comment": "Malware payload", "value": "349b045018e5538a6ca46707c267c6d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648301, "uuid": "ddee72d2-322c-4c6e-9986-6ab7247a9948", "comment": "Malware payload", "value": "c6ded27e55df7558e6a9e216510abb9ba5098e4fdcd5a9bedc309a7052c121c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648301, "uuid": "a5acd25c-aa58-4766-a8be-b575d0f35313", "comment": "Malware payload", "value": "91b02c91ab7c0ff8ad23296cd7846c21cf6550d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648301, "uuid": "1cf0190e-1498-42ab-8045-bb234587fd09", "comment": "Malware payload", "value": "c516b9bdd665e61b873c97033154d462a8e361804ffb97e83ede326728ad7c747e171277f72d4e1afbf09114b1cc15c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648301, "uuid": "2eedd63a-dcab-4e40-b7e2-2a2b17cd63e7", "value": "T1E9A3F9C2AD527E33C2C2EBF5FBEBD24837F25510D79B3301A5D96EB04A1AACC1919254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648301, "uuid": "4cf0f281-324b-4263-858b-1467f8968e62", "value": "3072:1SjUb7UGiXL2GELOhp7UcDKg7ff6UWlVqp:db7UGiXFELOUOKg7ff63lVqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648301, "uuid": "32e777e7-a0ad-43e8-9902-c6abaf808747", "value": 105972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648301, "uuid": "ad7190fb-e9ee-40dc-9d5a-7b98e04ab687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648301, "uuid": "0f27ca3d-8a14-4467-a0f2-f14bfc47cbaa", "value": "armv4l-20230706-1258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c912e0a-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688645945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645945, "uuid": "75adb5e3-5d0f-45ac-9b09-aa843e5bbc06", "comment": "Malware payload (RedLineStealer)", "value": "0e164cfd932d47c532641fb9c7e25f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645945, "uuid": "eed114e4-4387-418c-8916-3a552d05d439", "comment": "Malware payload (RedLineStealer)", "value": "c7dd68d47ba050199add07cbb691881450370abdb83f39e6a6c11c2e7360c04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645945, "uuid": "e5982cb4-a752-4e33-8b62-39632f7340b3", "comment": "Malware payload (RedLineStealer)", "value": "26bfd6c4dd65ae8a20f41beff2a066d0c88af07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645945, "uuid": "a74116ee-9cb6-4b5d-818c-f16b0178ea20", "comment": "Malware payload (RedLineStealer)", "value": "f6cb1de5493865dc60b587950bc03411fc7d5f54fbe6cc3ab6dd8952b79f018f402f7b4dd2737e7055bd752f950e3604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645945, "uuid": "dff15708-913f-49d5-a8f5-82f04fb77d9b", "value": "T11F55AD05A09D1D5CC672E3B2BADC23523DBC8474291DA13952E21DEF99F9D0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645945, "uuid": "4bca4b5e-acbf-4386-a797-b9cdfaea73d0", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645945, "uuid": "1c926f20-b4a5-47a6-a9e1-a9b10e0800d2", "value": "24576:AzmLXJOAVnSCe1pWcFm9KPz33qLtkUSxBk+NVQUk:ASNf/e1pWgm9KPz3aLeUOvNVQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645945, "uuid": "efe56a6a-7206-4351-9e0c-0e8eed69dfe9", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645945, "uuid": "daffb353-da40-4819-9413-2fda7e0e30ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645945, "uuid": "86c2bc86-0213-41fd-a662-df7412d5ec8d", "value": "0e164cfd932d47c532641fb9c7e25f4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036708ed-1c1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661713, "uuid": "30e103b2-d4ae-4786-8846-c7ad39139b8b", "comment": "Malware payload", "value": "360f0e4a6a1effd21ffeac80ad3a0a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661713, "uuid": "6b6b2580-d3b6-4bc6-a291-7626ec8be9b0", "comment": "Malware payload", "value": "c806b0e3a7c2d1efb4170931ceb91efe9e2a9d677c3e9833cae188776e01f148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661713, "uuid": "4b21f9cf-4522-4e47-babb-ad9386bfe153", "comment": "Malware payload", "value": "d37a5cd0effb4c1c509460a906c0c56cf0bced86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661713, "uuid": "ae7fadd4-d07c-44dd-98ff-8e8e8b135430", "comment": "Malware payload", "value": "5dbdf312956f73b45503220d14961a7882005bf5429c2f89f55fa57530c572b91418bc13564df146db7a2747a26316fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661713, "uuid": "dd8921bc-e659-4b4f-a646-6d45a7f632ac", "value": "T197A5B983BA469DE1C185573AC6B7983403B0D54123BBF60A798E232A55C37BB7B49D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661713, "uuid": "a3937e55-82da-414b-8044-d7719c3f335c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661713, "uuid": "878de32d-64fa-489e-9c63-aacfefabcdce", "value": "24576:S58eKasUSIBtKnaoEGpC/nA3DhWc0b68herEh5S:SKZasAjKnaoEmCaWc0b68h4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661713, "uuid": "ed12e8e9-c2e4-4d1c-8e9f-011de64662af", "value": 2097664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661713, "uuid": "5a3f665f-9d4e-4e6f-809f-0743e7fd4f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661713, "uuid": "a02bd884-2fab-44d5-88b4-eecfc6e4d70e", "value": "Sipari\u015fi (P.O_5220288)_GEMA ELEKTRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7942f3ff-1c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663629, "uuid": "8a1f5b96-2d40-4c14-b100-6ee26123348a", "comment": "Malware payload", "value": "ef7d916fa1bf81143effbc5fdb4b0805", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663629, "uuid": "f80e0144-ed8b-4600-b935-70189b5a35bd", "comment": "Malware payload", "value": "c809e81fed8fff4660a47b593e105b8f514ece73ed0142ad3a0a2aec61bdd387", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663629, "uuid": "e81ae7e6-71f7-4a07-b28c-40e092c759c2", "comment": "Malware payload", "value": "c5e1503849e5e79c925e9606ff604ced5609fe37", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663629, "uuid": "f58419e4-97e7-4dc4-9510-4dcc811233a6", "comment": "Malware payload", "value": "e2694039c8ff253d203eff76bd5839aa90cf1476b11904a521a5f329dada1513ef48c1836ae1854163f98c224cfd38c9", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663629, "uuid": "7d9696a8-c5ad-4e65-8c72-eb5f7d26e5cc", "value": "T16BD633B8F0B9D1737DA8E64E56AF4F2EB59118E6CC0C0C219CC818DF27155C29EB66C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663629, "uuid": "2864f506-3071-4496-9094-0981159d7233", "value": "196608:PLZo7gearilKMUYgusnnYR/28Xqe6qlFdPxpvaQrDu1O/0Y7f+taN0ehj/S92eDC:PKar6LdanTe62FdPtrDuc/0LauYk2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663629, "uuid": "7d447374-19f4-4936-8a48-4f258fa00d5f", "value": 13853006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663629, "uuid": "a02dc568-630f-4d07-aa63-9b9cdc95a424", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663629, "uuid": "1fc8eaa9-f514-40e6-a356-f09b2baa6f84", "value": "Evolion.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e87a7b-1bbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688620427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620427, "uuid": "9cecb66b-ed7f-4a6b-ae09-73f62b68e559", "comment": "Malware payload (Mirai)", "value": "bc152acad73829358847e5f5bbf3edc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620427, "uuid": "85bc1429-fa17-4038-8736-3ee407fca0d7", "comment": "Malware payload (Mirai)", "value": "c8b0e1c5fa98bb407fe5bd3f2760b0ec2e5e33db0cee10a0085cac4505ef16cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620427, "uuid": "c8924245-c0a1-403d-91c4-fa7251b9684f", "comment": "Malware payload (Mirai)", "value": "f2e26e44709ba5a9766c3c00226bdb663ede5957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688620427, "uuid": "4409417f-58f5-4811-ac26-e0c87808bd4b", "comment": "Malware payload (Mirai)", "value": "840d25350a22820e05f3dc783e772d6481d709fb2e75a8666e98a87681d11fc1759417be6cabeb3bc2f76c2bea65b9c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620427, "uuid": "c195fd0b-4c82-4574-b232-4ec075cbf2b2", "value": "T1103494216826E213C0D7FFB9FFE676856319F2564F8A6303A5A4205D0EF595D282FCC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620427, "uuid": "355084ca-83b0-49ff-9d35-fbc63353948f", "value": "6144:wvfshJAkxN6tWLLNttaipUO8P07QpzDPoRbfy:TxYtWteO8P07wzDPoRry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688620427, "uuid": "06e70cb2-3122-4da3-904e-407e7019d1d8", "value": 244647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688620427, "uuid": "5430a42f-192f-4463-80fb-8bc904de0af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688620427, "uuid": "d8555c2b-dea0-4267-8d68-c6f302f93a5f", "value": "bc152acad73829358847e5f5bbf3edc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41107c02-1bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688648932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648932, "uuid": "59ca7f43-308c-4965-bed8-67f9791e0fa6", "comment": "Malware payload (GuLoader)", "value": "b90bfc72d86b5af5795a952d88c0ab7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648932, "uuid": "4c7b9aad-fabc-4009-a733-5da48b49a400", "comment": "Malware payload (GuLoader)", "value": "c92b8de7afab714c39ef49e954887a849f7e0e73c1e916ca20c5db06477551af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648932, "uuid": "4bfb4adb-ccc6-45ca-9796-24e55090720c", "comment": "Malware payload (GuLoader)", "value": "41f84d2d2c45da312201a48185b89602b1f55556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648932, "uuid": "8d041a30-ae70-4243-93ce-f8d735a5360a", "comment": "Malware payload (GuLoader)", "value": "533fb1c9117a9cc14cdf4e6ae8e6a14754ec3d8d5b1b06923f99b9cfeabdc5d4c2171afd9aeb86b0f9d2ef31043fba70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648932, "uuid": "40c63eb7-b115-455f-a814-eaf36d79d080", "value": "T14AB47BC6EA518572D55B5630267DBE2A4A19AFF4306CCB1448EC3C4B7D31B0D3A93EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648932, "uuid": "e2cf7900-9691-452d-959b-437625f5bda1", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648932, "uuid": "b7200d95-f865-49ec-88d3-cef5dc2e23af", "value": "12288:PzqdPcmSA/J/cNy1b7uOlI7VJryK4IlMcC1j6+Uq+1WrDBf7Kb:/O/BTdAjrZ3CVDzeW5Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648932, "uuid": "62718b06-ddec-4287-acd8-2f2ad9a670ca", "value": 513056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648932, "uuid": "4893cb78-60dc-4280-b149-781894414429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648932, "uuid": "f106cc66-24a4-47da-9f10-bc2cd21b33c3", "value": "c92b8de7afab714c39ef49e954887a849f7e0e73c1e916ca20c5db06477551af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3c1cdd-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661461, "uuid": "a56ba700-a28f-4fa6-8e63-16469777fef2", "comment": "Malware payload", "value": "fd7e758aa92a90eaae39ed45b2d6bacd", "object_relation": "md5", "Tag": [ { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661461, "uuid": "2f912eeb-4525-43c2-a484-53159a62ca1d", "comment": "Malware payload", "value": "c9e599da275abf8595baac8b05efe5a608d7e45103c2e921fdc41269d552edcd", "object_relation": "sha256", "Tag": [ { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661461, "uuid": "9ad44a32-af4b-4cd8-9025-6815ee1c9b87", "comment": "Malware payload", "value": "f033f96706be45da30bcffec0a1c07141d8db408", "object_relation": "sha1", "Tag": [ { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661461, "uuid": "7af8a10e-4d18-4a2e-ae2f-3382373e3682", "comment": "Malware payload", "value": "e7e8a492585c276c7e97b4b1cdb6840cf4ab88b55278314c0418c5a132c5cdc1357f7dc6484c667365fde2f66c7f1f51", "object_relation": "sha3-384", "Tag": [ { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661461, "uuid": "56d37b9f-284a-4c7a-9bd8-f7a59997852a", "value": "T1C9144B315201BD9FAFFB0F8571142AD26C7831B7AF504118BBCE29E96AB45285D39FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661461, "uuid": "2e48bf0e-fbbc-40aa-ae45-b323eb9d4ee9", "value": "3072:9fuJ/Gcc2fnLvRhe29F+8GvZwkZ8WMqYlZ8jBOpSH5AxvVydK3WnmE78:sJBcQvzX9M8shHdtOpSH5AxvVyK0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661461, "uuid": "4d6c6e06-372f-419b-864c-930ac3231671", "value": 193162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661461, "uuid": "dac277de-5796-482d-8613-06170ba2a548", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661461, "uuid": "8e3945f1-6888-4348-bc35-399bfffe82b6", "value": "out.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a283b701-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688636640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636640, "uuid": "088ee7f7-b436-4b93-be51-f8ef6fa41077", "comment": "Malware payload (AveMariaRAT)", "value": "2f182f7025e5b78cca54e51cbf229945", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636640, "uuid": "c45c0e9f-bc2b-4654-bb3b-5abab58da09a", "comment": "Malware payload (AveMariaRAT)", "value": "c9fb3a8d01e154b4cd305f0113b1dad394159991ea5616bec94e63276a689683", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636640, "uuid": "8356ffe2-a214-4a40-ba51-e4e71cb3e4b6", "comment": "Malware payload (AveMariaRAT)", "value": "b2741550cb217f68ec9643a502ddb82b5edf6faf", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636640, "uuid": "f98ceb48-28c0-45d2-9521-f7d7f3fad39d", "comment": "Malware payload (AveMariaRAT)", "value": "efc5974d02f04d5a6e556430b251c32e3134c8453d869cf87cc3af3a453f31137d7ffc6283c8ab9fcf45370d6acac20f", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636640, "uuid": "37de392d-cfa2-4972-8fc5-b086eb98ea34", "value": "T11FC4234AB5C8CA8517C3501F7F768192B6FA70E162B96E32ABBFACCCB14160314E7165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636640, "uuid": "8668fedb-47b8-4d8d-a9a3-697e56b31697", "value": "12288:l9EQ+Hl1pYldUhcr+73CQxWAUjK08M18cd0uUGVw/+NmnF4wQ1:l+Q+HQUb37WbJD18c5UaJmn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636640, "uuid": "bdbf700a-ff4f-443d-a9f6-036b53ad5964", "value": 578337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636640, "uuid": "53e5dda5-5eec-4dc8-9b7d-8ad31d03310a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636640, "uuid": "c536075c-30c4-43d9-af03-90c9b49fd45d", "value": "SVR003884884835.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8475c2fb-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623275, "uuid": "3d6e1f83-315a-4e90-92bc-62e44ed23792", "comment": "Malware payload (Amadey)", "value": "8b1119bb5433be98639dad87cb5267f5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623275, "uuid": "835237c6-b817-4b9c-b71a-61c7d657b710", "comment": "Malware payload (Amadey)", "value": "ca7d45e91a76ffdfe2c06b1464a2f5a62b572e2515a4814132731895245ee17e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623275, "uuid": "d7520ad7-a67e-4807-a887-01a3c93a49a2", "comment": "Malware payload (Amadey)", "value": "29116f67e8a3752ea402cfb0ce8b4d11c0844b32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623275, "uuid": "8be97e1e-e857-4dce-bc27-76009ffb4433", "comment": "Malware payload (Amadey)", "value": "6f1e577d1f5c0381e5819404c1f03cd2ce24e7cf8423a7ba6f9ac894655d2fc3923d7a62916592ce4aabaf6cce88d940", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623275, "uuid": "a824d2d8-8042-4635-a8e9-1e175240172a", "value": "T101060101248DAE6FE53A353667CC0153F96CA474DB1A0D4522D2ADEFC99CE83F6A64CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623275, "uuid": "81cb68ae-e160-4d02-a625-ad4eae90b4d2", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623275, "uuid": "1bf5edfa-bbae-457c-93e9-c033a06b9c30", "value": "49152:HlmWcIdKotn7qoJaTTe087Dn6yLW1TAKi8wEIePRAuhEn4yjCW5nMYmliiR/H+Ch:w2diADn60QvguB+MYrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623275, "uuid": "6b50ec3d-33dc-463d-9402-ef7d83350d4a", "value": 3788616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623275, "uuid": "30f66cfe-99bd-4260-a125-49a4ea34ad22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623275, "uuid": "2bc23be2-0985-4990-a5f0-8d31b4fb7a20", "value": "8b1119bb5433be98639dad87cb5267f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb25ec62-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622964, "uuid": "4019d86f-7f65-4d25-a007-5816181f6334", "comment": "Malware payload (RedLineStealer)", "value": "68f844bc6244febea653bda804777142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622964, "uuid": "6819dd3e-12df-4941-adf7-94d881a70bbf", "comment": "Malware payload (RedLineStealer)", "value": "cab8efc9756c43db65b7b4e924422765f81441e4f7fefa45971b8473de164c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622964, "uuid": "c0792079-8b7e-4c5e-a073-8627af728db4", "comment": "Malware payload (RedLineStealer)", "value": "b105e81cfdebb6755778bf838c2b9f9fa9abd1c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622964, "uuid": "00637dca-1bf9-4ecf-b8b1-2bb91123d675", "comment": "Malware payload (RedLineStealer)", "value": "df76a4b58487e16c16cd54b16538e86029b992963ce442b46276f03dd8baa3d28f8b1883158ab66d9ccd891e0088feef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622964, "uuid": "d33fd4ac-5c8a-441f-9870-9797194f8954", "value": "T1C355BE05A09D1D5CC672E7B2BADC23523DBC8474291DA13952E21DEF99F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622964, "uuid": "b7f63756-cfee-4c2b-8e87-fad552913817", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622964, "uuid": "e86d2a1b-cc82-4aa1-ac60-30922a276e24", "value": "24576:yli2dGfYU5xpaCozrddBehxOFEYjIj2l9VuV:yGg1CujB6AEYHPVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622964, "uuid": "fc135541-689a-49fb-aaa5-b09c6e720072", "value": 1343820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622964, "uuid": "67c7e2ce-41d4-4839-a2da-96913e7123ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622964, "uuid": "cb4c1d8f-6db9-4da6-96ac-a15ba699c3b4", "value": "68f844bc6244febea653bda804777142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b05323d-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623581, "uuid": "e8d825ed-fd42-47c0-bbd9-b3960b0fe039", "comment": "Malware payload (Amadey)", "value": "978fea2106c86d4278d9c588f5bbaf95", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623581, "uuid": "75e75c8c-0aad-429b-a19f-54b7b580b8c6", "comment": "Malware payload (Amadey)", "value": "cacacef9c39e74f48bf9cb63efaf81125f0ba450f07b0f2e9854831f67292820", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623581, "uuid": "67550ea1-4024-49c7-b317-a2ea44aaff3e", "comment": "Malware payload (Amadey)", "value": "7bd5ae501151effa81d68ae821b759969037df05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623581, "uuid": "a6cd63d4-bdf6-4996-9e3e-d82b5d340268", "comment": "Malware payload (Amadey)", "value": "6d5de0e4c7c661442b3b831c85ab920fc2711bbe2ed68816f6c6cc4286a0354fbf99b0e3f546e12059bda04eba891102", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623581, "uuid": "2e377b6e-25be-4186-a442-a4ecf953fc93", "value": "T1AE060102619C8E6FD43A397577DC4453F86D9474DB080D9221D62CEFC89EE83FAA698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623581, "uuid": "eb35e706-1e30-4070-88dc-e953d02cb4f6", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623581, "uuid": "430b45f9-8528-4eca-a91f-02dd13c9bf90", "value": "49152:ksa1bhr0zffanC3/5mOrHnD398kcHQdPrF8Nz2rK4Bd04Poi1fTSrAFaWqimE7ef:xIHF2rT7Qi1fRwW77eys2cBSfM0Ww0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623581, "uuid": "9d7662b7-1cf3-47e6-b512-3fb5e3237e7b", "value": 3773768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623581, "uuid": "d89d1b72-fdb8-4d9e-942c-a5c17c540e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623581, "uuid": "b70aa6f6-8691-4a6e-a967-1809fd9a3915", "value": "978fea2106c86d4278d9c588f5bbaf95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdc9e72-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622350, "uuid": "002a375f-1503-4e10-98fa-c0d98e790789", "comment": "Malware payload (RedLineStealer)", "value": "158820de14556c867a7b4ed0abf8d356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622350, "uuid": "e7d3716f-3c66-4ef5-ad73-772831e69630", "comment": "Malware payload (RedLineStealer)", "value": "cb7d143b6d4d9d394d13b47ab17e502b73690c09958d4b86e1e06e8aa085536e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622350, "uuid": "8d6cea08-72fb-4648-b21e-a83df028471a", "comment": "Malware payload (RedLineStealer)", "value": "b6725d75e90067ce518e0a94c096ca8f33462dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622350, "uuid": "a9a2f1e9-02af-4a71-a097-e41badfc3548", "comment": "Malware payload (RedLineStealer)", "value": "f9bd0639743e3a6bcb2caedd5f7441befa1e5df69eb3603810cec7aa220f90262c5d53b4b231509e1f1735f0a34c1f68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622350, "uuid": "4219b986-3d07-4f7b-a8b3-221a6ded0c6d", "value": "T189560152290C4C5F927135641FCD646378A857B99B170D9232D2EDEFEBACD80FA81B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622350, "uuid": "ec0499c6-a5cc-4579-b338-bbc8dd3f38be", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622350, "uuid": "5e0eb36e-a338-4bcc-b4ec-6eb210c92182", "value": "49152:IoRjwnku4JWXgMJrw22XUOr2I0AWU9vQx2c7uKjbowdygI8qQPzQ2a2Fk4S2Xfxc:R5JWQMJ82tzca5I8Opak4nXf59nv8fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622350, "uuid": "9d34d63c-3676-4f08-9226-c49cef8f2781", "value": 6013768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622350, "uuid": "b7c088de-61aa-4242-9504-ff0838d00291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622350, "uuid": "2e88d4e1-cc7f-4d93-9848-cc3352ef9d51", "value": "158820de14556c867a7b4ed0abf8d356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2de36b1-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623782, "uuid": "823cf7cf-be85-47e7-84bf-bcdeb7f66bd7", "comment": "Malware payload (RedLineStealer)", "value": "96682a4060256cc902505cdd5a16ac81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623782, "uuid": "42a7327d-eaf9-4dac-a31a-3ac6e791d26f", "comment": "Malware payload (RedLineStealer)", "value": "cbd0c95fe9c461e74ffb592e26b4558a0fa20ee08bde31ecbefb26e5f12fd89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623782, "uuid": "ac67847c-905a-4de0-a12d-5a6573a5e651", "comment": "Malware payload (RedLineStealer)", "value": "9468513e6316aed7e2c442b28365f2681f9fa56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623782, "uuid": "23d705fa-2554-42ce-9410-8a24e6ad601a", "comment": "Malware payload (RedLineStealer)", "value": "de0830bb756a4954773ffcba4f3fabb50fa2b032c826dfd463499974f5e587079a87debc5e98ba2e2c48e4670437a1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623782, "uuid": "fcef389d-7cde-479c-aa5d-25a3219188b0", "value": "T1DE060101608C4E6FE53A787533EC4457F92CA474DB090D4662C62CEFD99EE83F6A698C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623782, "uuid": "3d37d530-4dc1-4981-a44b-edd940224f03", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623782, "uuid": "8d3f35ef-2de5-4deb-8a3b-af40a1879efc", "value": "49152:fWGFL5UbuCUmq/bDVOVhbN5T5PwoBmHQmU2rTYD1MH8deSmkUG8sOy4zI6Mql92z:zyoehmHIDKHMhxUGBOyF6BC9xrI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623782, "uuid": "281fcaeb-ff90-4874-84df-f1efc4cfb594", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623782, "uuid": "f874a527-4583-4c59-b05b-2a86fd1d455e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623782, "uuid": "9aee4abe-62ed-4a7b-8c6a-6c087c5feec1", "value": "96682a4060256cc902505cdd5a16ac81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5182d591-1bc6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688624908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624908, "uuid": "6c864e9b-8e70-4435-a382-869df12af82c", "comment": "Malware payload", "value": "dee2b9e8e169716088e68bcbb7246e4b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624908, "uuid": "7da57615-1860-49e9-960d-637abe4ac1e4", "comment": "Malware payload", "value": "cc00d91b8110287f107adba5e6ca8742d665056e93cd230ad5601975a9aef8a5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624908, "uuid": "70c94761-b541-4b88-9e2a-df2ac203ff8e", "comment": "Malware payload", "value": "1ce088abadd0ad39dec2ba0ee23f2bcf9bcb6da3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624908, "uuid": "365312e0-d1e5-4e06-924e-5559317b72da", "comment": "Malware payload", "value": "7b8d17e83ae2dff99fca0d6cebbec3a06bea3302d7558a377113279b92e286eec1098a4b4fbcaa5edd174173c030fc87", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624908, "uuid": "90edb181-a1a3-45fc-a703-def7106188dc", "value": "T118E1AF39CD9A4731553B5E76CD9C42C97F52F5879521A88F81EC8AE24D05A03A2F3B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624908, "uuid": "0a1e796b-1c85-42a2-b5b9-5bf516fa3bc8", "value": "192:5ZQrxG4jtez+pyiC4dZEi5+DpCX8v42xJk8WaH0Egg:rUxdiyJC4IicDpCXg/DkDaUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624908, "uuid": "8901a6f0-d3b9-4702-a9bd-d7e8102ffc1b", "value": 7142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624908, "uuid": "8da618cc-543c-4f19-b9e1-1bfc01d45926", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624908, "uuid": "de757a4b-ebe5-4570-a5cd-a088b0d9bb10", "value": "f59941a4bf784a3046d1f037075e4a36024f9a1724306336f5ac137ec746dfa2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285cd0d4-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622691, "uuid": "56b584d5-a180-4e44-9019-6b5e66b30d95", "comment": "Malware payload (Amadey)", "value": "4640e401a0de5b9fad288b0e51763b9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622691, "uuid": "e6889a73-4da7-4e3d-a6ee-7ebe407562c5", "comment": "Malware payload (Amadey)", "value": "cc6785030e787ce0bb04bdd22ec3d77fa8a01605047734d7e1a293b0e99752f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622691, "uuid": "b40b2e6d-13ca-4933-bf99-23dc34770f7e", "comment": "Malware payload (Amadey)", "value": "288100ea08727b4d01cc806fc04a30154e454298", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622691, "uuid": "28669c76-7de4-42c2-9764-03152148d202", "comment": "Malware payload (Amadey)", "value": "37d688bb3b397d8066a1de2490ebc9e827f32cace921b2ec0daa9106dc87de4ebd82a9fe49a9710379ca015881b6555d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622691, "uuid": "c4d862ca-b333-4b90-8ecb-719718cd7f2e", "value": "T13A060102619C8E6FE839353527DC4853FC6DA1B4DB090D8122D66CEFD89DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622691, "uuid": "0ac81f44-4ebc-4c69-aeca-ac730fef21fe", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622691, "uuid": "51e0ccc3-b17b-4036-a583-02fa9b2b5781", "value": "49152:YJvrP90lgyL7am6U4mNzsaWF5TvN2EGc1IHHaicuaD8En3R3nTUN6djgnXuW:wzUfwX29xcT5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622691, "uuid": "893df21f-a2fa-4e63-966f-c3f76ec53254", "value": 3770184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622691, "uuid": "c70d54c6-3d9b-4509-b9f8-2d410be5b77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622691, "uuid": "340f7967-bcc7-47d1-a4e5-dfdcd4a9d956", "value": "4640e401a0de5b9fad288b0e51763b9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761f3dce-1bff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688649450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649450, "uuid": "0c1758c0-f3f7-4b9e-97d6-e91c95c66eb6", "comment": "Malware payload (RemcosRAT)", "value": "e20590320804fe7edc4f00805f31befd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649450, "uuid": "4318e940-1b4a-4f93-8fc0-870bb3e641d5", "comment": "Malware payload (RemcosRAT)", "value": "cc97eccfa44feab9151a39e5dffd8daccf9ebb1a77164c9c09ad5e784d09e486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649450, "uuid": "5da2af3b-e6fa-4b74-8a56-f16f59704d34", "comment": "Malware payload (RemcosRAT)", "value": "f90974d1b7c0c9b46d1c3dbf22eccc64b85c89eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649450, "uuid": "ebd27994-cabc-481b-9927-dcedcd109298", "comment": "Malware payload (RemcosRAT)", "value": "77c8c3abffac7cd62926f793b88c60ddaacab6f8ae7d212f3ed7b919631bbdb68573313d488f1e64546e215415467a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649450, "uuid": "372c03cc-8ad7-464f-98a9-140e33414877", "value": "T130C40107B72C434DE39A4672393907318B68DF5315A4AD1ABBD0FD6C263654C7D0ABE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649450, "uuid": "76e145f7-845c-4eaf-8c0c-cd57856318b2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649450, "uuid": "b1936d85-b920-4710-a7d9-d1237b26b1e8", "value": "12288:0YgBbkY+5kNbvk7xEMSgT54ztBGFmLue1EQZ/:0YgB+5Kbka4CzfGKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649450, "uuid": "c854424a-90b2-4485-a96c-834fa7519b50", "value": 543129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649450, "uuid": "921c4c0a-9dcd-49f7-835a-2d77ea2296be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649450, "uuid": "3680a48b-211b-4a4d-9fac-d59f2f6c13ed", "value": "cc97eccfa44feab9151a39e5dffd8daccf9ebb1a77164c9c09ad5e784d09e486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a0e721-1c08-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688653208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653208, "uuid": "2e0509ee-e222-4cda-938f-c9e83fbe2079", "comment": "Malware payload", "value": "c85123e4d4bd6c9ef3deef3b87fc831b", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653208, "uuid": "8b006041-a601-49ed-826a-044c2598d350", "comment": "Malware payload", "value": "ccbb7510e84df49e1e6bd523ec739ddec71b67e84269d065b0d0ea3942f30471", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653208, "uuid": "3630ce9e-f1df-4cf5-a94a-aaf4e1cdee61", "comment": "Malware payload", "value": "d890822af137df48a91f4ba47a27272dcacc9920", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653208, "uuid": "ef9dc68d-bc6e-4ef7-b555-42f1c5177dbc", "comment": "Malware payload", "value": "4b156574fecc12d3a414d0ae44f6a1ec7b85abf99b6096f25a230d6afeb94e550dde73062f4914a63a8e371df569063a", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653208, "uuid": "85c45697-bb92-401e-82e6-fee40cb622b1", "value": "T1C747AF11B9AC1D29D2C7E0784D8E47A22732F5244135E6DB3936F23DAE62E53C71D32A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653208, "uuid": "a74a1f83-0122-453a-83cd-96826acd3542", "value": "196608:fkDNRAAhRooXJFRwdUA1jTxwP7kvMfU+I/VbYRtodgiDAoIEM7gIqlec0GKhZDam:fkDNRvBVwdUAhTYwvGgVYDOiasoI7Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688653208, "uuid": "1e5a90e9-2e31-45b2-bc8b-df0506d5d0d3", "value": 25164614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688653208, "uuid": "f3332156-f1f2-4bce-a989-a63a1bebd722", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653208, "uuid": "2f751906-6af0-4fcd-81ad-7d7e25cce72c", "value": "Launcher", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8133d81e-1c09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688653764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653764, "uuid": "c0bb4157-8bc7-4cb7-a9ff-8ae83c2061c5", "comment": "Malware payload (RedLineStealer)", "value": "2aa4cfc48ed85914fe82f00f5ce406bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653764, "uuid": "76fb940a-44ec-4878-962b-09a8b5c71d41", "comment": "Malware payload (RedLineStealer)", "value": "ccfbe98a43242d1fd993bdab2bc97035e6d749365058975c59f5f29893f366be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653764, "uuid": "7f287da5-cbb8-40e6-b558-9091cb93bbb8", "comment": "Malware payload (RedLineStealer)", "value": "5afb99cc26e5efe7ff9814b82b3d0794d08c8938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688653764, "uuid": "8cc985e6-c0f2-4959-be24-317b870df63d", "comment": "Malware payload (RedLineStealer)", "value": "07392481f72b210309c8ebd064fecdb41f01bbd5cd44eedc722449aba12974a76e494caf0f13090a83b1935603990c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653764, "uuid": "bcb19aa5-37c4-4262-be9d-17caa16d7f3f", "value": "T173B40233395055A7F089DA30997A64C1FFB9E3A53BB681DB712CD03A6B031E1D36831A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653764, "uuid": "9af18bc7-aa1a-43ca-bd25-cef90de374a0", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653764, "uuid": "f8bedeef-c669-4db9-a30a-dbe87b8c49c9", "value": "12288:NvJRfvzaRdnQgpEOVxp0Qtx3H9ASuWAyZBYiZgJD/:NvJdvz82gpEOVDqQBYiK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688653764, "uuid": "a60440e0-7e8d-4978-974e-eca3d0718480", "value": 524104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688653764, "uuid": "5b56ebe6-cca9-4606-861f-f1b84ca5da04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688653764, "uuid": "5924ca0a-1402-4828-9840-6095140feeab", "value": "2aa4cfc48ed85914fe82f00f5ce406bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1184c185-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645845, "uuid": "8ce234c0-bd0b-42c7-9997-5c28093a50d4", "comment": "Malware payload (Mirai)", "value": "2ba27a96236892e00eed9bc58d2d4324", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645845, "uuid": "72949df8-da70-485e-a6dd-4af5b31d503b", "comment": "Malware payload (Mirai)", "value": "cd31433e2ba76d891c21bfff3edcf0e8593b771f8b82457beb8b69039d3b2f80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645845, "uuid": "583c5bb3-ba37-4084-8e60-3dabcc214084", "comment": "Malware payload (Mirai)", "value": "c5bb27776058352d23e6b5e4a07aaf50b5f9abc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645845, "uuid": "923bb537-40eb-4fb1-b57e-2007e9641ec2", "comment": "Malware payload (Mirai)", "value": "e195240b1b7ea92f51497f80bfb510d31ed1ba67bc1531d01e7385fd29309201e022b47f219b015d586ddb411175fe1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645845, "uuid": "9e2eb69a-bdf7-42f3-aedb-1da203c5b270", "value": "T1F7834A9AF9019D7CF84BD63A44160D0AB530B2D01FA30F3B63A7BDA7EC321A56C16D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645845, "uuid": "023b2138-8143-4c57-b908-655553f4f3cb", "value": "1536:iYyKYP8dQO/G5oIHDtkj8jYGd8zCYIpTVGcYn7rkNzi00XeTBnH7:GO/G5oIHRRjYEFVxqt00XeTBnH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645845, "uuid": "d3e4e048-7fb7-4594-aec5-5ecc7e5c2359", "value": 82976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645845, "uuid": "0998552d-9e0f-49ba-abf2-ce69a147fc05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645845, "uuid": "16338df8-b7b5-425f-8760-02dc04ed48f0", "value": "2ba27a96236892e00eed9bc58d2d4324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b74e2de-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624495, "uuid": "73411991-e594-47b0-b56f-e8298dae61b7", "comment": "Malware payload (Amadey)", "value": "4f232b65a5db8acb421213bd5c500c52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624495, "uuid": "59d310fe-750f-4b61-a233-2afd15556803", "comment": "Malware payload (Amadey)", "value": "cd579bb9362503c738838c6d1d62be40532dc22a9b5ab9ae813272dc110a1199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624495, "uuid": "5b8aab37-fec6-4d9d-8d9f-1015486b005b", "comment": "Malware payload (Amadey)", "value": "d488618621dd00b8abb2d79bcd23149e944ee20c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624495, "uuid": "19c7442d-124f-4851-bfab-2c65368ae129", "comment": "Malware payload (Amadey)", "value": "a0b726030ac5ef57000d84aca6640ec6504e7b89ed968f8dec9a0c194197ee9fabe9d74be64d2e44663301b18a77e2c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624495, "uuid": "9a4aa22d-6509-41d1-9042-0f1aa0ec8279", "value": "T1ED161129505D8D9FD57134712BED1993F9ACA474272F4E0122C2EDEFE8ACE80F29199C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624495, "uuid": "ca3b239b-8c96-4309-bcba-7e9e15a398bd", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624495, "uuid": "2a88e403-dcee-4ebd-9d76-6650a8ad1e60", "value": "49152:ZnLRY+IFWokz8rX+4s8wIVIVP3tACo6ESz3V3leGP9jT1p5hFA/fzuA0PjL8SNqf:4Xhs/t+7SlFhFTsS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624495, "uuid": "e48188dd-4c4a-42a8-b692-9fef5574eaca", "value": 4081992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624495, "uuid": "30bb28a7-e743-4579-8f3a-de0d28ee2056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624495, "uuid": "f360d3c5-2503-47db-9ab6-dbe9c9c767a2", "value": "cd579bb9362503c738838c6d1d62be40532dc22a9b5ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd5cadb-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688624361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624361, "uuid": "75abe769-d4fb-4827-a39b-fe4ecf8c7a0b", "comment": "Malware payload (RedLineStealer)", "value": "fa85ab3da7ee5df99814a992d65afd02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624361, "uuid": "1e4ba228-dbcb-4900-ab70-1fb634fc425c", "comment": "Malware payload (RedLineStealer)", "value": "cdc9aea2a75cfaaebc176d4e83475cfda1caf1c7b32e43251e9b20c946da0385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624361, "uuid": "6021e807-da1b-4f3e-91e6-6ed6efc40c91", "comment": "Malware payload (RedLineStealer)", "value": "45c7e52111989e940f85a0e6c2797460cd564346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624361, "uuid": "29cded6b-462d-49ef-b2f8-484cd59afe08", "comment": "Malware payload (RedLineStealer)", "value": "5137bed9d28829d283b44eefd1f4efe9ff4004009f357de4af71d093602567b3234c97e01a5b6111371babee61f3f12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624361, "uuid": "023d3d2a-1aef-42b2-9f7d-6ed8093a1475", "value": "T1B8060102619C8E6FE436353527DC5993FC6C9474EB090D8222D62DEFC89DE83F6A658C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624361, "uuid": "b87e8030-d743-4058-9027-03d0c0e14db8", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624361, "uuid": "ff26b75f-17a8-4409-a324-bcbb89f1b426", "value": "49152:XJvrP90lESL7am6U4mNzsaWF5TvN2tbAhyleI12ElRvFnfnjxwRcOS8nwPNgcLLB:ZzAfwX2th5nfjmR1/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624361, "uuid": "e6de8d99-631f-4f1b-8eff-605a488c9d76", "value": 3770696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624361, "uuid": "8932762a-f40f-4a12-9166-be1a837c85c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624361, "uuid": "f3d1340e-c914-4106-a159-edc93e3bd07f", "value": "fa85ab3da7ee5df99814a992d65afd02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ab7a5a-1bc1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688622950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622950, "uuid": "003941f8-7cee-436a-acc0-17dcb25a64f1", "comment": "Malware payload (Amadey)", "value": "455b2e6fa5fbeecb5f9e5a9b8687af77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622950, "uuid": "fe99c7e6-834e-4955-b9b9-5a9be565f719", "comment": "Malware payload (Amadey)", "value": "cde04d38277572bee32d6e2cb621946b7ba25a6890fd48fa2e1e99b3262188e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622950, "uuid": "d70e9f6a-db65-4eb8-821b-c01b6a1b6dd5", "comment": "Malware payload (Amadey)", "value": "bbd0218a88e666c7e7823265880c6173874eee4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622950, "uuid": "73566a4c-0652-451e-a728-05c5d724863c", "comment": "Malware payload (Amadey)", "value": "01d5685bfc06bd9757efc8a15f1e918235b6ecda77bb6bfd186531a1641b30e35352012557e62804def9daf56a37f79a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622950, "uuid": "21afb62f-1844-4282-9dcb-e89b1d71fb42", "value": "T156560152281C0C5FA57638201FDC585339A9537A0B274DA671D2EDEFEBADD80F681B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622950, "uuid": "4043bbc9-c7b3-4df2-b8c5-b444047f755f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622950, "uuid": "2a012f83-6b06-482b-a03b-30cbc7ebf092", "value": "49152:OIF1euamkYQESMljphKSK1cgxhtwjPc/ENv3ilElOBcuakCcC6NB71bJJkdFUJrd:Ok4uaDsjphTUxtQvP6Jc0XVi54vsrTIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622950, "uuid": "c9c80aab-42d6-4d90-a144-87ae165ce3fe", "value": 6032200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622950, "uuid": "04cf256f-f3f4-47f8-8609-06b7c1afd6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622950, "uuid": "9a8c4310-3307-4f96-9875-bf2be9c2b25b", "value": "455b2e6fa5fbeecb5f9e5a9b8687af77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18510aa3-1bc6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688624812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624812, "uuid": "7a6587ab-0f81-4974-a533-0723a111aa6a", "comment": "Malware payload", "value": "f55d5813e823619765cc95fb4cccdc8c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624812, "uuid": "3b2315d1-e417-46fb-86b9-0f8660562972", "comment": "Malware payload", "value": "ce84b7c63a6d513d7211fdddf6d828f32974661d8f8e16b263a19c4c39b4a3a7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624812, "uuid": "9af267b9-03f2-4180-b698-9ce5d68cde20", "comment": "Malware payload", "value": "d7870e0d41b610fdb71fb905f5ce9be97bf8d9a9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624812, "uuid": "630d90ee-8d32-4bd4-808b-36dccdc419a5", "comment": "Malware payload", "value": "34b3ea85d56616ebebfa6a783408ab877fbe584377a43828cd20303f0090eb4587b109522df25e83671a1ee875847013", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624812, "uuid": "e64b3586-6553-49e4-b02b-6e319392626f", "value": "T1A603F14F34416505468B95FA27E0E1E7D247A128ABEFDC038D371D6A7A0EA42253793F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624812, "uuid": "05db9913-c9aa-4083-9794-629a760cf96b", "value": "768:F2exkjBwBmdcz7Z9AvxheRs5LUxIXypcNSSZ2FrYNZs+BxKLr:Fk7s9m0OpEpcwSG4Zs+BxKLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624812, "uuid": "fa2b5e88-7548-4c17-8e62-5ddf68de2feb", "value": 38334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624812, "uuid": "ee5b5c27-61db-4724-a2e8-7e5ed33abb7b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624812, "uuid": "e721ba11-4cb4-40a7-a79c-6ae605235328", "value": "34138201fdb272147eb45b38164a6eaca197c296f272537275c28b56d0214fd0.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba809509-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688648706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648706, "uuid": "dd0aabb5-09a6-417f-b70c-7b61f454d3a5", "comment": "Malware payload (Formbook)", "value": "4631dad986ba06a9516a9d474fe42d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648706, "uuid": "6bd16cc2-83a6-4ef9-9922-b964f7745056", "comment": "Malware payload (Formbook)", "value": "ce9a0c42305d137c27b4f369996a15387ae6f0d1e391116f54e7733918083239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648706, "uuid": "77cf3741-24ed-4b1c-9848-8fc192af9e63", "comment": "Malware payload (Formbook)", "value": "61937c2ab9c0f977fa1eb7b4770ee1d4023550e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648706, "uuid": "08c77330-ac8d-4f77-9ffe-8c3074410d37", "comment": "Malware payload (Formbook)", "value": "fdd3ff7845563cd48db133b80959845614eaba1a025204777dac9b4d86d87f872843a1003ed02352cd312365cc8fe210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648706, "uuid": "12fccfcd-11e5-454b-980c-7244de2cd597", "value": "T13205121D0BFB421DD6663FBD1D4441B2D3FF5AA6B037D60B8E9BB898AE0271509906C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648706, "uuid": "92d76e40-b3e9-4bae-9c8a-3743849ecf7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648706, "uuid": "9c4c7d3d-5c63-44d3-8fcc-b061c452c694", "value": "24576:h0biRoSErVxIE5BAf8/RqnzELr+Jbp5Brx:hy4oRrjIwmEACCJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648706, "uuid": "fa9f6aef-a150-4bfd-97ed-20e8fe32116c", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648706, "uuid": "28d81134-46dc-4c93-bf55-e678323ad76e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648706, "uuid": "9256307b-1965-422f-8e69-82f7842fbbd4", "value": "ce9a0c42305d137c27b4f369996a15387ae6f0d1e391116f54e7733918083239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3749b0a8-1c1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688661371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661371, "uuid": "74efa33d-e7e5-414a-94c0-5486daa45d0c", "comment": "Malware payload", "value": "a3fa964a51bcff6d62163011c6999299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661371, "uuid": "050da062-c150-43b5-9caa-6baf8e3af682", "comment": "Malware payload", "value": "ceb6cb4805529d4612832c8dd2a49aedd5a3feb9151311f8ab896bcf46411c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661371, "uuid": "33c9353e-185b-47ce-a20b-f88ed16e9061", "comment": "Malware payload", "value": "0cc1c0c346ea606eb9a2891a6106dcbff23af985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688661371, "uuid": "ee0bb198-34b6-44d3-b8e0-e816dc3e02a3", "comment": "Malware payload", "value": "4222e691d8c47f017074d70c42d248b5684d0d4f723fae0ad01f6fb63a4ad8b2972c8f37f55e69d37d1a810aa71fd06d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PearlLand", "colour": "#116ADD", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661371, "uuid": "f0225dd3-c6b7-4a4e-b859-c8d3c3c5d0de", "value": "T149B68D007491C032E57314328DF99A795E3DFCA04B1959EB77D80E6E8EF12D1BA71A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661371, "uuid": "e94bed18-8861-4dd2-9f11-d03df24dd40f", "value": "8b2838bd3da172e7dd503f6e2f29a648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661371, "uuid": "05bb0824-f300-4702-84a2-00182d5f7f1a", "value": "6144:Hw7dMn19BGX6/O9zPng83cykieAOaauarzsOM:Hw7dMn17GXcvprzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688661371, "uuid": "44ab4df9-57be-433c-ac5b-42bd150ac305", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688661371, "uuid": "e4b1febc-fc96-4b14-8c1e-a5d1fa1f9169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688661371, "uuid": "59636783-2718-4e20-a627-edd8b8d070dc", "value": "Pearl4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46a0736-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674439, "uuid": "7697dc79-7b9c-4842-ba04-c1f210ae9954", "comment": "Malware payload", "value": "156fa5a252573dcf03634fbe9df2fa6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674439, "uuid": "bad47553-a8f3-4e0a-81d7-845db5a2a087", "comment": "Malware payload", "value": "cee9ded4007465a04afa4330c621d9eba9f1a260eb4a138aa4e797a3685e4103", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674439, "uuid": "a9934189-2d66-444e-a778-e4ac69d825ed", "comment": "Malware payload", "value": "f73143379e262742e168a7c5ab191a81f1699dd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674439, "uuid": "5f1ab51e-b0cf-41d1-aa64-1d746407e484", "comment": "Malware payload", "value": "517e46f3b36a990e7183b18c8960afd1c2c6ace7b2c1c89b7822061d5fd67d8a881a6f7017e0135371a0d9afb8aea2d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674439, "uuid": "75a7d6c9-4614-4b5e-9eb6-e1b441c6bc03", "value": "T1B8A3F8C2AD427E33C2C2EBF5FBEBD24837F2551097DB3341A5D96EB04A1AACC1919254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674439, "uuid": "b925ce61-e932-451c-af8b-e4efd8a79bdd", "value": "3072:e48JDhUKLZlmJMZqQ8ePNXg6npIba5R7ffqU1lVD4:CdSeZlmJMZqOPNX75R7ffqIlVD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674439, "uuid": "3ca80bb4-c186-42c5-b35e-dc4ffe1d9c6e", "value": 105738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674439, "uuid": "425e58a5-8278-4df6-8c1d-7e22756cfd0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674439, "uuid": "be10fa64-bcca-414e-9261-1cec75c16fac", "value": "armv4l-20230706-2013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca5123e-1bd5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688631342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631342, "uuid": "7b538686-5276-4552-9357-73d572438400", "comment": "Malware payload (Mirai)", "value": "8bf5ad69fce368a16815ee8657288dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631342, "uuid": "4f3037e9-c8b7-4ffd-887b-1ff2959aa526", "comment": "Malware payload (Mirai)", "value": "cf1c165477ffadcdfc7ac5d96f2b6b1475d181df5c9335508a9220d4848d4315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631342, "uuid": "01b978ef-9946-4d30-be7c-75c23d6e72ed", "comment": "Malware payload (Mirai)", "value": "244ceacadb6316cd7ca85ab4f711f21b3de1bcc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631342, "uuid": "32efbe20-0853-438c-96ff-468f94f7527f", "comment": "Malware payload (Mirai)", "value": "7128e264df52791102037b2232ea8b376cbe9caf9208166b9add29ebbe25e4dd291b0ca4a57417d5e1544d267b7dacd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631342, "uuid": "71b0ac79-973b-4134-a5f5-6df7ca2331b4", "value": "T1D4336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631342, "uuid": "fc899578-df9a-4839-824c-196ed6171afb", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631342, "uuid": "f432f0e8-65c3-404f-a050-e28b3c0fa5fc", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631342, "uuid": "52a4fe71-25df-4ebf-a407-27623e87990b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631342, "uuid": "df9fd8f7-1dfd-4b1f-be1a-6437a6edea07", "value": "8bf5ad69fce368a16815ee8657288dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8358d37-1c04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688651709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651709, "uuid": "85a78f8f-c38c-4b33-80ba-047750cb3e19", "comment": "Malware payload (AgentTesla)", "value": "ce7885fdc860d94837d2fbe6a1421b1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651709, "uuid": "f824bb36-9419-4e7b-b969-9b7bc9f04297", "comment": "Malware payload (AgentTesla)", "value": "cf1eb9b3d862c9f561c215d3c9c49795fd822b4022e325368963376014fce4e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651709, "uuid": "8871908a-5031-4cfe-931a-7d0ebdd9589b", "comment": "Malware payload (AgentTesla)", "value": "c0f4139b172942ea519066d1f4223788afb7d0c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651709, "uuid": "091c842e-ec50-49fa-9048-7996fb8c4a6c", "comment": "Malware payload (AgentTesla)", "value": "b52d093ea94bc0cd431e9e7fdae6cbb7b9c156416ac3260feb0d8761e9fb0cd507a6ed57050f5fb1c7735082fc5a3afa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651709, "uuid": "0fdf7d33-f87b-4e0a-a1c6-b3fabfcc4e0e", "value": "T1D905D081713D1A63EAB9CBF5025062B087F62F4E625DF6E84CC2B0EB56F4F844651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651709, "uuid": "253b9fb7-2565-4cac-9795-6cc445b7f163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651709, "uuid": "a171dae1-cf9e-40a6-959f-9414a880b316", "value": "12288:tlKnu5tEXqXdVsZahNMxSExoXXwfwkiJOuyyxQqcnjOjnnshBTLD4:KYt4qXdV19UfWyyxQqcnajnwBHD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651709, "uuid": "049f7612-aaac-4e6c-8137-f2febb15e1c4", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651709, "uuid": "954d1b05-b26b-4ce0-a441-8eda4b6f0f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651709, "uuid": "3bb21174-85ab-4c8b-b021-c57c6e0273d5", "value": "cf1eb9b3d862c9f561c215d3c9c49795fd822b4022e325368963376014fce4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f24875-1bc9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688626259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626259, "uuid": "519bb06a-d303-4be0-b1d8-c9cb05fc87bf", "comment": "Malware payload", "value": "472eb179e041dd88e63212c135918c6e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626259, "uuid": "591349be-d657-4eff-9c9e-bb52ad0342ef", "comment": "Malware payload", "value": "cf1f7f8c0c0fd7e6899404691bccee1482b307378a5f6a60b320621b5aaf363a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626259, "uuid": "9917644a-6e17-4b9f-ad08-d74007b7ddf4", "comment": "Malware payload", "value": "6acc1b506f29228a65f57b3ff04c5def26bd6140", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626259, "uuid": "3415a1c5-6498-4984-80d0-5c34b1308963", "comment": "Malware payload", "value": "ee3f37a2fc5f94fca739a5c10cd94c2b8536b5eda3ddfb01c4ad834ae7a04197691f4a5541ec6e2825779ea2e5569c59", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626259, "uuid": "7b1dd3d6-3748-45ba-9472-cf653f1caa7c", "value": "T1B7453313D66F54BA02127F3DA6C0A73A3AE6AA3C96D13E1FD264B09736137087605DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626259, "uuid": "a2ebce65-f42f-418d-ace5-8ccb5e6e1b26", "value": "24576:QurT4l3AeMJt78gsBxy+twV6WwQO9BHaBcXmvSNqu1:QuHy3vMJajReVvxQBHGGDNqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626259, "uuid": "e72e1303-bbfe-43d0-9254-7c67043a063e", "value": 1241696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626259, "uuid": "062115e8-c6d6-45dd-bc5f-fd0c1ac2a3fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626259, "uuid": "5f2d4e3b-671a-476d-91cc-d3402d84d92b", "value": "DOCUMENT REVIEW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1a3d36-1c03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688651235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651235, "uuid": "a39a0c37-60c7-4cef-987d-554557da02f9", "comment": "Malware payload (Formbook)", "value": "1e32cdd35a8e0077504a4fd585ffe7c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651235, "uuid": "ff140ed3-3287-438b-957b-70d66f0116b2", "comment": "Malware payload (Formbook)", "value": "cf989b127f62cc76cf185d700cc2354c3556bea90cdfc3d7f669b1f9e8e39e48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651235, "uuid": "1fa1e2cf-f5a9-472f-b8c8-89a9c7b047c9", "comment": "Malware payload (Formbook)", "value": "f91efe6fec811f370b764c2c9cbd8e450eadd8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688651235, "uuid": "15e38a82-e4ec-44de-96b1-e962bdf13ea3", "comment": "Malware payload (Formbook)", "value": "ca9f784b69d588692c74eceae36dfaf9e1f7bf6876a98a6ac83d3670bb9109a632b32fc0f1e77b9c2e6bb6eac236faf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651235, "uuid": "92e16a92-c5f0-4569-abe5-98965c454247", "value": "T179F4010872B74F2AE47E67FD0A591132C3F8992A7073D3675EC325DEAD21F440A90A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651235, "uuid": "11d91c6a-d4cd-4277-8eb3-8663444a5acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651235, "uuid": "7cc587ec-a79b-401b-87b2-665871c5be8e", "value": "12288:k02iNyOe42KMu/N3mWhQmwmJCMpUEw0Wh/Xi18Tib+ryt/np/s9bStvvxi2Z+qVd:d1wOV/NOaDwRVXiPbAe9s5SdZi9qz6iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688651235, "uuid": "0f1a4fa9-aa2e-4439-9462-c2a5bb28c0a1", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688651235, "uuid": "3523bbeb-131b-4d1a-8a5d-9f6fb4052f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688651235, "uuid": "7e22bc4a-ed66-44aa-b084-977cb0ec1b91", "value": "cf989b127f62cc76cf185d700cc2354c3556bea90cdfc3d7f669b1f9e8e39e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37895eef-1bc5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688624434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624434, "uuid": "18c32df8-c5ce-486e-a024-cf7b0e7c038d", "comment": "Malware payload (AgentTesla)", "value": "0475f295ae263ae36d3bc368c14c888b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624434, "uuid": "025ea6a5-49c1-446d-842b-3d32abc282c1", "comment": "Malware payload (AgentTesla)", "value": "cfda7c13e3c8ef2f8a3665c52f7c88b6ad977b970bd29e9b0dde3218700f25b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624434, "uuid": "6d96cc0f-af60-48e1-a3da-6222af0ca106", "comment": "Malware payload (AgentTesla)", "value": "b090c50fead300cac782599632491b75bb3bc6cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624434, "uuid": "2f3da6f5-4e09-40e2-b8b1-50cae779e8a0", "comment": "Malware payload (AgentTesla)", "value": "0cb74bae4f463926ee228a25432461fcfefda11a6ce7be44945c60ccb46c6bb9c31afa85d8f0aeb6962c25f6abfa4754", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624434, "uuid": "f1dd16bb-fc77-4cc4-aeff-63c5099d0773", "value": "T14A151220AAC0D2B3D8B7103145E5CB399A3961721B66E9D7779C2BB59F603D0B3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624434, "uuid": "8206e4ab-3b50-4030-8262-d03db2d9735f", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624434, "uuid": "c950e6d8-f5dd-4cac-a7ab-8552ff5e7e1a", "value": "24576:wk70TrcnMpE2PSzy7dkmSGEPs44QmPumaI:wkQTAnMWowGEPstQm2m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624434, "uuid": "904e657b-4479-40d1-9170-cde1d67de3ba", "value": 927296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624434, "uuid": "d0cfde3d-96f3-4d31-a9e9-d2e610b4ac31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624434, "uuid": "eea3e4b8-573e-4852-90eb-2cbb840112a4", "value": "3037_230704_odeme talimat_453747683648987643456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67abf6ca-1c43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688678632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678632, "uuid": "9aa9a594-b11d-4ecf-91f5-a742b33df302", "comment": "Malware payload (Mirai)", "value": "6b83021aff7f7346a9ee2de629217b84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678632, "uuid": "e7580bac-6cfe-403b-b993-8cdf8bb91246", "comment": "Malware payload (Mirai)", "value": "cfe2c47fb519b7d3383c8a0ac857b399960f04dfdc61a68a86592cb2ede5b471", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678632, "uuid": "ec83473b-d53f-401c-a46a-b7d8d727319d", "comment": "Malware payload (Mirai)", "value": "3c4eb69c00383c685d39ac0cd8586dda24b90b69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688678632, "uuid": "5ced4c75-42a7-4420-bfdc-b0b183921ff2", "comment": "Malware payload (Mirai)", "value": "2fe73c07d2e18e6c638d4841052e41b1c34a1c91afe8b0a90c2e69cb871473c6aa85a41bc7b73467fc167788d150cb9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678632, "uuid": "b6470048-cb36-4df0-a5c7-a3b2cd4b2390", "value": "T158C3F987AF223E77D8CBEFB786E6D70420DE580317A6276674B4DC74A20E48E14D3568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678632, "uuid": "46ebfb63-4462-42f5-a619-392392395d91", "value": "3072:+vdX7QeSHi3yzdDfRdvv7iS3B5OR4jId4:g2eSHi3YDfRV7iS3B5ORCId4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688678632, "uuid": "096e04bd-420b-49fc-baef-bedc19a5c596", "value": 119609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688678632, "uuid": "aedbfb61-a262-4786-a769-23048fa5415b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688678632, "uuid": "e754f98b-3b27-44dc-912c-4f6703bb68f9", "value": "mipsel-20230706-2123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a01b83-1bfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688649047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649047, "uuid": "ee20e809-3d8c-427f-a0c6-d4e03a10c8b3", "comment": "Malware payload (Formbook)", "value": "9099e7d1f993e4125f73d14ea4904e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649047, "uuid": "937cafcf-c1c6-4a65-8ab4-58f64807c27a", "comment": "Malware payload (Formbook)", "value": "d0822780e14edb57b8f46ebf39b402b90b12b4a9ee7a5537412302815982351a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649047, "uuid": "4b7a6795-1195-4fea-ba9f-1bfec7d95af3", "comment": "Malware payload (Formbook)", "value": "ebc984ac814e572884c28acf074de607cf2cf78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688649047, "uuid": "97cd0ac8-a962-4d59-a725-615d9dd454b4", "comment": "Malware payload (Formbook)", "value": "d9276d7709c033b11b28570a07644e466b5627f79ca811a06a0d68a1946b505c2dfd147aa78ce469b476cc72aee709e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649047, "uuid": "7d5696e1-86e7-4af7-8313-e87ab0ef76f5", "value": "T114F4F10633BB4F2AD43A6BFD09191172C3FC595A7023D6139ED32ADEAC51F540BA0A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649047, "uuid": "f682a7e9-c877-409c-8412-abd7b465fc4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649047, "uuid": "6ff956ba-2f5a-4366-9b34-dd38c227d666", "value": "12288:kr2iNyOe42KMu/N3mWhQmwmJCMpURooNQWtu0+u2BPzpHAPlGKc5SqTZ9uhPS3Jz:s1wOV/NOaCnuvPzpHiZcXZHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688649047, "uuid": "202724b0-4760-4d0a-8fa0-6a0db0ea0f0a", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688649047, "uuid": "55452d41-d220-44ea-b8f4-64900b38cbb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688649047, "uuid": "839edd4e-416a-49bb-b983-5a537135d394", "value": "d0822780e14edb57b8f46ebf39b402b90b12b4a9ee7a5537412302815982351a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb524b1-1c39-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688674451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674451, "uuid": "b8cfcf29-db4f-4237-aca2-39839966f663", "comment": "Malware payload", "value": "3a488d963fe17ea509a1be4eaf24a54c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674451, "uuid": "65457c89-9d96-41a8-9c25-237d991f430d", "comment": "Malware payload", "value": "d09c826922f1d1763cb4d8d0bca8f49c21ff07b0dbbcd3dab3f48a8bc42efe97", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674451, "uuid": "5eaf95dc-9666-4561-b7cd-fc7a19643df4", "comment": "Malware payload", "value": "385ab8c607ce2c2f98d505d58fce30f3705643b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688674451, "uuid": "45145896-2d50-46b8-8fef-039a3dd92067", "comment": "Malware payload", "value": "06b54f5bdce61230c9bad64c1fb69179b28e0b4e2fdab474ec145a1d979ad1bd71c7d905e5d14e7512e01fe49d72b2a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674451, "uuid": "b024ffbb-8a81-4b0a-9790-aa1a546fb927", "value": "T16583D7C2ED53BDF7D5C3DBF492EBE2285AF298051B6A0645F7D99DB0C61B8883009358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674451, "uuid": "13bf4541-3240-454a-a77c-3c1b659d64df", "value": "1536:t3VCKU+t5pCW2B8hy0WnCtUY2dmA5KHoFv+nVj/5n3DZI3q0u:tBLt5pCW2B8ICtV2dB5UEE/53DZ8q0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688674451, "uuid": "81d81966-eff7-4d83-a42b-d3662350f0f9", "value": 87279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688674451, "uuid": "82da459a-0448-495b-8351-cf4350d5e2f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688674451, "uuid": "869daeb9-cddd-4334-b6c6-e92ccc0b226b", "value": "i686-20230706-2014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5736d6-1bec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688641488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641488, "uuid": "572f5bc6-5f3a-4504-9b9c-3ae195719de8", "comment": "Malware payload (Loki)", "value": "a75e4570933319baec39468b1661ef23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641488, "uuid": "10db8aa4-f917-4f39-a2f3-9ee8cf0e49c9", "comment": "Malware payload (Loki)", "value": "d1becb4376a162d47a00a17713631946c3c0f728c4a1039cd3998e3f85aacf89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641488, "uuid": "b54d7abb-03f1-4d5b-ade5-ce56e2dde855", "comment": "Malware payload (Loki)", "value": "35dc3ee137df9fb0a01ccb87e35f7607d1de0d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688641488, "uuid": "99ab49db-1930-442c-8ba0-3935f2f22f4e", "comment": "Malware payload (Loki)", "value": "8ee325ead582b0a04173fc93107ba312fb0118013902ef11bb0f41b463cea31545146143d8cbf38df9c2f79552b422ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641488, "uuid": "0aa31c35-36c9-4310-91cc-c82317e98ca4", "value": "T180E401A933E7204ECD6E7FBD095506BDCAF85A023602D2879EDB749DDC68F458A40363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641488, "uuid": "d5ecb77b-d7a1-4269-a2b3-9160baf30cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641488, "uuid": "fab51f7c-6dd0-4469-b0d1-ae9905b57c81", "value": "12288:Yd6L7PVrf2ifbhaDnLMzIL2q+RTdOL837Enba6TMkRfPZ/nNu+xfQzbkWM7ZIJRK:dOyqGUL83onjthN9xfQzbGuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688641488, "uuid": "288003d7-7810-4b8d-97f5-9b6902348ccf", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688641488, "uuid": "58461e4f-7a64-48de-83e9-539e471c9e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688641488, "uuid": "84b5400d-900b-4e7d-8540-7266309d6a73", "value": "d1becb4376a162d47a00a17713631946c3c0f728c4a1039cd3998e3f85aacf89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68d22e1-1bdf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1688635841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635841, "uuid": "f4df365d-02e3-4ca5-92f1-f51caff79837", "comment": "Malware payload (LummaStealer)", "value": "a4d4c81fead95eda399ec3739839d6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635841, "uuid": "d5898c73-6ebb-49df-b64f-16e17ae6931e", "comment": "Malware payload (LummaStealer)", "value": "d1f92a1ee28a016edfc091be927a75202c851e2aaaf1a56ea3f7b6d0ee81baaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635841, "uuid": "e5f03fda-7565-47b1-8a06-bbd424f33edf", "comment": "Malware payload (LummaStealer)", "value": "2b1cbe5883d614cde60207cc374438ed7af1b7b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688635841, "uuid": "1d4f9567-b85b-483c-8825-ec09349cf56a", "comment": "Malware payload (LummaStealer)", "value": "7624daed949cbbcd61bb7c3a1e78524257e84329174249e97ab2a417cb048379e2f9761b700cc39e8edb425865457818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635841, "uuid": "f62db17e-b8cb-4d37-9c79-e34ab202713d", "value": "T17F45BD257581C9B1C4551932C0D3D5F90BF2BF62E272C68BFA873D9B3E323818A566C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635841, "uuid": "adaf2e64-0249-4046-8dc9-58d3c7f910f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635841, "uuid": "4b4d0a3c-6505-4ec0-8448-43a8afb3c718", "value": "24576:8CMVAl0Y3xq10UBpt/l0Y3xq10UB1gZ/zMjhPzysSEO:87cj3xAxj3xAA2dydEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688635841, "uuid": "e7f16956-1fe2-48da-bd85-a0c9261a2095", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688635841, "uuid": "9876c47b-4ec1-40ce-a656-14daba13ee32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688635841, "uuid": "17518fd3-04c5-410a-907c-63307e0f0821", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7486e0-1be6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688638723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638723, "uuid": "966675af-8cba-4723-aced-09c0782558d9", "comment": "Malware payload (RedLineStealer)", "value": "8aae30d4ac8d87bbc0f04e314229db4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638723, "uuid": "f5c0b7e3-ea93-467c-a4d2-effa83d6e5aa", "comment": "Malware payload (RedLineStealer)", "value": "d25fecc75a5a2670b5aa7397bbaaefff56a91bbfff107e05d44fd2167000390f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638723, "uuid": "bacc9a7f-8386-4064-a712-24df9baae873", "comment": "Malware payload (RedLineStealer)", "value": "6f1a933afb9e6c3a18b5e7c84871ebbcf38297d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638723, "uuid": "16b398c2-dcda-45e4-bfe5-65d505c38653", "comment": "Malware payload (RedLineStealer)", "value": "67ee4c1893b8075a8980dfe4bbd5ed915eb6fe82970467b8b6320bbc08b34850f5f4e1cbe4be532fbff83ac2d78b7ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638723, "uuid": "190409d3-a51c-4602-894d-64210012fac2", "value": "T14755BD05A09D1D5CC672E3B2BADC23523DBC85742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638723, "uuid": "92f0956e-41c0-4366-a498-2939f1184a4b", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638723, "uuid": "f6a75b92-6a58-4dee-bf54-deda40afb31b", "value": "12288:L6aSZF+94P3ezcZ+whkMkqEt5+6Jili5RAjfrYwlth2rDBXWNN/HVUBnFUHXOtrt:2jaPgfU5G/fYuTORU/133iRrsgUP94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638723, "uuid": "660a7af6-9366-40a8-b7bc-50b2c4a18025", "value": 1343818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638723, "uuid": "86084e7e-5dd6-4d02-a7f7-373287448d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638723, "uuid": "75fdefef-0440-4367-b96b-6818394fad7b", "value": "8aae30d4ac8d87bbc0f04e314229db4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8dde30-1be1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1688636741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636741, "uuid": "1a500a9d-53fb-45a2-9362-35a630a37830", "comment": "Malware payload (IcedID)", "value": "ed60961dc668399d829b01608d0032c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636741, "uuid": "532104cf-61dc-4ef4-9f3a-7ec646e33424", "comment": "Malware payload (IcedID)", "value": "d2ec3c0c88dfa1c27bd8225522f99ec50bcbbe15677b3cf34a2b0ba5a415e973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636741, "uuid": "b15a8f32-4b97-4ab7-8b79-c8329f28a2fe", "comment": "Malware payload (IcedID)", "value": "15ebac7bca2ee4a0aa2a24c0db934073bddd55ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688636741, "uuid": "ef5bc486-da1b-4623-8d93-df295fea6e6f", "comment": "Malware payload (IcedID)", "value": "e65a9ba6690f90a57483adf4b0f13b237280b55a11dc7d58c833b1f0ec7569307c734fd787e30c800d437558409fad5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636741, "uuid": "24854f33-cd94-4613-be03-d707be7eba13", "value": "T108056B87E1E310ECC66BC1B14757A673FA32BC198124797B5794DB703E06F60A62CB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636741, "uuid": "f7dbcc37-197b-4784-8090-ddc3ab38235c", "value": "fcd69661d52485330c4a65d12b66db6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636741, "uuid": "87addca9-f09a-41ac-946c-e208903628f8", "value": "24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9KF3Nn:WF+uTsAx0tlpidvdk8F3Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688636741, "uuid": "c5c6d3fe-f4e7-4cb4-a614-af86f76850cf", "value": 845206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688636741, "uuid": "480c6f30-40aa-4275-96d3-19579c275e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688636741, "uuid": "79baf664-bbe9-4a6e-9a6e-4d62f04ed6fe", "value": "417269.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eaebdba-1be7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688639022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639022, "uuid": "8fc3315a-7fd4-4999-a5bd-e9b53e33a7ff", "comment": "Malware payload (Amadey)", "value": "399633cca7c74acac341174fbdc774f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639022, "uuid": "ccf0b082-d2b7-49c3-afe5-7389cd37204c", "comment": "Malware payload (Amadey)", "value": "d2f0572d2922164b3c4341027639d30074bc40b9a0ed9a10e5f86ea22572249d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639022, "uuid": "db0882c6-7c8d-4be5-9e05-2174ac757fb4", "comment": "Malware payload (Amadey)", "value": "8ec56cdd97a90e55825c7cec8e7d132cf42b984b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639022, "uuid": "1a50a848-e0fa-49b9-aa59-57c9b2e699c1", "comment": "Malware payload (Amadey)", "value": "585958c9af323530a931a669fa97c1a3691da243c2b8396fce90dfddc1c0c6e0b6c3447e14534ebedfbc6c116d5e5f37", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639022, "uuid": "d969f34b-a3b6-436e-8444-931a0fe6793d", "value": "T12D560111290C4C1FA6B539615FCC489368AD57785B134D9632C2EEEFEBACD84F684B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639022, "uuid": "46a8ab0e-2659-4e10-b86f-946b431e92e1", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639022, "uuid": "bce1ef4f-bb6e-465a-902d-9bb349f2e055", "value": "49152:jGJoMyiMf20af14MticNcu4NXYVi8RUfbzivEIUtWAgOCgkLMOIZ+rbWtinw6b+4:vMhBMlUUVgr2ebuYQ1Rup+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639022, "uuid": "2e706785-baa2-4d74-8dca-458d1d93862b", "value": 5956424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639022, "uuid": "e392cc90-55d4-4b75-a37e-07bb460d72b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639022, "uuid": "87fc3a90-ea7a-4e8d-a22d-70c19091d25c", "value": "399633cca7c74acac341174fbdc774f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a316cb33-1bfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688647808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647808, "uuid": "d07b7676-9a6e-4c42-bd29-169c07a8121a", "comment": "Malware payload (Mirai)", "value": "de9ad0b0ac76aa72d86d970931cc04c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647808, "uuid": "f966ccca-5070-4584-9cc3-b67b5a52c689", "comment": "Malware payload (Mirai)", "value": "d30aab435ae198c1e2db40490c05b201450bfd164b7e387dfe9316ad5bd07952", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647808, "uuid": "0677c3de-8bb1-4a59-9a79-3619316a89a0", "comment": "Malware payload (Mirai)", "value": "529b685df155f2bce0f3fc952afba40e4e9f8078", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647808, "uuid": "a1bbae71-59f9-456b-9c62-163a7cfac3b6", "comment": "Malware payload (Mirai)", "value": "0caf068ed624bfc0d6e2fe4852b5beb0d44e4c2d7e8a0592b7c3461aeb5850d9a3653bb73c1abe7c4364eb20c7197ac9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647808, "uuid": "25219d0f-9c5a-4da6-b8be-838c1ba17167", "value": "T14A4319C4E483F8F6E805147C207AAFB2ADB7E17EB4359D9AD7D91423E901A02D60639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647808, "uuid": "cbee2048-8318-44d3-86f7-7faca128cb09", "value": "1536:xb/2+OX+hs4pIq/qNSWk/zvwt33U3zo7:Z/2+++BANSWk/TQ33mE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647808, "uuid": "7561f13b-fc05-4ae6-b9e4-cd0a4c360c50", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647808, "uuid": "9cc0466e-ca88-46a9-bd69-f9f673dc4bed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647808, "uuid": "aa086fc3-c2c2-44e5-8d32-55ee52dd23a3", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dd92c4-1bf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643623, "uuid": "4e4ed56c-16dc-4aad-a6d8-6efac5649016", "comment": "Malware payload (AgentTesla)", "value": "932c3d6870008b2d964edd6bb0348517", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643623, "uuid": "a569eea7-3afa-4011-9182-5de45fad3e76", "comment": "Malware payload (AgentTesla)", "value": "d48d95e1122c76273ab844798f1a6896ee0aa2829cb889208789bdb24e72e72d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643623, "uuid": "623fc59c-7aca-461a-a9c8-714127631566", "comment": "Malware payload (AgentTesla)", "value": "303f72ed052a2664a854ba602e19a087d1260fa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643623, "uuid": "c242d7ff-2920-4cef-bb65-327fa41e61ca", "comment": "Malware payload (AgentTesla)", "value": "2bf37693341bc1b885307862cf44c27a1a3dc48a406e8ce713d5359c8abaaab161fd41647232985aa4b5dc199fb6ed24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643623, "uuid": "0e994158-823e-4850-93ba-08a7a2b42b93", "value": "T17CF4015C3BF6495BD66A7FBC1D201170C6F96E467423E39B1E8B798D8CA1F410D809A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643623, "uuid": "fe7c42a0-ccc6-48e7-84f8-d64a67ef018f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643623, "uuid": "68b628c5-d871-4431-a21e-42dae5d5a73f", "value": "12288:6u2as/16/YHmM9mARLAV+/3Kp3quwBjKjFstD1CMZ0/feDkWNIb3XoXjPVmZH:6Us6cV9mA9ImWquwZKJstD14/6ib3oVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643623, "uuid": "4b771973-71ed-47a4-8a31-c3ff87cbe097", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643623, "uuid": "6386af41-c0db-4d0d-8399-9fa64a5cd6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643623, "uuid": "9886d9a2-b573-4e76-b6ca-63ef78e3fa34", "value": "d48d95e1122c76273ab844798f1a6896ee0aa2829cb889208789bdb24e72e72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7201248-1c20-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688663706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663706, "uuid": "1c0dd598-ba14-4c8f-a7e8-d4ca8208c31a", "comment": "Malware payload", "value": "08f549dd5d6c14a4cb8e69a12fa92636", "object_relation": "md5", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663706, "uuid": "1009f915-eccb-4483-86a2-921240d1566f", "comment": "Malware payload", "value": "d4b921d8608727de5735603bbb1104d6f0e963e9bb0eed1d85205ef82f34eece", "object_relation": "sha256", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663706, "uuid": "1492db01-208c-41fb-9e0b-30931be0d276", "comment": "Malware payload", "value": "4a8d5e05500dc346ace05830dd7276a1b60959c0", "object_relation": "sha1", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688663706, "uuid": "ca24a4b5-bcdc-4abe-be24-f61a6ff19363", "comment": "Malware payload", "value": "5bb4ae1bf255226a3568d93d3ca4148093dd143f230f68d5cf28f38a362dece00e9be229b3603057c291dbff2515bcb0", "object_relation": "sha3-384", "Tag": [ { "name": "Evolion", "colour": "#F9BA82", "exportable": true, "hide_tag": false }, { "name": "FakeAvania", "colour": "#A43FBC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw EvolionGame", "colour": "#135D06", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663706, "uuid": "3d40f138-a824-4586-802d-aeed4a7e6730", "value": "T101F633808A1C1B43C034BBBF9760D6CDA6B9760E5BA05C9AD637456E90D70C9AF1D83F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663706, "uuid": "932162c8-58a7-40eb-95ca-7046bb5f3583", "value": "393216:L3wJzKVBTm7VhzXCoFaSoTZSfV5ukzaxk7PMjVXVWD:zwJzKVqVhzXCQa4rBz4kwj1sD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688663706, "uuid": "bff66393-7331-45ac-9b77-7db229697aba", "value": 16374902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688663706, "uuid": "56034b14-19dd-4af2-9e96-0dafde97ae2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688663706, "uuid": "b5f352b3-269a-4985-aea0-0718f32da552", "value": "Evolion.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf60666-1c0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688654372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654372, "uuid": "44ffab90-b221-475d-92fa-349a3e3162eb", "comment": "Malware payload (RedLineStealer)", "value": "1e83f99f5ca637824dcbe1ea44d5bd18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654372, "uuid": "59b85299-8267-46e1-a4c4-cfe41a33fcb4", "comment": "Malware payload (RedLineStealer)", "value": "d58dd05a91383a252099a172f8a8dae59042f3e817b3822c076652008c8ccdf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654372, "uuid": "5fa4bd4e-b215-4ef0-9b0f-f8b0f0a0113f", "comment": "Malware payload (RedLineStealer)", "value": "882f6ceab9410a374eb7f425dd2c4d07dee81d5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654372, "uuid": "db4c3698-3a29-4a66-94a0-95de6a04bc92", "comment": "Malware payload (RedLineStealer)", "value": "bd2134f969132e157d216109ba09816d16730618c2813230a189e77e02d4ce24f6333706c3542e3bf9220d4d6732ca92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654372, "uuid": "14839a52-0eb8-474d-be60-a87d72b65bc9", "value": "T140F4123339209553D48ADA305A6B52D0FBAEE3D13A7246DBF56CD0356F4B2E0D73422A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654372, "uuid": "3e3598fa-fb10-4cc1-910b-71cf45c5f541", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654372, "uuid": "6f6f8a5a-4df1-4e6b-8454-c229f2b94371", "value": "12288:NavDfvwaRdnQgsmTIAPUPQt844du2e2iuzTckkhQ4iLvixuv0wikuziDjgJflN/W:Navbvw82gfTLPUotWdugKDeDi7wikwV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654372, "uuid": "01a5eee3-9677-436b-9e8c-a1528c893ed9", "value": 789320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654372, "uuid": "bedff495-188f-49ff-908b-606c7668e38f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654372, "uuid": "a83b37df-bc5e-4341-9f78-b0d92f684662", "value": "1e83f99f5ca637824dcbe1ea44d5bd18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa84e33-1c07-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688652867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652867, "uuid": "7847e068-f34d-4b83-b395-1911dbb0b92a", "comment": "Malware payload (Amadey)", "value": "b75217160b16f9ce3dacf7147b8ff8c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652867, "uuid": "8041f5e4-50be-4c91-95ea-d977be24378f", "comment": "Malware payload (Amadey)", "value": "d5978ef468b154a9482b6e9c540485bee099757bba946cf9746b832c44cfff0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652867, "uuid": "8e508e80-0b2f-4b81-8521-bfb60afe0966", "comment": "Malware payload (Amadey)", "value": "d4aea1a5721bb5ab81f1b916c1bf7ef10ecf46fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652867, "uuid": "19b06bd0-1541-404b-a1ec-5a025d6b9f2c", "comment": "Malware payload (Amadey)", "value": "5de5e30059bb65eb01ff68dc3d3f01499b9a1e1b40fed51c30876bca903f411cfacb2f8339cf62e6a00affe2fd6a1aef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652867, "uuid": "6ed03d16-dcc3-40e0-ba5d-5aace0945893", "value": "T181B4013339B09557E48AE930EAAA14D1FBA8E3E03B7581D7751DD039BF472E0D724229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652867, "uuid": "96cf25d7-d19f-4a39-a8a1-8a176d0f16b1", "value": "2d19099d1904dd0b51b1aeddbc146872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652867, "uuid": "e03c0a81-b1b7-4ea9-97a2-368776462c58", "value": "12288:s1QOfvtaRdnQgGeevxAw8yTk7aI8uh+3zq1w3+aw:s1QUvt82gGeevxAnyC9h+3zUqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652867, "uuid": "265ea62b-9710-4955-98a9-eb07a0784c33", "value": 523080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652867, "uuid": "0ace89a1-8e6b-430a-8014-51f47578fdc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652867, "uuid": "01055162-dbb3-4dd0-8861-cdba296f3c11", "value": "b75217160b16f9ce3dacf7147b8ff8c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4470b6-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688637118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637118, "uuid": "206ac2ec-8cf8-4e49-b446-c95664f77296", "comment": "Malware payload (Mirai)", "value": "ed754da6c9fe4c7203ffe3a329ad90e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637118, "uuid": "d2e7685f-4c8e-47d4-91e0-ad381c260b77", "comment": "Malware payload (Mirai)", "value": "d5ecdbab3b5c21583ea130d3bd143261dceaa296facdc303f17a094a49d4dd86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637118, "uuid": "7df55bba-998c-466c-bf34-4a13c049633b", "comment": "Malware payload (Mirai)", "value": "9cb8295fbb2988ead6dfcb77e7327ab24a47e33b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637118, "uuid": "55c0ea21-41f4-432d-bd2d-3c4f65f2d7e7", "comment": "Malware payload (Mirai)", "value": "5a89536e3e844cf926a9d63c81d926ee7623981e2b88d835ab7dd6c3e0935ff19a06400a71a7b4b7c48d32387cefa5f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637118, "uuid": "337a255a-3dd9-4ead-8970-59804a59af70", "value": "T198D2D02CD95D7949C6AD3EB951CE56F42D8C60C0A35DE68E17278448BA17A8BBC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637118, "uuid": "3ccc9407-0eb6-419a-be38-57f25da3989e", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNivJbUWU6:kbDs06t4BEub4sU/MbUivY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637118, "uuid": "6cd04d1e-6ee1-4ec8-b7a0-9466f40ba58e", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637118, "uuid": "7d894a48-1a97-4234-931e-606a646a91eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637118, "uuid": "da2b8322-2e28-483e-a1df-082bc8055643", "value": "ed754da6c9fe4c7203ffe3a329ad90e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b1669d-1bc8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688626040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626040, "uuid": "7d439477-6efb-451e-bf14-0a6167e8c6a7", "comment": "Malware payload (AgentTesla)", "value": "8ff79ca4985e0adae1a132ec02ac10ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626040, "uuid": "bbb130f7-8aed-4854-b23d-5c7e5843673a", "comment": "Malware payload (AgentTesla)", "value": "d6318d749c05b8db21c9d1f0cdcbdc2000f25f56ee154f58004e86b782722a79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626040, "uuid": "5e09911c-40b7-4dd7-9c13-e76d884d7363", "comment": "Malware payload (AgentTesla)", "value": "9659dab601e7a9c25512c140eae2ccd7b99fcfca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688626040, "uuid": "14499f7c-d998-412f-9b33-e68375086ef9", "comment": "Malware payload (AgentTesla)", "value": "3fc7c4375a562ad6bd8438bb8350940eb4dc024d4baeaf090154c7521741ce562c47591068863df4152e7ca9ca3d5692", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "87-121-221-212", "colour": "#D51031", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626040, "uuid": "f2557a82-86f6-4845-9aeb-112482fe2ff4", "value": "T10ED46A3C1CBC3227C174E6B68F9DC421F260956B3E618E2765D39999071EE0269CBE3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626040, "uuid": "1dcef887-a7ab-4624-923a-cf79fa3ae443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626040, "uuid": "4a811261-705f-4c41-9e7c-d022dcf3a52f", "value": "12288:QTnKcZSFhGx8BtRwknEGRdni7vHmdC8m7:uKcZuh8S/EGRdiCRm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688626040, "uuid": "7bfa3427-feba-4b69-8537-444b6aab62f4", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688626040, "uuid": "76a3d863-a01e-4bb0-843e-c3bc98dc69d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688626040, "uuid": "7768eb79-5cde-4348-9839-84916a85acc2", "value": "8ff79ca4985e0adae1a132ec02ac10ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b448de-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688624057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624057, "uuid": "1a346e13-2d17-42ed-97c5-33e1722740b8", "comment": "Malware payload (SnakeKeylogger)", "value": "4fb31d8d813a7f94624f86011c6b63b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624057, "uuid": "a875eaff-97e8-4129-ba8b-29e9719676d1", "comment": "Malware payload (SnakeKeylogger)", "value": "d6844e4d321d82b76bd2d9d6b66c6a8edfd695323a741481cddb426825cebc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624057, "uuid": "ef988e0e-20ad-41f7-8a9e-b519d679c378", "comment": "Malware payload (SnakeKeylogger)", "value": "f8a8056fb8e366277360c23f0fde6e734956f04d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624057, "uuid": "3059e64f-e0d6-40b9-9e4b-5a161a26f301", "comment": "Malware payload (SnakeKeylogger)", "value": "3ad1ae52ab3f86138933ff969c3a713f8f8cd3b0c96dc9160e671f38e521d98fa9de17c26d3990f17329cacddd93cd14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624057, "uuid": "7fe370e3-35bb-402d-8e92-993c8553ccc6", "value": "T107F46C3C18BE7622C174E6F58F9CC421F2509C6A3D61DE27A5C3B99A461EA0225C7D3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624057, "uuid": "4943f154-854b-41b8-bdd8-6fd337889b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624057, "uuid": "88f03a1f-4f31-4643-8406-ab25d1771cc6", "value": "12288:MzGGjhnjh35JPEdc1lINuFagoucgGdbBzB0W//sHe5/+J1:MzJNnN37P+CINuFljcNzn/0+5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624057, "uuid": "65455c78-89d0-4cce-8189-b48a308a449c", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624057, "uuid": "ce659d68-a8cb-4eb0-9074-8853c9890906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624057, "uuid": "5a08656e-2863-4ef6-a28b-7117e601dea9", "value": "Ningbo Tuopu Group Co. Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05c5cc4-1c23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688665090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665090, "uuid": "44f04d4f-4ce4-494b-8607-2740896a4dbd", "comment": "Malware payload (AgentTesla)", "value": "911c654ca4f9fe6936d3b57730df1461", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665090, "uuid": "0d134b37-6f71-4ab5-9145-b994258a0388", "comment": "Malware payload (AgentTesla)", "value": "d6e2992496408bb580877ab61792394e03e4b5424dc77132b7609b2a0eadde3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665090, "uuid": "39123fcc-5675-41ac-a5d0-41e2bf8cd7de", "comment": "Malware payload (AgentTesla)", "value": "d60e9d44284fedadb6f591873ea056aa7479cbff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665090, "uuid": "c23befbf-e035-4c4b-92b0-e7e864ce739c", "comment": "Malware payload (AgentTesla)", "value": "62d012dfe32d0f014027b7ffd2938844e96785cd44866bd092649c101410d8a1b46d5c7cc9530a0b2cca67f0579bbf41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665090, "uuid": "229b1897-f8b8-4eb4-8acf-24c8e377b510", "value": "T1C2D4E00176B79B42E1B9C3F639B6149027F9361A64BED32C4CC690FE5A76F0416A3B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665090, "uuid": "d3718e38-1bba-4fc5-bc77-be796170f152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665090, "uuid": "5ec8098a-5591-4403-ab1f-b5acea078989", "value": "12288:ZTkPOZnZHTRKNcj+I7UICHrgnkU0n8TD:iPOZr8cj+4CH8kzns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665090, "uuid": "ac3e814c-d88b-42d3-9e3e-b76872841e7f", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665090, "uuid": "6ce48a23-6ca6-45b7-843c-f508a8b08570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665090, "uuid": "2c332241-4109-4466-ab6c-ba98466e24c1", "value": "SecuriteInfo.com.Win32.PWSX-gen.8098.25806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfada86d-1be2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688637145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637145, "uuid": "d384c7ca-f8cf-4a88-8c54-5eb2858cd5e2", "comment": "Malware payload (AsyncRAT)", "value": "1e821d014e0685cf68b790c5c8df7519", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637145, "uuid": "f2648486-2a7c-4b09-b83c-8579056af4a0", "comment": "Malware payload (AsyncRAT)", "value": "d6fcf0bcebcac7aa5e7b21b189dbd89f314f79871b770911a7d7b780207fb83d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637145, "uuid": "f2b2563c-3437-4abd-8cbc-3e06b25c1494", "comment": "Malware payload (AsyncRAT)", "value": "1d80d5c26fab6826b6c60a7a7d52847c48a60f44", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637145, "uuid": "2369fb35-7063-4bf7-bc64-89c3fe6cc2d3", "comment": "Malware payload (AsyncRAT)", "value": "d5d8491595d642f6df6a0e0fb9a97c329c44391b8c77c3c623d99fcc35c560b466abc208a261020ba2be80f5c99e2f4d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637145, "uuid": "7c6f7d9a-c54a-4e78-b125-bc98d01900a6", "value": "T1DC54AE15F74660BDD06AC07482479A2175B6BC890B31AEEF2694733A7D76BF02E3C748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637145, "uuid": "b57aa1ec-58a1-42c8-a585-0c917cd4857e", "value": "ae9bee30dc1f7d15ed935d0e9d66e3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637145, "uuid": "5e17e6db-f9cf-4c41-8574-93654682d544", "value": "3072:HhKwEb1kz+I612/YPZoiy5mRvHjMQcAGP/HpdBEVfUtooaD22xhE1VlC1Dz3SBXC:HhKwOvICgiy/QKhEVfUmZce1DmBA2hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637145, "uuid": "b28a163c-7604-4849-aadd-f63b7a6b384a", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637145, "uuid": "d2a0e4db-1e7d-4185-8401-b5f0ce957e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637145, "uuid": "14d828e3-58c5-4248-a802-71b25e512670", "value": "1e821d014e0685cf68b790c5c8df7519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f791ea4-1bef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688642594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642594, "uuid": "0043dc38-dfa5-498d-a277-c3555d862fe4", "comment": "Malware payload (AgentTesla)", "value": "fbf9794708b8c57a6ee331058d36d2eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642594, "uuid": "43dad966-326c-4e4c-bf78-ccf76e9f027a", "comment": "Malware payload (AgentTesla)", "value": "d71f0f448eaf4589f3e415bf5fd1ccc10d6ef85f2279539c263c4f6928836bda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642594, "uuid": "bae51f04-6f1e-4b7c-867e-a8edb52c0349", "comment": "Malware payload (AgentTesla)", "value": "cfe3eb580387702f0654e36da69f3365ef425ae9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688642594, "uuid": "730bd280-9f0e-44b8-8194-2aef76114331", "comment": "Malware payload (AgentTesla)", "value": "c33867b6e47acb7debc3cd1e53902f9303c71c6aa3379d9c4654cae1a4bdaf3b79e9b386974a86713fe4c6a550b13411", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642594, "uuid": "54e7c9c3-ea45-403a-9ef6-c301378eebb8", "value": "T16E05F15823E7505EC9AAAFF90C950577CBFDADDE3112C2079AD634BDAC78B8D4A00613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642594, "uuid": "d84f7add-040f-477f-b8dc-c67f955a0474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642594, "uuid": "9083b43d-5560-4bef-a6d6-5be6ac940114", "value": "24576:fOyqGUL8KTLBOcq7qtWi38kfWb8R+eqbmF/x:fNqGo8KTZqjkfWARTwO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688642594, "uuid": "2f225664-03ad-4dbf-8aae-91430554c0a8", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688642594, "uuid": "a4eb928c-bf60-4f17-a9fc-70612816e61f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688642594, "uuid": "60a8859f-5db2-4ee4-9449-2d3443e682f4", "value": "d71f0f448eaf4589f3e415bf5fd1ccc10d6ef85f2279539c263c4f6928836bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8af3c7-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623715, "uuid": "3f63d1e7-cbdc-4173-9786-a4242ecd53f0", "comment": "Malware payload (RedLineStealer)", "value": "acabdb16690058dab6ee01c47613c194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623715, "uuid": "51b46453-923b-438d-b3ec-de2d8f8c4bdc", "comment": "Malware payload (RedLineStealer)", "value": "d885c60366464c7d4584a206a98c717906c245512c267cfef69de87e0d3bb3f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623715, "uuid": "e3784142-3198-456d-af9d-6b9ec8cc2376", "comment": "Malware payload (RedLineStealer)", "value": "756da1bfe4ae5b89e001b8f3f56091760e9cc6bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623715, "uuid": "b90aa663-852a-4d93-8433-675239999d00", "comment": "Malware payload (RedLineStealer)", "value": "3deb102db2cb1799ea865aa5d421f5867522c93f98ada5b5ef751f9d16bdb4f7a8038a09b8863c0c421d6a282e5d4f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623715, "uuid": "e45f1cef-3b3e-433a-bb17-f6628f1d8ce2", "value": "T157060101258C9E6FE136757A77DC4457FA6C94B4EB080D4522C22CEFC58DE83F6A6A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623715, "uuid": "04eba76a-f1ab-45fd-ad57-5ae079faa70e", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623715, "uuid": "fe81d625-624d-492d-99f9-5853a5fec521", "value": "49152:PrCrF7V42qBO2b74UYtaAOgC4yr0Uc7jm9qdpB8B9LGk0T2xNWI5AyViOKlwpETh:TAql10TG9JNGkpLH1KAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623715, "uuid": "93362d43-d7ae-4bd7-aa30-62467058ed64", "value": 3763016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623715, "uuid": "ddbbd346-11ac-4752-8285-500238f397c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623715, "uuid": "8e33018b-95fc-4cf1-a697-b4cf27f82e50", "value": "acabdb16690058dab6ee01c47613c194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aebec1f-1be9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688639929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639929, "uuid": "4e335fe0-bd12-4d25-91fd-2df399688b33", "comment": "Malware payload (RedLineStealer)", "value": "a7c3d0332a3d46a9fb6c698154ad4773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639929, "uuid": "111f7d11-eb09-4aab-a04f-f2dbfb1731bb", "comment": "Malware payload (RedLineStealer)", "value": "d95b58bf1483ee10be16e8826b500017b629aa8eeff941b8a3a534b6a9abaed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639929, "uuid": "93ce5718-072c-4001-9167-27c09ffc85da", "comment": "Malware payload (RedLineStealer)", "value": "a464b6802afcbfb5d856ca6824ebd8b733464d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688639929, "uuid": "da3d0436-bb88-4d95-a99e-bdb00ee533bc", "comment": "Malware payload (RedLineStealer)", "value": "28f083b4eb5dd89289c9c340ae49ba8a903b1078a93d5760e0629b4b73288f8cd777a9c0c350fc9cc88fcdcd4a98c9f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639929, "uuid": "6cc2938a-f80d-4123-819a-e8aff6ca6c9e", "value": "T17A55BE05A09D1D5CC672E7B2BADC23523DBC84742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639929, "uuid": "54f818bd-9750-479b-be99-39847db9455f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639929, "uuid": "04a419b3-de85-44c1-8923-b4acbfae30d7", "value": "24576:zZi2dGfYU5xpaCozrddBehxOFEYjIj2l9VueK:z6g1CujB6AEYHPV5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688639929, "uuid": "6a8bfc43-6d31-4016-9cb3-d4f275c33e1a", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688639929, "uuid": "10d84ae8-17cd-4a36-886a-91019fa5f4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688639929, "uuid": "f0100a70-e5ef-43ed-9ec5-b6ba8194e9c0", "value": "a7c3d0332a3d46a9fb6c698154ad4773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e724aec9-1be5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688638473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638473, "uuid": "01fb42da-c9aa-43d9-bdfb-654895cc96fd", "comment": "Malware payload (Amadey)", "value": "752b16daf8b3cefddccd87541af11450", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638473, "uuid": "76f61b7c-4f02-4637-beb3-a7c15e2305c0", "comment": "Malware payload (Amadey)", "value": "da3d47143f4db79063c2492b254a01edd3c4523a367066f1f4ffb41cf15470a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638473, "uuid": "27b7c0f2-ac18-47bd-99f5-0e9ae54e3a5a", "comment": "Malware payload (Amadey)", "value": "15046f80c4c87b8a2160ab5a2b48a48076467206", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688638473, "uuid": "4856508d-f29f-4385-96dd-f57af4d82a15", "comment": "Malware payload (Amadey)", "value": "5f44da3b7980217ee88e537d5332ebccec4127195a2cc93361939f1142b51f2df312948ff707fe0effd1d4075319f21b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638473, "uuid": "487eb75c-2357-498d-9ef7-0507c15e3b1f", "value": "T135160159646D8D9FE431387127DD1993F9AC64752B2F0E0122C2EDEFD9ACE80F29498C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638473, "uuid": "05b02dca-5598-4d01-8cce-ef5eaf5044b3", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638473, "uuid": "6afeeaaa-bab4-4cde-8e5b-b4fd6d074679", "value": "49152:BgQuMJgcWlMua0ueSBafgFBtIqOUNVzCekoGiUVSwB9bIq7i7MzBcoHTAduAq0AY:n2Gl2gQBVSwtpiipAMPEgzKEi5sg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688638473, "uuid": "bdb7b3dd-4383-47a8-8401-9f711738f968", "value": 4081992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688638473, "uuid": "623c954d-accd-4f45-bc21-abd24abbcfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688638473, "uuid": "490e3201-be31-4023-a8c0-4588d36a59bb", "value": "da3d47143f4db79063c2492b254a01edd3c4523a36706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ba94bf-1bc8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688625713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625713, "uuid": "6a779686-e607-4cff-850e-1fab0ead51a2", "comment": "Malware payload (Amadey)", "value": "b086f76904f52cf37a3effd7a3251600", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625713, "uuid": "618032a7-747e-42ec-b028-c040ea66929f", "comment": "Malware payload (Amadey)", "value": "da5fbc716653778284d080b0e1f328757648a3d4a18f0f108b0baffdba396b5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625713, "uuid": "2dd39497-47c9-44c7-851c-d9d6297c0356", "comment": "Malware payload (Amadey)", "value": "d0098d677ca43a942f6c1aa0b12618983a38628f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688625713, "uuid": "6c918cd3-725c-4ead-acd1-de7bbb710ee5", "comment": "Malware payload (Amadey)", "value": "f75951f3e693b65e08cd0e6b49906e13b90db3dda0f0867864377bb5c5cb12f16c645f5425f8bc49ada1634c2a5a1563", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625713, "uuid": "d69a199a-2443-455e-9256-896ad8f7cd19", "value": "T111160119612E5E9FC47034B52BDC1A83F9AC6474675F0E0122C6EDEFC9ACE80F69099D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625713, "uuid": "d119bbb5-4019-41e1-865d-ff0084377340", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625713, "uuid": "2f8d880c-0615-48d2-8e64-7a5c5de801d2", "value": "49152:8gTJ+96wQMXE/Zj71214V40ymjf0bU8R+3pB/PUmeQ310V/JZvannVxuyaR67VCq:1YEDoSpV10oneX4esT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688625713, "uuid": "a60a7eb3-9e65-4c7b-ba9f-822d292b44a1", "value": 4074824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688625713, "uuid": "c6185ec5-2759-4e37-b963-a80a3d4310bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688625713, "uuid": "23377422-324d-4398-9805-524297d9a539", "value": "da5fbc716653778284d080b0e1f328757648a3d4a18f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf8ec62-1ba3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688610027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610027, "uuid": "883488ed-0367-4f56-a041-9d5f14f1c42e", "comment": "Malware payload (AsyncRAT)", "value": "a94df8607ec00db78d4e4ee91a5caa49", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610027, "uuid": "47e04d93-5116-44e1-a6dd-294eb7eb29fd", "comment": "Malware payload (AsyncRAT)", "value": "da816e315d1130151e152d0e390be7ffec1272503ed5368c3957eeeb9c9fdea9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610027, "uuid": "70949993-6f8f-427b-a869-960daca9d9ee", "comment": "Malware payload (AsyncRAT)", "value": "0b261f27dbcbd51fc4073ec4959081fb68aea573", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610027, "uuid": "7a494558-6f7f-4755-b295-20331c095a3d", "comment": "Malware payload (AsyncRAT)", "value": "21cc82ddc7dc3c987ea35d97f9f238b06204397d71de32ea6276697e49a4f211e717825131644ca6b9ed9b047cd7cf38", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610027, "uuid": "bf0ddb5f-81c0-4d6b-a49d-5738b66752e2", "value": "T1AC84BFB36D91F2D9E3AE6038731050ADB33AF4F016A987EF4B8605A61F535C45C3E689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610027, "uuid": "479aaf8a-f9ad-42b1-bd0f-9f93ae1533f4", "value": "7fdd119c985f8e1e19afb37ad49d8714", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610027, "uuid": "68910a3a-f995-4011-9a08-98be58c639aa", "value": "6144:jCRqZ7gWMN93Hl7afE+yptBGXts9J0u/QnB6LrPwlic3u7J:+Rqqx93cfEXOXtR0nPwlPuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610027, "uuid": "a40b84c0-32a4-4b78-a775-c74a71541062", "value": 388624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610027, "uuid": "df267271-ae23-428a-9f56-2571d3f8c94b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610027, "uuid": "5dc9e94b-2c52-4e41-89e7-604fe91db71a", "value": "A94DF8607EC00DB78D4E4EE91A5CAA49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24cadb4-1c02-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688650867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650867, "uuid": "88d5661a-456e-451c-89c2-487bc32a5125", "comment": "Malware payload", "value": "0f34389570cd6695ba6ea44ab145daf1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650867, "uuid": "2f1e72a0-0fee-4a71-8b9a-f2299c14d10a", "comment": "Malware payload", "value": "da955ec5e7c7a0cb5663dd3e5a9e4a2daa8167bceda41cec9ee026b4a5b47508", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650867, "uuid": "02e43e8d-73e1-4e82-b36d-96f3f736cea8", "comment": "Malware payload", "value": "9dbcfec654d11e831b32896c1b729e57ea105656", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688650867, "uuid": "d0288bdf-2b3d-4ae9-9223-3232d5dce64a", "comment": "Malware payload", "value": "2de366b6a184f498902ed0b54ed35229fec1c0beecb08b7928d6288a7596a620f1471df77c8144cc449fe42b8b5cc908", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650867, "uuid": "a98de473-c965-4829-bca7-1a1c09ba5934", "value": "T1B6448C5074C0C472D57A2C345634D6B10EBEB8311EA0DA8FABD4197A8F366C2E625B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650867, "uuid": "0e1773af-e4b1-4cca-bbe3-457898355ac3", "value": "14eb01c0e22ebf11683c275de94f4a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650867, "uuid": "572de642-75b7-4a63-9068-bf57bc18582d", "value": "6144:IcMqpeIGoxQzaUEk6NtsnQhbqYUdmbJIUYgcJ7ulbrQrrviw:IWpeKxQzaUEkitsQhmYUdmLY3ulbYiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688650867, "uuid": "6aa26eca-9ae8-4620-8061-c90b3be088b2", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688650867, "uuid": "5cbad99d-9844-4473-81b2-c576107a58d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688650867, "uuid": "746ebea3-4423-42a2-a6db-42ae5a4fe415", "value": "SecuriteInfo.com.Variant.Zusy.475489.456.4065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b40154-1bf0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (YoungLotus)", "timestamp": 1688643007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643007, "uuid": "3058535e-c928-48ed-8724-4658555165bb", "comment": "Malware payload (YoungLotus)", "value": "e53b2cdaccb9748bfe45d7525a595de3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643007, "uuid": "c950d055-bce5-4001-8e08-77a7c838bcb9", "comment": "Malware payload (YoungLotus)", "value": "dacf404f18ed74e385ac6e44d264222ce138a16de81e6c1e9a45c3016c63588b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643007, "uuid": "5fbd2450-8472-47bb-ad70-703f02be6c05", "comment": "Malware payload (YoungLotus)", "value": "7a5b5639deb1345071f01d2cd7931a185de43c71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643007, "uuid": "8634ed88-49ee-4c26-bb40-f37678c2ccea", "comment": "Malware payload (YoungLotus)", "value": "6269a0bf75fd5310d6b8d9eddc0ea2118087ddb1da5d42d4656e27f9c245336643ff44c733ae17f89ca724077898c0fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643007, "uuid": "fc5010f2-5380-4f61-97a1-a8ce34568f54", "value": "T12DA55B10D186801FC9A719BACEBFB2EC6548BE407F4611C3628C3A5DDBBB4D17A3586D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643007, "uuid": "256a22a3-897f-452f-9194-fd9a47e99ab9", "value": "54b505207e3a17e4d06cf545b172c830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643007, "uuid": "47f0bcd9-78f1-4b06-843d-74657012ce8a", "value": "24576:EiLoRBTHMOqdkILizvSKp+iS4FG3r6xoEo8nu5E/:EisRB4OQYSKciSeG3OxoEoSu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643007, "uuid": "1e9c4c6f-c0a3-477f-b651-1c689ceeda27", "value": 2121815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643007, "uuid": "93622708-491e-4d8e-b1f5-d16ee4404021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643007, "uuid": "6f5528da-a9bb-471b-a2c3-76b6843b8883", "value": "A093D80F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307e7dcf-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610249, "uuid": "17faa2fc-f9c0-450a-b108-9efed0195ed4", "comment": "Malware payload (Gafgyt)", "value": "7496b817f8a3d31cf5ede03d0c2f6820", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610249, "uuid": "99e2504e-2ac8-43b2-ae55-cff0841236c8", "comment": "Malware payload (Gafgyt)", "value": "db3dc8cce9a7342770ca1941f93f16cb111243d8ecce2db4eb18381ef9d20957", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610249, "uuid": "7e66c932-5f81-4c77-9b13-f7b79e1855fa", "comment": "Malware payload (Gafgyt)", "value": "04893b1a454307f5906be66fe3ea31bb8b58798a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610249, "uuid": "a8bb06b5-5026-4e0f-b462-098e1b8cd3f4", "comment": "Malware payload (Gafgyt)", "value": "23090e583dc42eea4c45a2777a71f77b082d27b2a519949ad805cb586ba7827812d36f0262e18fc155b122cd9c8a67be", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610249, "uuid": "59a88809-48b5-47b4-880c-15573c60859e", "value": "T16F820701AA83D8F0EA1015B22163DF35BEB9F9BA2017DB07D760DC3BE421991D71726C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610249, "uuid": "5cc55795-bdb5-4f4d-bc93-1611b74dab58", "value": "384:fLyx4MrFYT05/0uueAIXOSXLsKfii63+mAzAiq70Ch:uRF+qMnkfiic+mtv70Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610249, "uuid": "9ea335d3-27f9-44a6-9bed-3f873ce87cc0", "value": 17768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610249, "uuid": "156932ea-749a-4b57-81c5-61f1e2ad5684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610249, "uuid": "ae03b155-7140-4dca-8e83-19deef414798", "value": "condi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71797d56-1bf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688643429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643429, "uuid": "67a8a2ad-aa71-49b3-ae19-cd9fe7c3fd99", "comment": "Malware payload (AgentTesla)", "value": "9994d7df628e484533cf89653565ad51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643429, "uuid": "b320a8b0-e83e-44c8-9066-f12e652a9e7c", "comment": "Malware payload (AgentTesla)", "value": "dc92caec60eef58db47c7815b17ba95bafb6c0f289d564483cb028a248449de5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643429, "uuid": "e4704584-950e-44ed-9fa3-f860109b5e63", "comment": "Malware payload (AgentTesla)", "value": "11dc2d33729bd175e917fcddaf1f361e59f51c68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643429, "uuid": "1fdfd29c-8dba-4fa6-8086-767c9d9f0bf3", "comment": "Malware payload (AgentTesla)", "value": "3659eb0aebb57149b42481c87fec2983e92645a969032a3611300af54403e7a5f06324f8e6926f2ed2225b111e8c5771", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643429, "uuid": "0623afcd-f08f-4a8e-9b17-30a9f8a68066", "value": "T118F412AD0BB7886FC8973FBD4C111AB2D6E856457037DA679FB7FC99DC00A088D81690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643429, "uuid": "e5c636e2-032a-4bd1-8276-5d1d6997f8a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643429, "uuid": "663fc3fa-ac31-4732-860c-abf139544b0f", "value": "12288:hVPWR28Le0cY+Yg9fb9qKJBtMEK6oWRHnQCuVlATb4fl3ZUQRx1e1VkjaGcj9u69:hB+xL9Rk9YKJoEXoAQpATKpUcIAIj9uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643429, "uuid": "c8d32ef6-5f3a-4349-bc89-fcc07f29c8c1", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643429, "uuid": "c90eea66-5611-4ff5-8301-f0d92f889a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643429, "uuid": "686064e6-c3d0-4eee-b16b-e1a76a08668a", "value": "dc92caec60eef58db47c7815b17ba95bafb6c0f289d564483cb028a248449de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c553092-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688647125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647125, "uuid": "df851bd9-0dba-4cd6-9afe-158ccc49d164", "comment": "Malware payload (Formbook)", "value": "2cfee7b18922ca1969071fdaf690f08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647125, "uuid": "8396ed71-b1e6-455c-8676-89b8130c904d", "comment": "Malware payload (Formbook)", "value": "dcc1c76391ceaadb1c6db678ad4811153fa107318b505d642c729abd7fe8cf1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647125, "uuid": "89a90960-6269-4384-9a9d-e67c35fa91a9", "comment": "Malware payload (Formbook)", "value": "d85260af54d839bb2504f1ab3316b9b21fee8c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647125, "uuid": "18c8d707-7360-4493-879a-051d408b16d6", "comment": "Malware payload (Formbook)", "value": "da9bff30c935d4a4af2cfac4bf8b8cc33b2ba5c8609f341572dc13d4695fa72b794b0bd1dc922ec761b2db0a63a9dd81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647125, "uuid": "cb00419b-dc58-4b42-b07a-66fcc9a380bb", "value": "T139741344ABB0C163DC620B315DB913BB5BEE6A011CE0873357786E1AF9F50619A4E3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647125, "uuid": "9c7abccd-d0fb-450d-b14c-d5b2af02fa5c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647125, "uuid": "5ae2ba7e-4c0b-4108-8224-ad03a83b55a8", "value": "6144:vYa6DeT7uHZNtR34A/h/Oi9GFhCZHGzO3YgDLknCABQXXKaAxO/8N0x0YkqMq1F6:vYpe+H8A5/OVcYgDLknCdXTWLN0GQT03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647125, "uuid": "b50e1036-396e-4512-a939-1e6bc75687b1", "value": 370908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647125, "uuid": "b20c0451-0f97-4292-bf39-cc2a7d89ceb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647125, "uuid": "e504e30d-2642-4c74-80e2-b7bea1b4325a", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22830.29797.18512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe7f8a4-1c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676605, "uuid": "dd0c4cfe-9335-408f-8f13-90b3d9295377", "comment": "Malware payload (Mirai)", "value": "efb46266273d045a3c5703e58bb8ebfa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676605, "uuid": "b7ee1fd8-7d91-4d16-aa8f-7a71697aa97d", "comment": "Malware payload (Mirai)", "value": "dd4677e8b077f3c86c120636b79931339b6a5d8a8a9ae07dcdd51ece81bb43b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676605, "uuid": "c31139b0-ff4e-43fc-9aa9-84120e3e2910", "comment": "Malware payload (Mirai)", "value": "07d13d9b906e25ce9047d1e644d705beb4b61ac4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676605, "uuid": "db3b8493-d830-4331-809f-1e2383fe33da", "comment": "Malware payload (Mirai)", "value": "63e13c2b53b12e5546dc55431d69d3efc319b5acbe8da9489d7de7df9bc1f70bf8227459ba3b78911317fb94c7712866", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676605, "uuid": "602c9039-b223-4ec4-8005-4317f3bf7dd9", "value": "T1FDC2D0B53FEB6DA7DE0A003A785DED3751B2B592D36B7746F28081052D071A9AA32CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676605, "uuid": "d3e124c5-107d-4683-8064-21f13e76af16", "value": "384:Mm1DMwk8JPyGgZDZpEXVZVB+6UIadsiWLRYJ4SwF/pfUVlMWEbo28tEe5mjWZSlj:/MwqDZ2FbB+6UaHRYncWnH5C0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676605, "uuid": "03eab882-7f00-4bbe-b66e-1ee64d80d431", "value": 28040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676605, "uuid": "85426387-a6ad-45e6-ba48-342b36ee7702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676605, "uuid": "bba2c9ba-39f2-449c-8ee7-7b869eb29606", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09d7b55-1bc4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688624315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624315, "uuid": "1abc9d59-0504-435c-bdd4-c621080d64c2", "comment": "Malware payload (Amadey)", "value": "e412ea15cc97e1497290b72d51826ce2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624315, "uuid": "f31e0c13-5835-45bb-9aff-51f6cb63f6f1", "comment": "Malware payload (Amadey)", "value": "dd720ccd377ee6dd0fa410ddcc7e451e76723d048b5eb3e17f3cee2cee37662a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624315, "uuid": "63a7ac9a-2fb4-4ab7-8c52-8c210a6f43dd", "comment": "Malware payload (Amadey)", "value": "f8caffd2f796c8b9fb8769bc572f76821ca1856e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688624315, "uuid": "4b5b820b-b46a-4ea0-8413-e27c1eb6925d", "comment": "Malware payload (Amadey)", "value": "f9f17ea1ab7646605da47f3a4047bc281ab021b3a86c796b3e2f1c889800dbc960b3d5cbf0e51b6ebdf3701b9023e74f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624315, "uuid": "a75f4234-0a07-4d93-8f82-bb7e1e3200c6", "value": "T14F060112619C8E5FE43A357633CC445BF86C9574DB090D8121D52CEFC99EE83FAAA68C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624315, "uuid": "acaa991e-6121-4014-a11c-49627d36f148", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624315, "uuid": "ab5bf22a-97cd-490e-9559-0e4a70651b53", "value": "49152:HTMSUuTrjNsjBvIGq0bqSOUMtHnOShaVZlTy4x+t6kDYEkpEn8kMSIIeo4VIGzDO:5eYQeaFTy4bGYpcriYuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688624315, "uuid": "83e6f552-2d3a-45cc-8a18-b821568a249d", "value": 3773768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688624315, "uuid": "39d99d64-0606-467f-81c4-1f46390224e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688624315, "uuid": "471cd5bb-788b-48b1-9574-1e8adf3eca8f", "value": "e412ea15cc97e1497290b72d51826ce2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e614232-1c25-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688665624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665624, "uuid": "5ce3efb4-468b-4eb2-bdd2-204e2a666e27", "comment": "Malware payload", "value": "c8837068fe68d66dc6b7b0c852b35a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665624, "uuid": "bcd23aea-f7ee-4fa0-98f5-dfb831f051eb", "comment": "Malware payload", "value": "dd8823d9eac573c2b6634f3a63614d01ec455f956c64eb8c50a57900caed557e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665624, "uuid": "16cebe0c-f834-4d51-bdfe-9f7653efc815", "comment": "Malware payload", "value": "3c95ff13ce205da41f7d4617f09eebfbedde608b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688665624, "uuid": "c3c5730c-0aeb-437a-8fa4-1c2bd2132e0d", "comment": "Malware payload", "value": "ad095262d93170a8c40ead4591c42dd9da8f32c29302e6fa2d0533da7e8755dbf590ce6b6bdf566e474d13951b404c65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDrunkRobots", "colour": "#5800B3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RyzeX", "colour": "#0CF62B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665624, "uuid": "9e92811a-6b1b-4060-acfe-eaa451562a0c", "value": "T176A47C59E727D25CE8B60179C9F29CF106AE6D62F11FC247658A3E39363A78540C42CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665624, "uuid": "a06d728c-dd9f-4867-a9b0-e79b531060bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665624, "uuid": "f4e8a3a8-a321-42e7-b0ba-931c5632d025", "value": "6144:ZFkLTNX7I5z0JsWo/b15m/6ax7vGTxqn:ZFsTtFa/0xjGNqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688665624, "uuid": "2a67b6e7-4b59-4e6f-a0af-79734020d1ba", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688665624, "uuid": "df168b1c-7afe-48b8-9518-d7f795cf4822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688665624, "uuid": "b8459d77-e5c5-4a54-8561-9272b5ba2850", "value": "Veonis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0f4c4a-1bfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688648464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648464, "uuid": "be424f90-0cbd-4f86-b9d1-25308a61deeb", "comment": "Malware payload (AgentTesla)", "value": "c98654669a945cfb62a3c40547473795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648464, "uuid": "12290195-4756-4cd3-bd6a-45c1c2450fff", "comment": "Malware payload (AgentTesla)", "value": "dd97e442a5d58e6c58f21d6ab84a80dd0b111ddbfbd7ab7feed758dac15eebad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648464, "uuid": "7cb16ed2-296f-4d2a-8a77-8e6bac35c4bc", "comment": "Malware payload (AgentTesla)", "value": "031f7b4033de36133ea7899b835556e28a6fa7fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688648464, "uuid": "3ed820b0-4a0e-4260-b3ea-ed1c0cbd7212", "comment": "Malware payload (AgentTesla)", "value": "43b1f18651c38718bc75648ca934dac62b47b5a7945f75bd1e56ff3c6d7ee97f4a0c6e36c3c189bef0fe969c42815451", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648464, "uuid": "5ccfbd93-b543-471d-bf0f-a1f9d0aea991", "value": "T12B25122D13EB421ED85A3FBC5D105172D3FA8A99B573C6075F9B68D8EF23B140980792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648464, "uuid": "e5e89acf-f7ad-4b11-8763-6294b55a33f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648464, "uuid": "f926c297-70f8-40fa-8d9b-dc0d144b3390", "value": "24576:+fJ0biRoSErVxIE5RhMssRaX5zEQc3EgdAzeAN:Gy4oRrjIwRhX3uEgOzeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688648464, "uuid": "569b59e0-ef70-4c9e-a5d7-aea2548a4a43", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688648464, "uuid": "74291e15-816c-47af-8827-6f8cb2672723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688648464, "uuid": "9bd81b65-fc4b-40f3-8c84-001a27b391cd", "value": "dd97e442a5d58e6c58f21d6ab84a80dd0b111ddbfbd7ab7feed758dac15eebad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a458d6c8-1c0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688654682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654682, "uuid": "b266f8cc-7975-4aaf-ad1e-ae8d73277a16", "comment": "Malware payload (AsyncRAT)", "value": "bc097b4f51b7eeb7b3acb6a9f7bd845c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654682, "uuid": "1a532473-637c-4cd8-aa95-2cc9135bec57", "comment": "Malware payload (AsyncRAT)", "value": "de06c586b9d40b027d6c9855862097ad46e7b07b423dfe4c59807efe58ce7d3d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654682, "uuid": "ff88cb87-e5af-4888-b22d-738a25166bd7", "comment": "Malware payload (AsyncRAT)", "value": "fc17bffcb92b6ffa753e07cc27d91a7f784448b3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688654682, "uuid": "2963c3da-ac92-4990-8342-b37ead18867f", "comment": "Malware payload (AsyncRAT)", "value": "879705f0832e8809cb07ae1cfe69c7e80f75224e2bf002dc4a3767c15930d7bebdb0b91a9de4e3c7d6d39543a5faba6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654682, "uuid": "1a4c1869-20ea-44d5-892f-7276eb11d155", "value": "T103230A003BE8812BF2BE4F74ADF261454A7AF2A73603D54E1CC4519B5613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654682, "uuid": "50a0e4ab-6d2e-40f6-b247-57414bd528be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654682, "uuid": "81cc4087-e0cf-48a9-9bae-f2a801323690", "value": "768:xuvV5TdxS7SWUkHm7mo2qLvKjGKG6PIyzjbFgX3it2xnZUX0UymTF1JBDZfe:xuvV5TdUg26KYDy3bCXS01ZvUyq/dfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688654682, "uuid": "1e692a72-da4f-47c6-845c-bfb322f5d255", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688654682, "uuid": "a5db40ce-aa17-412d-80af-0d7fa2f8d288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688654682, "uuid": "a8ccdefd-9e14-4c0e-a52c-9534a36e851a", "value": "bOeU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68598cd7-1bf2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688643844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643844, "uuid": "120b072e-5d76-4ad0-bf36-cd07482fb49d", "comment": "Malware payload (AveMariaRAT)", "value": "bb61f447834231aa7c75004eb3fd7456", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643844, "uuid": "9702b483-017a-4aef-bdb4-9238d31c1ed1", "comment": "Malware payload (AveMariaRAT)", "value": "df43baa8fe442e8ae56525071dcc533d82957f4e6b75f8e4d154b40ab8e756fb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643844, "uuid": "c183e258-2154-4bfc-9841-fbc34566d1e7", "comment": "Malware payload (AveMariaRAT)", "value": "225fbcbf7e07be4152651fd8ecc29d9e74870f5b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688643844, "uuid": "62025dbd-595f-4c03-a177-6681e7f8e182", "comment": "Malware payload (AveMariaRAT)", "value": "bb270c07af3a0dafc1f1cf0116bee24184b508931f743f7da6282f267ba66d13bd7fa72f30e1f003ad7a14c09e3af9fa", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643844, "uuid": "00749705-6533-4737-9901-2388bab84420", "value": "T19AB2F751A6B4CB37E0F985B45471095E03B3F2728493EB9E4CD8B5DE19E338527A270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643844, "uuid": "9ba94e1a-864a-405f-ac13-8889a96729a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643844, "uuid": "5fc1ea12-3255-407a-a9a0-b23d1d68703d", "value": "384:yTq7RSMb0tmj/wWg8eNjuRLCIh5nsCHNUZQmUL48GNqfod:yO7RRbW4/wz7+DN/mULJGNTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688643844, "uuid": "dd04e050-1045-4648-b946-c04f22fa1036", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688643844, "uuid": "391e3eb3-3085-4288-a59d-9f3612c46f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688643844, "uuid": "ae4c6bb9-f108-4d2d-beeb-92d95dd2e940", "value": "df43baa8fe442e8ae56525071dcc533d82957f4e6b75f8e4d154b40ab8e756fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24441bae-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688623114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623114, "uuid": "579dd356-5dbc-4a5f-8822-a7b7325358e4", "comment": "Malware payload (Mirai)", "value": "12e3f8ee49602c8a1555cd79399f47ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623114, "uuid": "73e0a236-a517-4531-9c3e-511ba9e224df", "comment": "Malware payload (Mirai)", "value": "dfb200568c8daa5fde208e25163336ef629f0f65b9a132feba959efe622dcac2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623114, "uuid": "9390d626-35e1-4e32-8084-c5f1eefdc4ad", "comment": "Malware payload (Mirai)", "value": "976816a9eb82113fa15dc4170455214c8c2a092c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623114, "uuid": "56a683d4-1699-4875-93ef-1cd1d4d76ca4", "comment": "Malware payload (Mirai)", "value": "8826a36db14b851b4b012ef9c4dc840379899f8264d2b1935ab9762f99cfc7c922c2912a56e85c36087eb3e6d352afc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623114, "uuid": "27d927a7-2f24-4c74-9d9a-4342c5d1e2c3", "value": "T123832946BD818A11C5C513BAFA1E118E331367BCE3DEB2129D10AF2077C696B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623114, "uuid": "b7f12012-d557-4f2e-8198-4d05d2b789ca", "value": "1536:10n9NiQOkKc5hV4QPI7PvoKTFugFIfVqaxTqQ4Mhi3updajqem5OYIU:GwQ2YYSCvLudqaYupdajqemAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623114, "uuid": "4c8ee618-b2c8-4630-b690-3742766ff23f", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623114, "uuid": "33c432fd-1423-482c-8c55-6a1e8add3e79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623114, "uuid": "5f5d36ea-a4a7-4cdc-8981-57438b0b1851", "value": "arm6-20230706-0558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edca5b26-1bc3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623881, "uuid": "87880d02-25b0-403e-86ef-d789677cb3ea", "comment": "Malware payload (RedLineStealer)", "value": "99ed9e2e41cd2f3b986a29d2563cb6a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623881, "uuid": "0cbe60bc-98e4-42d2-bd5f-23f676df98a7", "comment": "Malware payload (RedLineStealer)", "value": "dfd9a2b815e4d65adedd1ec1fb28b8bb04ae5d4553f601a9ba96508cc6d1fc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623881, "uuid": "d72e5a76-9348-4769-aa65-cbe9873dae73", "comment": "Malware payload (RedLineStealer)", "value": "f5f1f100ccfdda7e2154301b6d4c73be00ac505f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623881, "uuid": "87fd9cc9-5ae4-4162-a5d4-870d9e0d2770", "comment": "Malware payload (RedLineStealer)", "value": "96868ec935eff374d0011bde94ea0afb37efde8251ae557f0e72d8a0eb13cf895d1c2dee1278c02da2f4c829aed7a242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623881, "uuid": "7126633e-21e7-4ddc-8247-528ede709dff", "value": "T13F55BD05E09D1D5CC572E7B2BACC23523EAC8874291D613952E21DEF95F9D0E72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623881, "uuid": "c6160c61-1b19-4a36-b0b6-cfd7586f1746", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623881, "uuid": "d9f4ba8c-581a-469c-b5be-a7532489fb1a", "value": "24576:tZSFKRmxaSBggiyQSpXQJnuJvH4IEPxxZmAS4:tUF8IggiypGWvFAZmAS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623881, "uuid": "b6896a01-05c0-402b-8b11-7690887a11ef", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623881, "uuid": "6c3effa8-5b37-469e-bdbd-79ce1b6f0ea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623881, "uuid": "f37f26dd-d2f4-47e6-9bc4-3edd44867cf7", "value": "99ed9e2e41cd2f3b986a29d2563cb6a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d4e22b-1bd1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688629805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629805, "uuid": "5ced0dde-8ace-457a-8eec-697e0a12fd03", "comment": "Malware payload (Mirai)", "value": "65098205b5e2d69e287a1bbd25ff7ef2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629805, "uuid": "53d16efe-6dd4-49ec-b4ff-466b5b025b5c", "comment": "Malware payload (Mirai)", "value": "e05e936810698841047e0d720c5d99bcbf6d3f4d0145b1c6494087b64d41815b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629805, "uuid": "1e20e804-f0d4-4722-8ba2-a51211d8fd8d", "comment": "Malware payload (Mirai)", "value": "704708f654511a5b9a32e7df89e789c43dcaead7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688629805, "uuid": "745a3a61-93fb-45c5-90b8-50e0f20a2801", "comment": "Malware payload (Mirai)", "value": "75ad36ccd97b21a76fc090491b34a3c8123a058dafe315da9e550bc6ac707d22f983b3af85ccfd7681caa80f6f56b3ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629805, "uuid": "8f364aaf-4c43-41f0-94af-e3bc4041adff", "value": "T138E32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629805, "uuid": "2e9c5e5b-8443-4096-8671-582b2a5ce206", "value": "3072:eJLce5p0pHdzSEaaHbz4NrA/Jt5IQ1FuUXMk/M/983kY:eJLcHsEaaHbz4NU/JrHuUXMcM/9IkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688629805, "uuid": "18a99dbb-d587-497e-9ed2-7d525b6da39f", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688629805, "uuid": "b10e8558-93bf-46ee-a32e-1a2d3da27d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688629805, "uuid": "fcf83f2d-3151-46ff-a99d-87ba9846887c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d465e364-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688623409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623409, "uuid": "f1a75633-e400-410b-ab08-a152eec64ef7", "comment": "Malware payload (Amadey)", "value": "9873630a08369b3345f6cab3b4063037", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623409, "uuid": "9d0186ac-3249-4b2a-a6e1-9385931e9782", "comment": "Malware payload (Amadey)", "value": "e0830f29206064a58a0b2c272b608b7004d9f77f71fc7da069291d4fc55491d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623409, "uuid": "e04a5b25-8da4-490d-98ad-51ffbb75ce3a", "comment": "Malware payload (Amadey)", "value": "88aaf6e75ef12e00dcae41cc3998d4b49eb71c77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623409, "uuid": "6521b7f2-c783-41dd-a870-4afaf89e14ac", "comment": "Malware payload (Amadey)", "value": "96c8bc6e543612c7de5d97539a6fa45f4f307e883f6fd0437746611b92cc60009d9baf8f83d4c93ef57d74435000f693", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623409, "uuid": "4d9d5579-ee73-4aae-b9e0-e6cab937e6eb", "value": "T18F060101648C5E6FE136387977EC4557F96C94B8DB091C8122C62CEFC88EE83F6A658D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623409, "uuid": "9410e202-e694-4598-bd8a-dc11c6763209", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623409, "uuid": "4a2787bf-43ea-454e-8e21-94ff243e79f8", "value": "49152:3KW2210LtCYO7aywkOq18HPDsLG+HW6t8QgfzHoOC/U5fQhgR0joIM5KXZdoy1bX:zALfAH583L72SKXnoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623409, "uuid": "42bddd08-f094-4f32-8980-b138d1f33af2", "value": 3766600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623409, "uuid": "704a1db0-1908-4c85-9fe4-b5401827acef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623409, "uuid": "b84479c6-3ed4-4546-97ec-447271945112", "value": "9873630a08369b3345f6cab3b4063037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd10d663-1c06-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688652629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652629, "uuid": "210941d4-3ab3-4c54-a604-a815d1c067ca", "comment": "Malware payload", "value": "cfca235a138eed9c173678377cf9ff05", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652629, "uuid": "c75d288d-cd1d-40fb-b2ac-ace7ae2a3388", "comment": "Malware payload", "value": "e0eeb9b87c7ca8b812e9e9a3b6711e0200c80883780b59a3c258c8a3c0d73a29", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652629, "uuid": "195781a3-453b-42a5-9640-e440b003ee50", "comment": "Malware payload", "value": "294bfc9b97092904bb5e216531b184e38fb2c11f", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688652629, "uuid": "51565306-6c7c-41eb-836e-927cde997be0", "comment": "Malware payload", "value": "3b21ccf7588df2a33c6e4b6d46241441a042a272a898102ef22de290f8bd1c6071fc0599036270c203ee52c81a6425e2", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652629, "uuid": "53f3e99c-0d7f-4330-8448-d61618842482", "value": "T1D9867C27B9A01925D297C0304AEF57A26B31F9354235EEEB2375E7392F22C06DB5D306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652629, "uuid": "94a48380-f61b-454a-82ef-1976a195fa67", "value": "98304:YuxHp0hCwQFyYeyCrmu6kciN6OASP6sSP+:tSTmumdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688652629, "uuid": "b67d77f9-4284-45bb-bebe-3f910beb4492", "value": 7958136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688652629, "uuid": "526fd8d4-8d30-4638-a7b1-8b56e0a9e01e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688652629, "uuid": "7a20bb7b-4990-46b9-ba0c-f249dd58132e", "value": "Destruction", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6002fb17-1c28-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688667023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688667023, "uuid": "0801fc81-fe50-49fa-9266-d84959685749", "comment": "Malware payload (DCRat)", "value": "13788c36340920e74b5cef3242405aef", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688667023, "uuid": "6b1a438b-e037-4501-a28f-257ce16b2bca", "comment": "Malware payload (DCRat)", "value": "e0fd6af0e3efee2865c89a492f552e350d8da579d5df3b5effbe751244f5d8d9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688667023, "uuid": "9eecf386-93dc-4879-a73f-a93c7f04fbf5", "comment": "Malware payload (DCRat)", "value": "a44014854df10aee589db1eff2bd145fa9126b8b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688667023, "uuid": "f74c0e9c-ab42-4ac1-8189-8cbc16d4ced7", "comment": "Malware payload (DCRat)", "value": "74a6b38abe8a19608a725571474f786421a50e2623fb7c33506940fa25f8aa1b919fb3740540f8c9e897e8c0d91637c0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688667023, "uuid": "3cd1c42b-f778-4992-a5ad-76db57c1c80b", "value": "T1D7E5DF017E48BA52E40D1777C3AF45C84FB0A8D0EAA7E31B7AB9366D56153923C1C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688667023, "uuid": "efddc7dc-28a1-46c8-93aa-880b7ed6e809", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688667023, "uuid": "8999a87f-7adb-4328-be66-04c4d08766db", "value": "49152:PbA3XNkVmXQaBUXFrygFuT2CoX+J+UsgphCSQLgsYwFz/q/nWAOXeh6:PbUkVFBygAaCoXnwXSLgsLq/WAV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688667023, "uuid": "3b094242-608a-4836-baf0-de649ed6eb87", "value": 3192482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688667023, "uuid": "bc1cd48c-e5b5-4ec8-a20e-4fa22309c7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688667023, "uuid": "0b03519d-1af5-400b-8aa0-bc5d43746701", "value": "13788c36340920e74b5cef3242405aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e0f45d-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622341, "uuid": "2a820384-ed3f-46aa-b0bb-43f141716e66", "comment": "Malware payload (RedLineStealer)", "value": "15dd09e414d83915ff1a391a19049773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622341, "uuid": "86cf89f2-3c20-4d4b-8dbc-407f147173aa", "comment": "Malware payload (RedLineStealer)", "value": "e1773c71e23909ad31d7d685e9db591e89f675a87be77f18e764bbb44d78ff18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622341, "uuid": "b45be28f-375d-480f-a519-ff1f3f11e149", "comment": "Malware payload (RedLineStealer)", "value": "1e5651babad52c06ab0c97ae3e73456126e5ba8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622341, "uuid": "acc63a4d-bc19-4d74-98f5-b98b14330b84", "comment": "Malware payload (RedLineStealer)", "value": "0e43ef1ef5a80df9b6b3db0c69e6286300dff2fc6f7330034d313558c8cb424b5a34ca37fe66ce55347f676d858e901e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622341, "uuid": "2580a228-1a67-4b93-9e77-601cc4157580", "value": "T17955BE05A09D1D5CC672E7B2BADC23523DBC84742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622341, "uuid": "ab3ec47d-6bb8-45dc-bf5f-7602e7212962", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622341, "uuid": "a9000cef-282f-4287-a4ed-e60b3588bb57", "value": "24576:r5i2dGfYU5xpaCozrddBehxOFEYjIj2l9Vu:rag1CujB6AEYHPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622341, "uuid": "13d05a64-c96a-4ed4-87f8-0c040a50666b", "value": 1343821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622341, "uuid": "11b47a5f-6928-4619-8031-a77946d93e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622341, "uuid": "720fa605-9377-4645-8d0d-e17dc5590e2f", "value": "15dd09e414d83915ff1a391a19049773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cb849b-1c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "45a1cceb-8b04-49c3-92f1-b0b1b0f08cd6", "comment": "Malware payload (Mirai)", "value": "dc80b0a980d3d54abc589d82bd392c9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "7781fbcc-9353-4adf-8140-f6daa81a4b4b", "comment": "Malware payload (Mirai)", "value": "e193e9ab2bfdc701c17d65b450f04da3549d9a0f226b0765b6322cb7986953dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "7dcce533-463e-461c-8aa9-07861e2e9bd9", "comment": "Malware payload (Mirai)", "value": "e4bf774eb6fbaaab8f0ae3460c8410af3e2cea56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "f41fc3f6-bb4a-498c-bdd3-880d1a047e9d", "comment": "Malware payload (Mirai)", "value": "71f73c637c0ca94604ee759e5aaed218cbf2ec4409f9727e81287a2c4f7d453d8ee53e6be262a99511f8d71b7a2d78f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676607, "uuid": "b9721202-f2a0-482e-843c-22469f5ad376", "value": "T1ADC2E122A2A89E55E3F14872FFF6CE8DA60537BCD0BEB03212146660BFE275C3571241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676607, "uuid": "d9fc3514-6f7d-4f16-8371-9105f079ad1f", "value": "768:qwnLkDK4h7AxvIp4MSaoL4KX3kxD2Ws3Uozx:RkDh7AxkVS2KX3kZUzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676607, "uuid": "8b2f1c41-0051-41d7-9645-19c2693e5389", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676607, "uuid": "e1468e3b-9925-408b-9de7-291339b973a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676607, "uuid": "77d80f90-6e67-47e0-bb84-d698bf8298c8", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171479e-1ba4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688610251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610251, "uuid": "f9538b8d-5878-49ed-b393-ee1a708da570", "comment": "Malware payload (Gafgyt)", "value": "c5a0d2488afee2a0d8487b7a558a8181", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610251, "uuid": "afd667c0-91d4-4dee-b74a-f086006e3561", "comment": "Malware payload (Gafgyt)", "value": "e1cbc873f4703c699f407f81c4718124d5fc33a5a488f2a390f6779125445793", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610251, "uuid": "abe03b4c-973c-47e8-9d36-a340a66117ea", "comment": "Malware payload (Gafgyt)", "value": "afca36b02cb8a73fd91e730bd1ff43b054e9ca77", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688610251, "uuid": "32a01713-e575-43bc-8130-293f0379e4e0", "comment": "Malware payload (Gafgyt)", "value": "dd649c6e052c4ec1c0674fe2acdcb838e8edea26b2a43b5e6f065c3ebc060bdd9e6c9bfcef683cfd49589cac11f484e2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610251, "uuid": "f5872a99-d75f-4070-96cf-146400a3f204", "value": "T1A5C2425E2E225FECF718853956B34F70935973D622E5EB84E26CE8000F7424E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610251, "uuid": "19fa95b4-ef0a-444e-96ed-2829fc139baf", "value": "384:BUnpy6uHas2ZLahgWHAp9nwJqH2PHVb63NHWZM6r6L8Ph1xgNgAGhrMS30cpq:CnpQ3AzyDb6dWZdOibD3nEcpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688610251, "uuid": "cd4aeb5a-d2e0-4176-a841-b0a2eb800d84", "value": 26636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688610251, "uuid": "75e54760-65ad-4a6d-ad94-78ec1fec3689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688610251, "uuid": "9b4d3a06-1576-4cf9-8691-8b853ad8785d", "value": "condi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dac32b9-1bf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688646054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646054, "uuid": "a33ae4df-da63-48a8-b82c-5eeb95f516d3", "comment": "Malware payload (AgentTesla)", "value": "84ca114adc2e3cc0d20dff9e3a970b07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646054, "uuid": "85c79851-0f7e-4ee6-bf17-c19508b2e0a1", "comment": "Malware payload (AgentTesla)", "value": "e1d9ae35e325332ca3f13f2af7280b73670fdc1c613766a3661d677feb8e9948", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646054, "uuid": "73410067-f7bf-4091-8373-1d89be8a8b53", "comment": "Malware payload (AgentTesla)", "value": "85cb46ce6650099e2866bb79747d0d38cc05095b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688646054, "uuid": "56f85b50-8654-4604-a5a0-c44b3a4eb99d", "comment": "Malware payload (AgentTesla)", "value": "d5f1fa3e1a6b5f45eb699108d32869832c8444d5256228631ef9cd4296bd2aead6bc9d644dc0a64a3e779ba4b9f7af4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646054, "uuid": "7e9e3645-2e05-49f1-8094-29358f35ca55", "value": "T198C3DD31F895845EDA2C72FB58E0C5EE802D1838E5A01176F07D0B0EA77AD37D13969E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646054, "uuid": "168441f2-9090-4fd9-a360-42671b9b0d50", "value": "1536:rDK6/IHynUYwL+T777777KnsgQlVnvoChRYjKKP6NEPFb6OQ3ZvtbdRJ4Ag9A1Ia:rpl9h4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688646054, "uuid": "8b8b6da2-55b5-4a6d-8a1e-534b84d9713f", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688646054, "uuid": "240e1c76-9d1b-4630-ad45-b799e9f69ba3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688646054, "uuid": "02e7dcc2-20a3-42ef-be7a-d5b000a84891", "value": "nORDINE NR.2220271_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1586dbb-1bfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688647805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647805, "uuid": "9a1158b9-b845-419b-b93d-dcf487b866f6", "comment": "Malware payload (Mirai)", "value": "10373ff5e3ca994bd595401cac42fee8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647805, "uuid": "af8272aa-55a1-43cb-977d-b5810666c517", "comment": "Malware payload (Mirai)", "value": "e28318e111ef742c3df51e29e5cec13f045d61b829265c5ebf38e4aa40eec246", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647805, "uuid": "7cab49bc-57c4-42da-9d49-344358fe2a54", "comment": "Malware payload (Mirai)", "value": "c8b5fbc8e85d6d848782b7eca438a2e5eb45ff92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647805, "uuid": "81278e16-d72a-4009-b07e-2702d9a2e991", "comment": "Malware payload (Mirai)", "value": "a9eaa4fd836e2b30d6b357dea55b25446d8dca11461f4ae3fe4f4a2919ed456431f9889d819d0abda2eb6894649f649b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647805, "uuid": "4f992f3f-3eb8-448d-b1ff-a402417325c3", "value": "T1B2D33B86BB419A13C0D61B77FA9F424933229B54E3DB73068D185FF43F86A9A4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647805, "uuid": "a8178ae4-81aa-4683-baf3-24450d9fdd51", "value": "3072:6h7um7+ONhLmiTHsSTjpI3SyRTaAT08X6GsM/9/sW7m:6h7um7+mm0jpI3SKTa8X6VM/9/sW7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647805, "uuid": "0ee1d5af-28a9-4839-b441-d1ee41dbcf1c", "value": 138499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647805, "uuid": "769425de-a365-45bc-b953-f32b84b968ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647805, "uuid": "45cb3155-38e6-4fad-aaf2-2ace936bc5af", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0d9337-1bd5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688631608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631608, "uuid": "c5d3079e-f289-4cad-8a78-8f38340ac527", "comment": "Malware payload (Mirai)", "value": "12fd1bfda4e4c0857334dddc1f79c71a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631608, "uuid": "cce5c5c8-2f74-4d13-b7b2-5a255f5e8658", "comment": "Malware payload (Mirai)", "value": "e2e6356969149f990a7072d89cc69fdcf13507762542691d7071ff27cba8541b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631608, "uuid": "f982a4b6-fc97-49ef-a1bc-5b9bb97d4412", "comment": "Malware payload (Mirai)", "value": "ad1be667a98f4d51c81278083b664ada4e4cb359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688631608, "uuid": "13cf4b86-63ef-497f-9ddd-ed8feafaf83d", "comment": "Malware payload (Mirai)", "value": "921c70aea2194a8aa7ad6263709ec65809aceb6eb9c9aee862abfa5bc091c813606fdc61b4dafeec2b2c995d06d5aa61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631608, "uuid": "2c371322-62a4-43af-a28b-6472af5eca90", "value": "T12182CF3061AF74E5DBF14430EEEE8EC6976A0BF9D1FC329217586B78894210215F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631608, "uuid": "320c9d45-3b1a-4abb-b9e5-d1cfe430b767", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaQhymdGUop5h5lC:6GV0P6+kom0tVAoNvm+to1Qs3UoznlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688631608, "uuid": "114c8912-4955-4a33-b817-04bd5401af6d", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688631608, "uuid": "3380373e-fd61-4643-a866-494faf015fee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688631608, "uuid": "1c2f83ec-1699-449d-940c-94372b79c0ad", "value": "12fd1bfda4e4c0857334dddc1f79c71a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab797cb-1bc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688623366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623366, "uuid": "f7a6a023-9471-4aac-8866-9f3d825dd9da", "comment": "Malware payload (RedLineStealer)", "value": "6f139e3cd9de2f2b8bf3a0877e8c1026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623366, "uuid": "482663bc-4afd-4176-8288-2449b9803442", "comment": "Malware payload (RedLineStealer)", "value": "e34799c46688ad341fa4315e5bf2457be89a68d7284e9eecf3d61609f8484bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623366, "uuid": "207ddd68-8492-4ef4-86db-ae3bb6f6584f", "comment": "Malware payload (RedLineStealer)", "value": "a2395bf205c22d65ab33f7de6172fe7868584113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688623366, "uuid": "add054be-aaac-4652-9065-9b44095b7f68", "comment": "Malware payload (RedLineStealer)", "value": "782d817b6fa0c8e98552039ed376dcfaf391eacf42062a272cb5a63ad9a62584ccff7bd20be170d3c929fe3aca87e94c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623366, "uuid": "ae90378e-b221-4de6-bcc3-a1627c254eec", "value": "T1A155BD05E09D1D5CC672E3B2BADC23523EAC8574291DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623366, "uuid": "1f09d5b0-f7e8-4021-b87c-e44b9a2a1476", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623366, "uuid": "2063fab8-d4d1-4308-a5f4-b52af3ad1f87", "value": "12288:zIPHZF+94P3ezcZ+whkMkqEt5+6Jili5RAjfrYwlth2rDBXWNN/HVUBnFUHXOtrm:U/aPgfU5G/fYuTORU/133iRrsgUP91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688623366, "uuid": "cb7e204b-8973-4901-9d93-38c5b758f6d0", "value": 1343819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688623366, "uuid": "52c06915-75d5-4d5a-9212-0867fd9df1b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688623366, "uuid": "74bcddac-e477-4316-bf96-026d26b74ad4", "value": "6f139e3cd9de2f2b8bf3a0877e8c1026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b6a06e-1bfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688647357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647357, "uuid": "6952c3d4-9c3d-4e6a-8285-ab997179ab8c", "comment": "Malware payload (Loki)", "value": "1a9ea45201f688ecf3fe9ab8b6dda9f6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647357, "uuid": "129e6cdd-c7eb-477c-97f9-b2d0f0b2581e", "comment": "Malware payload (Loki)", "value": "e3671a89c420d13fe9fd5aa0f82f1c9ccd715d6add35941b84f9f5ec395c1902", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647357, "uuid": "4b8e3449-e160-4a6d-b9aa-ae9902951af6", "comment": "Malware payload (Loki)", "value": "c557fbe7b5d90e06a8620f8ecf13c0a91dfc213c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688647357, "uuid": "4cea3034-313c-460b-9bc7-88c9b96c4308", "comment": "Malware payload (Loki)", "value": "b250b14b0ee518a087d95fcf20a832f0bebaf8e7c1f242b522b633f593c75b5c26bf7021e6d60def05bece330c185a3c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647357, "uuid": "bc78b670-c388-4bf4-a6aa-4f54fbe0df8b", "value": "T19E327E3B88CC2AAED20B503540AA314AF2A437D35229BD8E7674FD75C5B65CE5E303D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647357, "uuid": "69233195-6c9e-4a59-9969-16967db1c2c7", "value": "192:Oya0NasjeWYARgZVPCK44AG9xXSJ+Ej7+JYwKwhKW/aWYacWeHt:OyXasjeWYANK4499xXSJf7+JYwDZYagt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688647357, "uuid": "6b2b6a5a-179d-4c81-a253-96fde1350c2c", "value": 11086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688647357, "uuid": "6279e8e8-e701-40ca-ad21-5a28c4a6bb79", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688647357, "uuid": "7dd8ebe9-6262-442f-931f-d2abf4300898", "value": "proforma INV5400.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693a7106-1bf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688645563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645563, "uuid": "8a15abfc-b868-41bf-ac0d-f181a07190ab", "comment": "Malware payload (Mirai)", "value": "2d5f82e6978c127bda705ee5abce0a82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645563, "uuid": "a44b023d-afaf-4040-9f2e-890923271dcb", "comment": "Malware payload (Mirai)", "value": "e39571d284bf67ca87c9fe4d95c2cd26f4f2e276e4140240c77be38eccb5cca5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645563, "uuid": "7b43c61f-f48e-4d05-8c4a-c36d5b4e45da", "comment": "Malware payload (Mirai)", "value": "e1ab12fea8550e3a3a52653b67c00fcdc619c6a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688645563, "uuid": "bbd63be9-0b30-4e4c-82f9-44231cbda911", "comment": "Malware payload (Mirai)", "value": "0b43f76895826bbdff976f22f6a4da157f595550011a35f6488d0313560c1c289d1a1880e0f59b252897558d723ff396", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645563, "uuid": "3403bbc1-9275-45c1-8931-cf8e9bf890bd", "value": "T1B1733A82BC815A13C6C5137BFB2E028D372653A9D2DB3217DD216F21738692F0E7B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645563, "uuid": "27bbf245-de84-45a0-b4ab-2ad69d601c9a", "value": "1536:IPE9uwgc5pVU7r+q6WwJuiFr3QBImvagsDwIwvMNa:IPEcjc5ApwAkABItRAMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688645563, "uuid": "72effce6-c70c-4d16-8105-c3fade98ce75", "value": 79384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688645563, "uuid": "977cf1b4-06c3-49d6-91c1-831b2c55ca43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688645563, "uuid": "5ca2ddb1-4881-4ee3-b770-88719c9337ea", "value": "arm-20230706-1212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abaf7e4-1c0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688655015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655015, "uuid": "2b472fa3-4b95-4e8b-b973-426ab5a813bd", "comment": "Malware payload", "value": "a30ef180e2412d3b8614e9e2b3d38e58", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655015, "uuid": "728eb57f-e55a-4827-acbb-26c33d6522fb", "comment": "Malware payload", "value": "e39cca965dbf7957d04f848572aacfbb736e6aff71e319a788c3f61e52abe795", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655015, "uuid": "b53c3321-9f57-4a77-98cd-1d8c2eb0647f", "comment": "Malware payload", "value": "7e24a5384ccdb5b6d6dd0f2984027ae2bc3352e4", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655015, "uuid": "446d8ea9-23c9-4565-bfc5-9e34d2e01d67", "comment": "Malware payload", "value": "d5661ddde283ac68c437884ee008370bd2a827309c26201583efd84978bc5730810af94808ad8d106f5fbcf1b080b094", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "RealstStealer", "colour": "#5A31DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655015, "uuid": "97075074-19b4-437b-a300-48f2132c66a7", "value": "T10F47337860184C5C8935E6B4EC783C35FEE8EDAB4C8D6931D19842D58793E23BE829D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655015, "uuid": "b649c296-aa34-440c-aacd-2035dba39418", "value": "393216:UobMqxRNE3xsSalSS+TE1qbPqKKQzKcetc4/Lg+bXl/KQbsbqO+7GFmGeECzou+v:UobtbEglJm9ClTjXlq+ZJH5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655015, "uuid": "949e57c4-d91b-4721-b7be-45414ec32cf1", "value": 26112686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655015, "uuid": "d83c985c-d95c-4d5d-b4f0-ed36fb45ea04", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655015, "uuid": "189dd0ae-1ed6-4b75-a3e6-8ff44fb3e50a", "value": "Brawl Earth.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502a62db-1be4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688637790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637790, "uuid": "886d11a3-8032-4542-a0d4-4866faed9430", "comment": "Malware payload (Amadey)", "value": "047a327b3457a4e94a9c20bf03d061e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637790, "uuid": "cdd212b3-cab4-43a6-911d-cb6a3ce5b8f7", "comment": "Malware payload (Amadey)", "value": "e3a5025120faf2034acffa05746286e387e9a273a11f2c4b14e2e4b3151c8564", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637790, "uuid": "3533206c-1d9c-422f-9ef6-4b17968fa151", "comment": "Malware payload (Amadey)", "value": "643bac95e0777619e29e914fa56e38df57a1d5fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688637790, "uuid": "66506c2e-a76e-404b-a9c5-ca289c0490aa", "comment": "Malware payload (Amadey)", "value": "7422c3f509517135f223713e8a4a7f036b48412a262ead981101bdb789158abf05a1760a1684d9c9f5b2d5dc9d6862d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637790, "uuid": "24261b9a-cef0-4a12-8d5b-fc998b11d5b0", "value": "T1A5160159602E4D9FD63134712BED1A93F9AD6470271F0E0122C2EDEFD8ACD80F695A9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637790, "uuid": "d9c54fb6-8643-4896-a284-a9fc5ab12d43", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637790, "uuid": "cfa02639-a834-4331-b2a5-5e2ea82c304c", "value": "49152:dQ0BTN3JIiW0QsudBoHY6Xp8TbHTb+pCAlSevorgAbcY4dQ1vcftH6V+kFnySoKs:dWxxaplCAJcbc/fZWF8VUJA9OE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688637790, "uuid": "57788d06-31d9-4ab6-8d40-428c31f5418a", "value": 4089672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688637790, "uuid": "546f0a00-dfd4-43ea-9144-5d4adf6bdc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688637790, "uuid": "8aa9f490-77cc-45de-b79b-e81d898f0771", "value": "047a327b3457a4e94a9c20bf03d061e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f214bc67-1c0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688655671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655671, "uuid": "48d7f7c4-081f-4ebb-a7ac-6a4b0f06f924", "comment": "Malware payload (AgentTesla)", "value": "c784ddd10090d67afaf514d38eecbfe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655671, "uuid": "e7d22674-6099-42a0-862e-6416f172b832", "comment": "Malware payload (AgentTesla)", "value": "e45d91008eb19ecc3c9e6aab13339bc327c2c61b97215b0d2cc98c23b0db057a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655671, "uuid": "de203fa1-d7e9-40b3-afae-0796f842d440", "comment": "Malware payload (AgentTesla)", "value": "d8c2db7622239a27c728913df77e508662d34ce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688655671, "uuid": "ab97ed83-d9c3-4012-8603-5a532719beb6", "comment": "Malware payload (AgentTesla)", "value": "3c21158162a31e4184ba2209f69dd08e04c2e53b5072d2580b4b4bc73a8b85a16c9e54270a836e7234d41e3866715776", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655671, "uuid": "9d856c6f-da24-4c98-bf94-44bb887f3150", "value": "T1BBF3286952C95D11D33E40B8C8B311480BB2E177965BF75ECDB1ACFA3A16383372B869", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655671, "uuid": "b3ef8ed8-7b46-4a8d-aba5-fcdf45bab6d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655671, "uuid": "539aaff3-943d-4ce3-8e35-6546a7e4092c", "value": "3072:vfEOgdvxglpHM+Q9Hhpn8WZE2NQyloz3By1:k1xgnM+Q9H78sNmz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688655671, "uuid": "c76b1d03-f328-4e9e-9a73-5a5b84f3e364", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688655671, "uuid": "e4a0c05c-2827-480f-905a-2eb702183498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688655671, "uuid": "28e0708b-c83c-4afe-b641-1ec53258d870", "value": "168865567042bc8d53c2c31eea42e40cf308fb91047c112335ea6ee72452b877728bca015a512.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5572d292-1bc0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688622337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622337, "uuid": "f72419de-9669-430e-ab6c-cf21a38fe39b", "comment": "Malware payload (RedLineStealer)", "value": "1684efe103ad7344cae9799e36728b69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622337, "uuid": "a70d46aa-e3c4-4baa-84d9-0cb2bba0bcc6", "comment": "Malware payload (RedLineStealer)", "value": "e4c864aef433dbf8c3a568a21868846e805937beeca07cb754a0ff3aa69cbe4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622337, "uuid": "67a29ad3-39f5-4433-b1c6-c0d6dbcfe4fc", "comment": "Malware payload (RedLineStealer)", "value": "96e0ab8591974793b4056c16cfd6feb4065a0756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688622337, "uuid": "45415d67-5f9b-4fff-a034-cc008f7ee3b9", "comment": "Malware payload (RedLineStealer)", "value": "72a6db0a6f377386a191f7ee7c153b40e7a31de1bf16f80ef36fa4e2f68cf44929ca8329863399bdd8844dea460c8126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622337, "uuid": "f7c24ad0-6189-448c-819c-6329caad6481", "value": "T12855BE05A09D1D5CC672E7B2BADC23523DBC84742A1DA13952E21DEF95F9C0D72CBA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622337, "uuid": "6b55fc12-eccd-43b7-94f6-22fbd5c2f37f", "value": "c40e9a4f29716be1d546d01b7139454b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622337, "uuid": "06133694-5e2b-4066-9c3c-e7aa17c16050", "value": "24576:r5i2dGfYU5xpaCozrddBehxOFEYjIj2l9VuE:rag1CujB6AEYHPV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688622337, "uuid": "f0676b6c-4067-4df5-a3de-9d3911504a3b", "value": 1343817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688622337, "uuid": "95e769e0-6b21-4214-8010-ba74418d3595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688622337, "uuid": "16fb5c41-f651-4ba6-92d4-dcaaa249bc81", "value": "1684efe103ad7344cae9799e36728b69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ec53a0-1c3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688676607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "7abaf986-dd9d-4c67-a8d3-f52ca61ba5d0", "comment": "Malware payload (Mirai)", "value": "8d892129e5f43c20ec94f4e673751201", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "e313455f-ee59-4f6d-b026-f6c55e379c15", "comment": "Malware payload (Mirai)", "value": "e4cc8d5d0aa69f939de2769036e75f986f621b9eeafebc13c258949b4ff75910", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "c5bea241-6cba-40d1-8f0b-418254c110b6", "comment": "Malware payload (Mirai)", "value": "ddd21c3ee7b2dc96025ee07e6219daa66bcf2bdb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688676607, "uuid": "9231a609-d53e-47d6-8b19-97d8dce2c9fe", "comment": "Malware payload (Mirai)", "value": "8cf34ccb42061e568052bb7dd615c521b36cff359886946a610c09b6d610da9f311e25c8ddce8037ab853491322eead1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676607, "uuid": "dee477db-2bc8-4f56-a777-854161ded64c", "value": "T1C1D2E026D237FD61C1705432C96C9AC33792473DE19839253E0143A1EEDFB0E99BA5EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676607, "uuid": "6da1e470-ad88-4620-b214-3331d4f585e5", "value": "768:M6LmkLopzDgjWRTXaz7Fpp90sItxmNbsRs3UozYZ:MvkLohgyRMex78zYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688676607, "uuid": "815b18c0-a134-4613-8c0d-f60d14ce9f7d", "value": 28536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688676607, "uuid": "c1bb5803-ffe4-4d09-89f6-38447ba8619c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688676607, "uuid": "8ca63b82-5c64-41e7-9f5c-f3edc3f44c45", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63bc9ac-1bae-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688614822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614822, "uuid": "e4c0193b-44e2-4853-9c1b-5f29090a07b8", "comment": "Malware payload (Formbook)", "value": "d8b43c0f720ab0f7eead21aa70827cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614822, "uuid": "4ded9ee6-8bc3-4ede-86a5-8b2ecf9e1178", "comment": "Malware payload (Formbook)", "value": "e4f9c1298c90f9ffbb03d200ffdad6dae09bd94e1a408a3ba6a1b671d567b2c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614822, "uuid": "01317b7a-4259-43c4-b5af-c4535678e909", "comment": "Malware payload (Formbook)", "value": "0fa1081253bb226bcc6f51c7bc817ba0c656ad9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688614822, "uuid": "e5444e74-e118-441a-baa0-1bc5873075b0", "comment": "Malware payload (Formbook)", "value": "cefa912740e08e2917b72994cadea0fbc0014a8a89fbcbd7acce687134e8da79fcd4d59cee2cf0b0969bd8a9e32e22bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614822, "uuid": "fb0538c1-7b2a-47aa-aa39-90e826832680", "value": "T12584123871D494A3F4268572297A87482FF3A2343421831F67643FAD7F52BA28D2F756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614822, "uuid": "ccf34caf-875d-4ae6-b867-67101e75e5a3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614822, "uuid": "7297194b-45fd-4d55-a9c5-7d2e61e9b748", "value": "6144:/Ya6rw42xgWR6S/OfkfPfbwMI+NHE+FFAJMVLfz85PotMSsZJeDc:/Y5w422WAS2G31Imk+FFEeLfzlmZUDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688614822, "uuid": "3a5a2cd3-e396-4b5c-bdd8-9e1ffccb8d82", "value": 371340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688614822, "uuid": "1734bf6b-128d-4e3a-820e-0f6a57bfbdaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688614822, "uuid": "76703203-4696-41e7-9147-d6d4fbcefd27", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22774.14982.29980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cc8095-1c3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688677013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677013, "uuid": "4c1d28fa-111c-4e69-9efd-c94458f42143", "comment": "Malware payload (Mirai)", "value": "1e9bb05cead460bfd20bc66b77e30a8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677013, "uuid": "f2197985-556a-43d3-940b-57dd22ef9668", "comment": "Malware payload (Mirai)", "value": "e53aa20fe91d0322c4b5fdbb1588b472ab5553a6eacb96687aea95a756eac715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688677013, "uuid": "8df6c143-98ef-485c-a706-23c37647d216", "comment": "Malware payload (Mirai)", "value": "c99be88b8ab62c635fc5859d4384687f1aa808b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }